Updated version – as of July 2026
Supply Chain Act in transition – what companies need to know now
The German Supply Chain Due Diligence Act has been accompanying companies since early 2023. Initially, it applied to companies with more than 3,000 employees, and since 2024, companies with 1,000 or more employees have also had to comply with legal requirements. But no sooner had the law come into force than it came under political pressure. Complete abolition of the law, pushed through by a CSU minister, was called for by his own party as soon as it was in opposition. The party is back in government in spring 2025, with talk of a radical cut.
Today it is clear: The LkSG will not be repealed, but amended in parts. The Federal Government presented a draft amendment at the beginning of September 2025, setting out the direction of travel. The government draft was introduced in the Bundestag on 29 October 2025 as Bundestag printed matter 21/2474 and remains in the parliamentary process.
The current situation
The scope of application remains unchanged. Companies with at least 1,000 employees are still required to review their supply chains. The definition of the supply chain also remains the same; a company’s own business operations, direct suppliers, and indirect suppliers must be taken into account, just as before. Likewise, the core due diligence obligations remain in place. These include risk analysis, a policy statement, preventive and remedial measures, the establishment of a complaint mechanism, comprehensive documentation, and the monitoring of risk management by the human rights officer. However, this 1,000-employee threshold applies exclusively to the national Supply Chain Act (LkSG) and must be distinguished from the EU-wide threshold under the CSDDD: following the first "Omnibus Package" (Directive (EU) 2026/470, in force since March 18, 2026), the CSDDD will in future apply only to companies with more than 5,000 employees and a global net turnover exceeding €1.5 billion.
What changes
The main change concerns the reporting obligation. Companies were previously required to report annually and on an ad hoc basis on their activities, particularly via the BAFA portal. Under the government draft of 3 September 2025 (BT-Drs. 21/2474), this obligation is to be abolished retroactively from 1 January 2023; however, the law has not yet been promulgated, although BAFA has already been applying the intended effect in administrative practice since autumn 2025.
Relevant adjustments are also being made in the area of sanctions. In the future, they will focus on serious violations. This includes, for example, when preventive measures are not taken or are not taken in a timely manner. Similarly, failure to implement remedial measures, even though a human rights violation has occurred or is imminent, will remain subject to sanctions. The absence of a complaint procedure will also continue to be penalised. However, an inadequate risk analysis will no longer be subject to sanctions. While it will remain mandatory, it will no longer carry an immediate threat of penalty. Likewise, sanctions for environmental risks will be dropped. According to the government draft, the number of punishable offences will be reduced from 13 to 4 (§ 24 LkSG-E); the Penalty framework remains at up to €800,000, or up to 2 % of global annual turnover for companies with a turnover of more than €400 million, plus a possible ban on public procurement contracts for up to three years. By contrast, the CSDDD provides for its own upper limit on fines, which has been reduced under Omnibus I to a maximum of 3 % of global net turnover (previously 5 %).
The due diligence obligations of companies remain, and the protection of human rights is clearly paramount.
A look at Brussels
The amendments to the LkSG are closely linked to developments at European level. The Corporate Sustainability Due Diligence Directive, or CSDDD, has been in force since 25 July 2024.
The previously unresolved questions have now also been settled: the due diligence obligations continue to apply, in principle, to the entire chain of activities. However, the risk-based approach has been strengthened: where the risk situation is comparable, companies may prioritise direct business partners; requests for information from companies with fewer than 5,000 employees are intended only as a last resort for in-depth assessment.
The German draft amendment was introduced in the Bundestag independently of the European trilogue on 29 October 2025 as Bundestag printed matter 21/2474 and was debated there at first reading on 16 January 2026. The LkSG amendment is intended as a standalone national transitional solution until the LkSG is replaced by national implementation of the CSDDD; under Omnibus I, this implementation must be completed by 26 July 2028, with the CSDDD rules applying uniformly from 26 July 2029.
What does this mean for businesses
Companies should not be lulled into a false sense of security by the political debate. Until further notice, the LkSG will continue to apply in its current form. All due diligence obligations must be fulfilled.
In the medium term, the reporting obligation will lapse until the CSRD rules come into force from 2027 onwards, and only for companies that achieve more than €450 million in turnover in addition to the 1,000-employee threshold; many smaller companies subject to the LkSG will no longer be subject to any comparable reporting obligation from 2027. The number of sanctions will be reduced, but the risk of severe violations remains high. In the long term, European regulation will take over – after the first omnibus package, however, with a smaller circle of addressees, longer transition periods and a reduced upper limit for fines, thus overall weaker rather than stricter standards than originally planned.
Conclusion
The Supply Chain Act remains an integral part of the corporate framework. Even if the external reporting obligation is to be abolished under the government draft, companies should not neglect their processes. Effective risk management, clear preventive mechanisms and robust documentation remain essential.
(The male form used refers to all persons, regardless of gender.)
