Extended supply chain due diligence obligations for companies active in Germany

Ⅱ. Protections / prohibitions

The prohibitions the LkSG is designed to ensure that human rights, workers’ rights and the environment as protected under international conventions not be violated. In particular, they include:

• the prohibition of child labor (ILO Conventions no. 138, 182);
• the prohibition of racial, ethnic and/or religious discrimination (ILO Convention no. 100, 111);
• prohibition of slavery and forced labor (ILO Convention no. 29, 105, UN Human Rights Convention);
• prohibition of violating the freedom of coalition and minimum labor standards (ILO Convention no. 87, 98; International Covenants on Human Rights);
• prohibition of “land grabbing” and destruction of livelihoods; and
• prohibition of the use of certain hazardous chemicals (Minamata Convention; Stockholm Convention, Basel Convention).

While the LkSG does not require companies to actually be successful in preventing any and all violations of these prohibitions by suppliers, it does require them to exert “appropriate” efforts. What specifically is considered “appropriate” depends on various factors such as the size of the company, the sector and the countries in which it is active, and in particular the degree of immediacy/intermediation between the company and the supplier.

Ⅲ. Obligations according to supply chain levels

When determining the applicable obligations and the degree of due diligence required, (at least) three levels of the supply chain can be distinguished:

• 1. Company proper, i.e. the company itself and its subsidiaries (including foreign subsidiaries) in which the company holds a controlling interest (“Tier 0”);
• 2. Immediate supplier, i.e. suppliers that have a contractual relationship with the company and directly provide goods/services (“Tier 1”); and
• 3. Intermediate supplier, i.e. suppliers that have an indirect contractual relationship in the extended supply chain (“Tier 2”).

As detailed below, the obligations imposed by the LkSG differ according to the tiers. However, the law requires a substantial rather than just a formal analysis. Bad faith contractual arrangements that aim at circumventing the LkSG by artificially constructing more indirect contractual relationships, thereby rendering all suppliers (only) intermediate/Tier 2 suppliers and limiting LkSG due diligence obligations will be disregarded (§ 5(1), 7(1) LkSG).

On the Tier 0 level, the company is subject to the strictest obligations. The LkSG assumes that within its own sphere of influence, the company has the most control and must therefore bear the most responsibility. If, on the other hand, (potential) violations of human rights or environmental protections are located at the far end of the supply chain, the company has less control, which is taken into account in the strictness of the statutory obligations. The obligations, which are therefore somewhat staggered depending on the levels/Tiers described above, can be structured into separate categories:

a. Risk management

Risk management measures must be implemented in all relevant business procedures (§ 4 LkSG). In particular, responsibility and accountability for risk management must be clearly defined, including by the designation of a human rights officer.

Consequently, corporate regulations may need to be reviewed and amended to implement new reporting obligations and allow the human rights officer to adequately perform their role.

b. Risk detection

The company must conduct a risk analysis to determine the type and degree of risk of human rights and environmental violations that exist in its operations and supply chain (§ 5 LkSG). This analysis must be conducted at least annually and generally includes at least a mapping of all relevant supply relationships, a risk determination on the basis of both abstract and concrete criteria (abstract: countries, sectors etc.; concrete: individual supplier reputation, due diligence result and performance). The results of the analysis must be communicated to the relevant decision-makers, e.g. the board of management or head of procurement.

Moreover, the company must implement a complaint procedure (Beschwerdeverfahren – § 8 LkSG). Similar to a whistleblowing system as a system for employees, the complaint procedure must enable internal and external complainants to bring risks and violations in connection with human rights and environmental protections to the attention of the company. The company must publish the basic rules governing the complaint procedure and ensure that the procedure is easily accessible. Complaints must be treated confidentially and good faith complainants must be protected from retaliation. At least annually, the company must audit the effectiveness of its complaint procedure.

Companies with pre-existing whistleblowing systems should take particular care to seamlessly integrate the existing system with the new complaint procedure.

c. Risk prevention and mitigation

The LkSG requires companies to take various risk prevention and mitigation measures (§ 6 LkSG). As a baseline, company top management must issue a basic strategy regarding human rights compliance.

While companies can take their pre-existing Codes of Conduct as a foundation for the LkSG compliance strategy, the latter will require a lot more detail. In particular, it should include a description of the compliance mechanisms as required under the LkSG, the human rights and environmental risks relevant to the company, and management`s expectations regarding the behavior of employees and suppliers in this regard.

Moreover, the company must take measures to implement these expectations, in particular by obtaining contractual warranties, conducting trainings and including auditing and control mechanisms in supply agreements. Employment agreements may also need to be amended.

Once the company recognizes that a violation of human rights or environmental protections in its own business or at controlled subsidiaries as described above, or its immediate supply chain has occurred or is imminent, the company must take measures without undue delay to prevent, stop or mitigate the extent of the violation (§ 7 LkSG).

In its own business or at controlled subsidiaries as described above, the measure must stop the violation, unless it occurs outside of Germany or at subsidiaries, in which case the measures must stop the violation only “as a rule”, i.e. in typical circumstances, with possible exceptions for atypical cases.

Where the violation occurs or is threatened to occur at an immediate supplier, i.e. on Tier 1, and it cannot be ended immediately, the company must create a remediation concept which includes a timeline. As part of such a concept, the company and the supplier can for example create and implement an action plan to end or minimize the violation, come together in industry groups to exert more pressure on the actor behind the violation (e.g., a third party, intermediate supplier) or temporarily suspend the business relationship. The termination or complete discontinuation of the business relationship with the supplier is only mandatory if the violation is particularly grave, the implementation of a remediation concept does not actually result in remediation, and there are no less drastic measures available, also taking into account potential measures to increase the company`s influence over the situation, while details and/or examples of such measures are not clearly defined or provided.

With regard to Tier 2, the risk analysis, prevention and mitigation measures are only triggered if the company knows of factual indications of a human rights or environmental violation at such intermediate supplier, i.e., the obligations apply (only) in relation to specific events instead of continuously.

In any case, the effectiveness of risk prevention and mitigation measures must be tested at least annually.

d. Documentation and reporting

The company must document its compliance with its due diligence obligations and retain this documentation for at least seven years (§ 10 LkSG). Moreover, it has to publish an annual report on its compliance measures on its website.

Ⅳ. Enforcement

Enforcement of the LkSG is the responsibility of the German Federal Office for Economy and Export Control (Bundesamt für Wirtschaft und Ausfuhrkontrolle, “BAFA”). The BAFA is authorized to conduct investigations on its own initiative when it perceives a risk of violations against the prohibitions mentioned above. Compared to other supervisory authorities, the BAFA currently makes a very active, hands-on impression, approaching a number of companies directly and enquiring after their LkSG compliance.

The BAFA can review the human rights reports submitted to it, order the surrender of documents and other information and conduct raids. When compliance measures are insufficient, the BAFA can also order the company to take specific measures and threaten monetary penalties. In case of actual – even negligent – violations, it can also impose fines up to EUR 800,000 or 2% of annual global turnover of all group entities acting as an “economic unit”. Especially for large company groups, this can lead to very high fines.

In addition, companies can also be excluded from participating in public tenders for up to three years if a grave violation has officially been determined (typically requiring a fine of at least EUR 175,000).

Violations of the LkSG may also trigger liability for civil claims. Consumers may for example argue that manufacturing in violation of the LkSG, including insufficient reporting, qualifies as a defect of the final product. Competitors may also raise claims for injunctive relief or damages on the basis that violations of the LkSG lead to unfair competitive advantages. Finally, third parties (e.g., manufacturing staff whose human rights were violated or inhabitants of polluted environments) may raise claims for injunctive relief or damages under tort law. Considering that Germany very recently implemented the Representative Actions Directive (Directive (EU) 2020/1828), thereby bringing the concept of “class actions” to Germany, such claims may be litigated more often in the future. In addition, German unions and NGOs can raise claims on behalf of persons claiming a violation of their vital rights (§ 11 LkSG). Some examples of recent movements based on LkSG are as follows.

• Multinational retailers are already facing complaints by an NGO advocating for women’s rights and a union in Bangladesh, who argue that the companies did not fulfil their due diligence obligations with regard to their Bangladeshi textile suppliers. In particular, the complainants allege that the companies should have acceded to the so-called Bangladesh Accord※1 regarding health and safety in the textile industry, and that the companies’ suppliers did not observe the workers` freedom to associate and did not provide for adequate whistleblowing mechanisms.
• Several automotive companies also face complaints by an NGO with regard to their suppliers from the Chinese Xinjiang region. The complaints allege that the companies did not observe their due diligence obligations with regard to the risk of forced labor of Uigurs in the region.
• Recent strikes of Polish lorry drivers also drew the BAFA’s attention to German companies whose suppliers included the companies violating the lorry drivers` rights to rest periods and salary payments.

Even if individuals do not choose to litigate their claims, NGOs may lodge a complaint with the BAFA, which can then take action to address the complaint if it is justified.

Investigations and litigation in the area of human rights and the environment can of course also have a significant impact on a company`s reputation.

Ⅴ. Measures and outlook

In summary, German and foreign companies with at least 1,000 employees in Germany will face increased scrutiny on their human rights and environmental protection measures as from 1 January 2024.

Companies with a significant business presence in Germany should therefore analyze if they are at risk of being subject to the LkSG and therefore need to comply with the obligations set out above.

Companies that are subject to the LkSG will need to review and likely amend their compliance and risk management measures. The practically most important points are:

• 1. the risk analysis exercise, including supply chain mapping;
• 2. the compliance strategy to be issued by top management;
• 3. the complaint procedure, including the underlying rules and complaint channels to be made public;
• 4. the designation of a human rights officer;
• 5. the introduction of compliance warranties and audit/control provisions in supply agreements; and
• 6. the publication of annual reports.

The bigger the company and the more complex its supply relationships, the more time and effort these measures are likely to take. So companies are well advised not to wait too long before starting implementation.