I. Background

“Protecting the rights of people who produce goods for Germany” is the goal of the German government’s draft law on corporate due diligence in supply chains. The sales of domestic companies are partly based on the value added by the companies ahead of them in the supply chain. Therefore, according to the government’s draft Supply Chain Act, domestically based companies should assume responsibility for respecting internationally recognized human rights along the supply chain they use.
The Supply Chain Act passed by the Bundestag pursues a system change by standardizing obligations of domestic companies within their supply chain: Moving away from a voluntary commitment by companies and toward a legal obligation with enforcement mechanisms.

II. Essential Regulatory Content

1. Which companies are affected?

Irrespective of their legal form, the addressees of the regulation are companies with their registered office in Germany and domestic branches (§ 13d German Commercial Code (Handelsgesetzbuch – HGB)), provided they generally employ at least 3,000 employees in Germany or, from 1 January 2024, at least 1,000 employees. Employees stationed abroad are included in this. In the case of affiliated companies (§ 15 German Stock Corporation Act (Aktiengesetz – AktG)), the employees of all group companies employed in Germany shall be taken into account when calculating the number of employees of the parent company.

2. What is a supply chain?

The central concept of a supply chain as defined by the Supply Chain Act refers to all of a company’s products and services and includes all of the steps in Germany and abroad that are required to manufacture the products and provide the services, starting with the extraction of the raw materials and ending with the delivery of the final product to the end customer.

3. Which legal positions are protected?

The Supply Chain Act serves to protect internationally recognized human rights in accordance with the Conventions for the Protection of Human Rights listed in numbers 1 to 11 of the Annex to the Act. In addition, the Act also stipulates environmental obligations. The legal positions essentially protected result from a catalog of prohibitions, which is supplemented by a catch-all clause. The explicit prohibitions include, among others, the prohibition of child labor, forced labor, all forms of slavery, disregard of applicable occupational health and safety obligations, unequal treatment of employees, and the prohibition of withholding a fair wage. The catch-all clause, on the other hand, is intended to cover all cases that are not already covered by an express prohibition and that violate the protected legal positions in a particularly serious manner.

4. What due diligence obligations exist for companies?

Companies are required to conduct “appropriate due diligence” on human rights and environmental issues in their supply chains. This includes the objectives of (i) preventing human rights-related or environmental risks, (ii) minimizing such risks, and (iii) ending the violation of human rights-related or environmental obligations. In this respect, the due diligence obligations establish a duty of effort rather than a duty to succeed and cover the entire supply chain, with the companies’ responsibility being graded according to the degree of influence they are able to exert. The scope of responsibility is then measured on the basis of three levels, which are subdivided into action “within the company’s own business area”, action “by direct suppliers” and “by indirect suppliers”. The extent of the action owed to fulfill the due diligence obligations can be determined using the following standard set out in the government explanatory memorandum:
“The greater a company’s ability to exert influence, the more likely and severe the expected violation of the protected legal position, and the greater a company’s contribution to causation, the greater efforts a company can be expected to make to avoid or stop a violation. The more susceptible a business activity is to human rights risks by product and production site, the more important it is to monitor the supply chain.”
Due diligence requirements subsequently required include:

a.) Establishment and monitoring of risk management

As a first step, affected companies must establish a risk management system to identify human rights and environment-related risks, and to prevent, end or minimize violations of human rights-related or environment-related obligations.
To fulfill this task, a responsible person must be defined who is to monitor risk management. This can be done, for example, by establishing the position of a human rights officer who reports directly to management. The management also has a duty to provide information. It must inform itself regularly, i.e. at least annually, as well as on an ad hoc basis about the work of the person responsible.

b) Regular risk analysis

As a matter of principle, the company should conduct an annual risk analysis to identify, assess and prioritize the human rights and environmental risks for its own business unit and for its direct suppliers. Occasion-related risk analyses are necessary when changes in the risk situation in the supply chain can be expected, e.g. due to the introduction of new products, projects or business areas. In this respect, the risk analysis serves as a basis for determining effective preventive and remedial measures.

c) Preventive measures

With the help of preventive measures, companies – based on the findings of the risk analysis – prevent the risk of human rights violations occurring in their own business operations and at direct suppliers. Preventive measures must therefore be taken if the company has identified risks with regard to the legal positions to be protected. The design of the preventive measures includes the adoption of a human rights strategy and the anchoring of the preventive measures in the company’s own business area as well as vis-à-vis direct suppliers. In detail:
The company is responsible for issuing a fundamental statement outlining its strategy for protecting human rights. The strategy on human rights must (i) describe the due diligence process, (ii) identify the human rights and environmental risks that are particularly relevant to the company, and (iii) set out the human rights and environmental expectations that the company has of its employees and suppliers in the supply chain.
In its own business area, the company must anchor appropriate preventive measures in order to integrate the human rights strategy into everyday processes and decisions – particularly in the areas of purchasing and procurement. This includes, among other things, the training of the company’s own employees in the relevant business areas.
A corresponding anchoring must also take place vis-à-vis direct suppliers. This includes the selection of a potential contractual partner and its obligation (including contractual control mechanisms) to comply with the required human rights and environmental expectations in its own business area and to address them appropriately along the supply chain.

d) Remedial measures

If a company determines that a violation of one of the legal positions to be protected has already been realized or is imminent, it must take appropriate remedial measures. In its own business area, the respective remedial measure must lead to the termination in Germany as well as, as a rule, to the termination of the violation abroad. If a violation is in the business of a direct supplier, the company should first endeavor to work with the supplier to remedy the violation in accordance with the principle of “enablement before withdrawal (Befähigung vor Rückzug)”. Termination of the business relationship, on the other hand, should only be ultima ratio.

e) Complaint procedure

The company must set up a complaint procedure that makes it possible to point out human rights and environmental risks or violations that have already occurred in the company’s business area and that of a direct supplier. The complaint procedure must be standardized, publicly accessible in text form, and provide identity protection for “whistleblowers”.

f) Indirect suppliers

A company is required to take action with respect to its indirect suppliers if it becomes “aware in a substantiated manner” of possible violations of human rights-related or environmental obligations. Substantiated knowledge is given if there are actual indications of a possible violation of the protected interests. The measures to be taken in such cases include, among others, an immediate risk analysis and appropriate preventive measures, such as the implementation of control measures.
A company must also set up a complaint procedure in such a way that it is also possible to point out risks related to human rights and the environment or violations that have already occurred in the business area of an indirect supplier.

g) Documentation / reporting obligation

The companies concerned must provide proof that they have fulfilled their obligations. Companies must prepare an annual internal report and submit it to the Federal Office of Economics and Export Control (Bundesamt für Wirtschaft und Ausfuhrkontrolle – BAFA). All documentation has to be retained for at least seven years from the date of creation. In addition, the company must prepare an annual external report and make it publicly available free of charge on the company’s website for a period of seven years.

5. Regulatory control and enforcement

The Federal Office of Economics and Export Control (BAFA), in its capacity as the competent authority, monitors compliance with the due diligence requirements and can take action in this regard ex officio or upon application. The monitoring includes, on the one hand, the verification of the reporting obligation. The BAFA can, for example, demand that the report be improved if the requirements for it are not met. On the other hand, the monitoring includes a risk-based review of the extent to which the other obligations under this Act have been implemented. For this purpose, the BAFA is authorized to issue the appropriate and necessary orders and measures to detect, eliminate and prevent violations of the corporate due diligence obligations. The BAFA can, for example, summon persons or order the company concerned to perform specific actions in order to fulfill its obligations, but it can also gain access to companies (searches) and demand disclosure of files.

6. Sanctions

In the event of failure to comply with due diligence requirements, the Supply Chain Act mainly provides for sanctions in the form of coercive penalties and fines. A coercive penalty may be imposed up to an amount of EUR 50,000. Fines, on the other hand, can amount to up to two percent of the group’s average annual worldwide sales – for companies with worldwide group sales of more than EUR 400 million. In individual cases, this can lead to significant fines in terms of amount. Furthermore, it is also possible to exclude the company from receiving public contracts. Civil liability, on the other hand, is not created by a violation of the obligations under this Act.

III. Consequences and outlook

The implementation of the German Supply Chain Act will entail additional administrative work for the companies concerned. Compliance with the obligations requires the establishment and permanent maintenance and monitoring of a risk management system by employees responsible for this. In the event of failure to comply with the legal requirements, companies also face the imposition of fines and the risk of being publicly accused of failing to respect human rights. Affected companies are therefore well advised to deal with the requirements of the law at an early stage and to ensure legally compliant and efficient risk management. This requires the creation of comprehensive policies and compliance processes, including training employees and monitoring suppliers in the supply chain.
It remains to be seen when the planned EU Supply Chain Act – with presumably considerably stricter regulations – will come into force, which will lead to a corresponding amendment of the German Supply Chain Act.