A multinational group with German operations receives notice from the national enforcement authority. It has failed to document human rights risk assessments across its upstream supply chain. The consequence is a fine calculated as a share of global annual turnover – not just German revenue. This is the reality that Germany's supply chain due diligence legislation now creates for large international businesses and their subsidiaries registered in the Handelsregister (German Commercial Register).
Germany's supply chain due diligence legislation – commonly referred to as the Lieferkettensorgfaltspflichtengesetz (Supply Chain Due Diligence Act) – entered into force in January 2023. It initially applied to companies with at least 3,000 employees in Germany. From January 2024, the threshold was extended to companies with at least 1,000 employees in Germany. Capturing a significantly broader group of international businesses and their German entities. This includes those structured as a GmbH (private limited company under German corporate legislation).
This alert summarises what changed, which business categories are now in scope, and the immediate compliance steps that international groups must take.
What the legislation requires and how it has expanded
Germany's supply chain due diligence legislation imposes a structured set of obligations on in-scope companies. These obligations sit at the intersection of German commercial legislation, human rights policy, and environmental standards. They are enforced by the Bundesamt für Wirtschaft und Ausfuhrkontrolle (Federal Office for Economic Affairs and Export Control), which acts as the designated competition authority-adjacent supervisory body for this regime.
The core obligations fall into five categories. First, companies must establish a risk management system to identify human rights and environmental risks across their own operations and those of direct suppliers. Second, they must conduct an annual risk analysis. Third, where risks are identified, preventive and remedial measures must be implemented. Fourth, companies must establish a grievance mechanism accessible to affected parties. Fifth, they must publish an annual due diligence report.
The legislation targets conduct beyond Germany's borders. A parent company headquartered in the Netherlands or the United Kingdom, operating through a German GmbH subsidiary, is in scope if the German entity meets the employee threshold. This extraterritorial reach surprises many international groups. The Bundesgerichtshof (Federal Court of Justice of Germany) has not yet issued definitive rulings on all aspects of the act's scope, but enforcement practice is developing rapidly.
Importantly, the act addresses direct suppliers as a primary focus. Obligations regarding indirect suppliers are triggered only when a company obtains substantiated knowledge of a potential violation further down the chain. This is a meaningful distinction. It limits the compliance burden at the indirect tier – but only when the company can demonstrate it had no prior indication of risk.
From a competition law perspective, the act interacts with existing obligations around market dominance and procurement practices. Large buyers using supply chain audit requirements as a barrier to market entry may face scrutiny under German competition legislation. The Bundeskartellamt (German Federal Cartel Office) has signalled awareness of this tension. Companies should ensure that compliance programmes do not inadvertently replicate conduct associated with cartel-like coordination among industry peers on supplier standards.
For groups with parallel obligations under EU-level corporate sustainability due diligence legislation – which builds on the German model – the national act also serves as a preparatory compliance baseline. Aligning domestic German compliance with the broader EU trajectory now is more efficient than running two separate programmes sequentially.
To discuss how Germany's supply chain due diligence obligations apply to your group's structure, contact us at info@ferrazwhitmore.com.
Who is affected: threshold criteria and international group structures
The employee threshold is the primary trigger. As of January 2024, any company with its registered seat or principal place of business in Germany, and with 1,000 or more employees in Germany, falls within scope. This includes employees placed through temporary work arrangements counted under German employment legislation.
For international groups, the key question is whether the German entity. whether structured as a GmbH or another corporate form registered in the Handelsregister. independently meets the threshold. Alternatively. Whether the group counts employees on a consolidated basis. Under the current legislation, the threshold is applied at the level of the German legal entity. Headcount aggregation across the group does not automatically bring a smaller subsidiary into scope. However, a German holding company that employs staff on behalf of the group may cross the threshold even if operations are spread across multiple subsidiaries.
Foreign companies without a German registered entity but with a branch operating in Germany are also potentially in scope, depending on how the branch is structured and whether it employs personnel directly. Practitioners advising on German law consistently note that this is an area where formal legal analysis – not commercial assumption – is required before concluding that an entity is out of scope.
The act also captures non-German parent companies indirectly. Where a foreign parent directs the conduct of a German subsidiary that is in scope, the parent's instructions and procurement policies can create liability exposure for the German entity. Groups operating through a holding structure should review whether upstream policy decisions could trigger obligations at the German operating level.
Companies with pending merger notification filings or recent acquisitions of German businesses should prioritise post-closing supply chain compliance integration. An acquired German entity that meets the threshold carries compliance obligations from day one of acquisition. Failure to identify this during due diligence is a common and costly oversight.
Groups that have implemented a leniency programme or internal whistleblower mechanism for competition law purposes may be able to repurpose those structures as the grievance mechanism required under the supply chain act. This integration can reduce duplication – but the two systems serve different purposes and must be separately documented.
For a broader view of how corporate disputes and enforcement actions interact with supply chain compliance in Germany, see our analysis of corporate disputes in Germany.
Immediate actions for international groups
Groups that have not yet assessed their exposure under the German supply chain legislation should treat this as an urgent priority. The enforcement authority has moved beyond initial guidance and is conducting active compliance reviews. Fines can reach up to two percent of global annual turnover for the largest companies. In addition, companies fined above a defined threshold can be excluded from public procurement in Germany for up to three years.
Five immediate steps are recommended for international groups.
- Confirm entity scope. Identify every German entity registered in the Handelsregister and determine whether it independently meets the 1,000-employee threshold. Do not assume group-level headcount is the relevant measure.
- Audit existing risk management documentation. Review whether annual risk analyses have been conducted, documented, and retained. The Amtsgericht (local court) level enforcement mechanisms include document production requests. Gaps in documentation are treated as evidence of non-compliance.
- Map direct suppliers. Compile a current list of direct suppliers and assess which supply chains carry elevated human rights or environmental risk. Sectors historically flagged include electronics, textiles, agricultural commodities, and construction materials.
- Establish or adapt a grievance mechanism. The mechanism must be accessible to employees and persons in the supply chain. It must be operational – not merely documented. Anonymous reporting channels aligned with German employment legislation requirements are standard practice.
- Prepare the annual due diligence report. The report must be published on the company's website and submitted to the enforcement authority. It must cover the risk analysis process, measures taken, and an assessment of their effectiveness. Boilerplate reports that lack specificity are a documented enforcement risk.
Groups that have recently undergone insolvency-adjacent restructuring governed by the Insolvenzordnung (German Insolvency Code) should note that supply chain compliance obligations are not suspended during restructuring proceedings. An administrator managing a German entity in scope must ensure continuity of the compliance programme.
International groups with questions about the interaction between supply chain legislation and German competition law obligations in Germany should seek specialist advice without delay.
About Ferraz & Whitmore
Ferraz & Whitmore is an international law firm based in Lisbon, advising business clients across 46 jurisdictions. Our team combines Portuguese civil law expertise with English common law tradition to deliver cross-border legal solutions in competition law, supply chain compliance, and regulatory matters across Germany and the broader EU. As a law firm in Germany advising international groups, we assist clients in mapping compliance obligations, structuring due diligence programmes, and managing enforcement exposure across civil law and common law systems. Our competition law practice covers supply chain regulation, merger notification procedures, and market dominance analysis before the Bundeskartellamt and other European regulators. We work with international entrepreneurs, institutional investors, and in-house legal teams who need results-oriented counsel across multiple legal systems. To discuss how Germany's supply chain due diligence obligations affect your group's structure, contact us at info@ferrazwhitmore.com.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.
Author: Sophie Kellner
Author title: Partner, IP & Technology Law
Published: February 12, 2026