LkSG After the Reform: What Suppliers Still Need to Provide

A German customer has sent you an LkSG questionnaire, or written LkSG clauses into a contract — and meanwhile you may have read that Germany is abolishing the law. Both things are real, and they're less contradictory than they sound. The reform removed reporting and softened enforcement; it did not remove your customer's duty to check its supply chain. That's why the questionnaire on your desk is still a live request, and this guide covers exactly what to do with it.

This guide reflects the position as of mid-2026. The replacement law is still pending, so details will move — the official German government LkSG page tracks the current state.

What the LkSG is

The Lieferkettensorgfaltspflichtengesetz (LkSG) — the German Supply Chain Due Diligence Act — requires larger companies operating in Germany (those with 1,000 or more employees) to carry out human-rights and environmental due diligence across their supply chains. In practice that means running a risk management system, performing regular risk analyses, taking preventive and remedial measures where risks or violations show up, operating a complaints channel, and documenting all of it.

Because "due diligence across the supply chain" necessarily includes suppliers, the law has always reached you indirectly: your customer can only assess its supply-chain risk by asking you questions, collecting your policies, and getting your commitment to standards.

What changed in 2025 — and what didn't

Germany's coalition government has decided to repeal the LkSG and replace it with a law implementing the EU CSDDD in a deliberately "bureaucracy-light" way. Two concrete changes have already landed:

• The annual reporting obligation was abolished — retroactively. In-scope companies no longer have to file compliance reports, and BAFA (the supervising authority) stopped reviewing reports on 1 October 2025.
• Enforcement was scaled back. Until the CSDDD-implementing law takes over, sanctions apply only to severe human-rights violations, not to the broader catalogue of duties (reform analysis).

Here's the part the headlines skip: the core due diligence duties remain in force. In-scope German companies must still run risk management, carry out regular risk analyses, and take preventive and remedial measures in their supply chains. What was cancelled is the paperwork to the authority and most of the penalty regime — not the underlying obligation to know and manage supply-chain risk.

The EU successor is also not imminent for most companies. After the EU's "Omnibus" delay, the CSDDD applies from mid-2029 for the largest companies, with others following later. So German customers face several years in which the LkSG duties still bind them, followed by an EU framework that expects broadly the same things.

Stopped vs. continues, at a glance

Stopped:

• Annual compliance reports to BAFA (abolished retroactively; BAFA stopped reviewing on 1 October 2025)
• Sanctions for most breaches (only severe human-rights violations remain sanctionable for now)

Continues:

• Risk management systems and regular risk analyses at in-scope companies
• Preventive and remedial measures across their supply chains
• Complaints/grievance channels
• Supplier questionnaires, codes of conduct, and contract clauses — the tools companies use to do all of the above

Why you're still getting LkSG questionnaires

If reporting is gone, why does your customer keep asking? Four reasons:

• Their due diligence duty continues. Identifying and addressing human-rights and environmental risks in the supply chain means understanding you — there is no way to run a risk analysis without supplier data.
• They still document internally. No filing to BAFA doesn't mean no records. Companies keep evidence of their due diligence — for their boards, their auditors, and the day the replacement law arrives — and your answers feed it.
• They're converging on the CSDDD. The EU framework replacing the LkSG carries similar (in some ways broader) supply-chain expectations, so customers keep their supplier-assessment machinery running rather than dismantling and rebuilding it.
• Contracts already require it. Clauses committing you to standards, cooperation, and audits don't lapse because a reporting form was switched off.

Treat an LkSG questionnaire as a real, current request — not a leftover from a cancelled law. Expect the same requests to keep coming, gradually relabelled from "LkSG" to "CSDDD" over the next few years.

Are you in scope directly?

Almost certainly not. The LkSG's obligations fall on companies with 1,000+ employees operating in Germany — not on their smaller suppliers, and not on suppliers outside Germany. As an SME supplier you have no LkSG filing duty, no BAFA relationship, and no need for your own LkSG compliance programme. What you have is a customer who is in scope and who needs assurances from you. It's the same pattern as the CSDDD: the legal duty sits upstream; the requests flow down the chain.

What your customer actually needs from you

An LkSG-driven request typically asks you to demonstrate:

• Human rights — no child or forced labour, fair wages, reasonable working hours, non-discrimination, freedom of association.
• Health & safety — safe working conditions, relevant policies and records.
• Environmental basics — compliance with environmental obligations; sometimes specific issues (such as certain hazardous substances) named in the law.
• A grievance or incident channel — a documented way for workers or third parties to raise concerns.
• Your own supply chain — that you pass reasonable expectations on to your suppliers, often via a supplier code of conduct.
• A signed commitment — acknowledgment of your customer's code of conduct or supplier standards.

How to respond efficiently

You don't need an LkSG compliance regime. You need the standard, honest ESG groundwork — assembled once, reused for every customer:

1. Core policies — human rights, health & safety, environmental, anti-corruption, and a supplier code of conduct. If you're starting from zero, ESG policy documents covers what each one needs to say.
2. Labour documentation — evidence of fair wages, working hours, and voluntary employment.
3. A grievance route — however simple, written down and reachable.
4. Basic supply-chain awareness — where your key inputs come from and who your critical suppliers are.
5. Honest gap-handling — where you don't have something, say so and describe your plan. A dated, credible plan reads far better than silence.

This is the same foundation covered in small supplier ESG requirements, and it's answerable from a reusable response system — which also covers IntegrityNext, the platform many German buyers use to collect exactly this.

If you want to know how much work a questionnaire represents before committing a week to it, the free time estimator gives you a realistic figure based on what you already have in place.

What not to do

• Don't assume it's cancelled. The reporting duty is gone; the questionnaires aren't. Ignoring one can still cost you the contract — your customer's risk analysis flags unresponsive suppliers.
• Don't build your own LkSG compliance regime. You're not directly in scope; answer your customer's requests instead.
• Don't invent policies or data to pass. A fabricated answer that unravels in a follow-up or audit is worse than an honest gap.
• Don't treat LkSG, CSDDD, and IntegrityNext as separate projects. They ask for the same underlying human-rights and environmental facts — answer them all from one base.

The bottom line

Germany decided to repeal the LkSG and fold it into a lighter law implementing the EU CSDDD. Reporting to BAFA is abolished and enforcement is limited to severe cases — but the due diligence duties themselves remain in force, so your German customers still need risk data, policies, a code-of-conduct signature, and a grievance route from you. The request that lands on your desk is real. Meet it with solid, honest groundwork, and the same materials will answer the CSDDD-era questionnaires that follow.