Supply chains and business partners

COMPLIANCE & RIGHT · TREATY

The four practical examples · Send request

Companies must distinguish which due diligence obligations they directly meet and which requirements customers or business partners contractually apply to them. An appropriate counterparty audit combines risk information with feasible measures. We advise on legal classification, supplier contracts and the organisation of risk-based testing processes.

Typical counseling events

A customer requires the signing of a supplier code, extensive guarantees or extensive self-information.
Your company must examine the scope of the supply chain care obligation law.
References to labour law, human rights or environmental violations are received from a supplier.
A delivery relationship should be re-established, reviewed or adjusted due to identified problems.
Existing processes should be adapted to European developments.

Direct obligations under the LkSG

According to § 1 the supply chain care obligation law covers companies with usually at least 1,000 employees in Germany under the conditions mentioned there. The calculation may include group assignments, posted workers and longer-term temporary workers. The audit is carried out on the basis of the concrete corporate structure.

The law requires appropriate care with regard to certain human and environmental risks. The instruments include risk management, responsibilities, risk analysis, prevention, remedy and a complaint procedure. Requirements for the own business unit, direct and indirect suppliers must be distinguished. It is not a flat-rate guarantee that there will never be an infringement worldwide.

Differentiating reporting obligations, implementation and reforms

According to the published official information, BAFA has terminated the audit of the company reports in the course of the planned LkSG amendment. This practice must be distinguished from a change in the law. The published § 10 LkSG also contains documentation and report regulations. Therefore, internal documentation and the material due diligence obligations must not be treated as void. For specific reporting and publication obligations, the applicable legislation and the current official information shall be separately harmonized.

The European Supply Chain Directive (CSDDD) has been amended, inter alia, by Directive (EU) 2026/470. According to the current information provided by the European Commission, national transposition measures are foreseen until 26 July 2028 and will apply in principle from 26 July 2029; for certain reporting measures separate dates apply. These future EU requirements do not automatically replace the current German obligations.

What does this mean for smaller suppliers?

A company outside the legal scope of application will not become directly obliged under the LkSG by a customer questionnaire alone. However, contractual information and participation obligations may arise. They should be properly limited and compatible with actual opportunities for influence and information.

In particular, we examine flat-rate assurances on the entire supply chain, unlimited audit and access rights, exemptions, contractual penalties and termination clauses. Disclosure of trade secrets and personal data also requires an appropriate framework. Committed companies cannot completely shift their own responsibilities to suppliers through contractual clauses alone.

Designing counterparty audit risk-based

Initial data: record activity, locations, products, ownership structure and function of the business partner.
Risk: Consider country, sector and activity-related information as well as specific information.
Test depth: seek specific documentation, evidence or further information in the event of increased risk.
Actions: agree on responsible parties, deadlines and verifiable improvements.
Tracking: Check implementation and effectiveness and take changes into account.

Human due diligence, sanction testing, money laundering prevention and corruption prevention can build on common information. However, their legal requirements must be examined separately. A single test seal does not complete all the obligations.

Our services and work results

Scope review and legal stocktaking of supply chain processes.
Examination and design of supplier codes, self-information and contractual clauses.
Development of a graduated test and escalation process.
Legal monitoring of complaints, indications and necessary corrective measures.
Preparation of reliable documentation and training of purchasing and management.

Common questions

Do all suppliers have to be tested equally intensively?

Nope. The measures are designed to fit the risk situation and legal requirements. A reasonably justified risk-based approach is regularly more useful than an indiscriminate collection of comprehensive questionnaires.

Does a small supplier have to accept any customer clause?

Nope. Content, adequacy and practical feasibility are negotiable. Particularly far-reaching guarantees and liability acceptances should be examined before signing.

Does the business relationship have to be terminated in any breach?

Nope. The nature and severity of the infringement, its potential for influence and appropriate remedial measures shall be assessed. The LkSG builds on special prerequisites; it is not an automatic first step.

What documents are helpful for the consultation?

Company and employee structure, supplier overview, existing risk analyses, codes, customer requirements and concrete contracts. In the event of an incident, the previous correspondence and measures already taken.

Check customer requirements before signing

Suppliers often receive questionnaires, codes of conduct and far-reaching assurances. Before signing the contract, it should be clarified which requirements concern statutory obligations of the supplier, which the customer wishes to pass on contractually and which evidence is actually available. Not every customer requirement remains subject to a legal obligation of the notified company.

Particular care must be taken to ensure that all sub-suppliers, unlimited audit rights and flat-rate liability commitments are respected. An appropriate agreement describes needed support, confidential information, possible controls and how to deal with identified problems. The contractual partner's own legal responsibility cannot be carried out solely by signing the contract.

Clearing out abnormalities with a graduated procedure

A lack of evidence must be distinguished from a concrete reference to an infringement. Depending on the risk, information is requested, contradictions are clarified or additional measures agreed. Jurisdiction, reason for decision and date should be recorded. An automatic termination of any conspicuous business relationship can be just as inappropriate as a release without review.

The requirements for reasonable care are based on the legal criteria of the company. § 3 LkSG. For the practical process, there is a Business partner checklist and the information on Contracts and distribution Ready. In the case of cross-border supply chains, additional Sanctions and export controls to be examined.

Legal basis and further official information

Legal status: 1 November 2026. The classification of concrete facts requires an examination of the applicable regulations and circumstances.

Four practical examples

The following fictitious cases illustrate typical examination questions. The concrete solution depends on the circumstances of the individual case.

01 · Questionnaire of a large customer

A small supplier is to guarantee compliance with all global supply chain rules. Own legal obligations are separated from contractual customer requirements and the commitment is limited to verifiable content.

02 · Reference to health and safety deficiencies

A report concerns a supplier's production site. Plausibility, concern and possibilities of influence are examined; a follow-up action plan may be required.

03 · Different supplier risks

A regional office supplies supplier and a raw material-intensive foreign supplier are not schematically examined. Risk factors determine depth, evidence and updating rhythm.

04 · Audit with personnel data

A customer requires complete employee lists of the supplier. Necessity, data protection and alternative evidence will be examined before sensitive documents are passed on.

Your next step

Do you want to transfer the requirements to your company or have a specific process checked? A brief description and a reference to existing deadlines are sufficient for the first contact. We shall vote on the scope of examination and compensation prior to commissioning.

Send request without mandatory fields →