Supply Chain Due Diligence Act (LkSG): Does It Apply to Small Retailers Too?

1. What is the LkSG and what is it about?

The Supply Chain Due Diligence Act, almost always referred to by its German abbreviation LkSG in practice, requires companies to observe so-called due diligence obligations regarding human rights and environmental protection. A due diligence obligation, in this context, is nothing more than the obligation to actively make sure that no serious problems occur within the company itself or at its suppliers, for example no child labor, no forced labor, and no severe environmental damage.

The law requires several concrete steps for this: a risk analysis of the company's own business activities and its supply chain, prevention and remedial measures built on that analysis, the establishment of a complaints procedure through which affected persons or whistleblowers can report problems, ongoing documentation of all these steps, and annual reporting to a government authority. That authority is called the Bundesamt für Wirtschaft und Ausfuhrkontrolle, or BAFA, the Federal Office for Economic Affairs and Export Control. The BAFA is a federal agency that, among other things, reviews the reports submitted by obligated companies, can request information, and can impose fines in serious cases.

It is also important to understand that the law explicitly does not only apply to a company's own operations, but also to its upstream supply chain, meaning suppliers, manufacturers, and their own suppliers in turn. This look beyond a company's own factory gates is exactly why the topic can eventually reach smaller companies too, even though the law itself only directly obligates large firms.

The law also distinguishes how closely an obligated company must look at different parts of its supply chain. For direct suppliers, meaning the company's own direct contractual partners, regular, systematic due diligence applies, so checks and documentation happen on an ongoing basis. For indirect suppliers, meaning manufacturers and their own suppliers further back in the chain, closer scrutiny is generally only required when there are concrete indications of a problem, for example through a complaint or media coverage. For smaller online shops this distinction matters, because it explains why some requests from large partners are quite general while others are very detailed.

In terms of content, the law is oriented around internationally recognized conventions. Human rights risks include, among others, child labor, forced labor, discrimination, disregard for freedom of association, and inadequate occupational safety. Environmental risks include, for example, improper handling of certain hazardous chemicals or mercury, as well as improper disposal of hazardous waste. These categories help you understand what a questionnaire from a large partner is typically aiming at.

2. Since when does it apply, and to whom?

The LkSG was not switched on for all companies at once, but rather in stages according to company size. Since January 1, 2023, the direct obligation has applied to companies with generally at least 3,000 employees in Germany. Since January 1, 2024, the circle of directly obligated companies was expanded to companies with generally at least 1,000 employees in Germany.

These two dates are why the topic has appeared more frequently in the news and in discussions among business owners over the past few years, even though the rules themselves had been known for longer. What generally counts for the employee threshold is the workforce in Germany considered over a longer period, not a single snapshot on one specific date.

For the vast majority of owners of smaller and mid-sized online shops, this means, first of all: you generally do not reach these employee numbers, and are therefore not directly legally obligated to fulfill the due diligence requirements. That is the good news, which, as described in the next section, is not the end of the story.

One special case for corporate groups deserves a brief mention for completeness: for affiliated companies, for example within a group structure, the employees of parent and subsidiary companies can under certain conditions be added together for purposes of the threshold. For most independent, smaller online shops without such group structures, however, this practically does not apply.

3. Who is affected, does it apply to small retailers too?

This is the core question on the minds of many shop owners, and the answer has two sides. The direct legal obligation, meaning the duty to conduct a risk analysis, report to the BAFA, and carry out all the other steps mentioned in the first section, generally does not apply to smaller online retailers. If you are clearly below the employee thresholds mentioned, you are not a so-called obligated company under the law and do not need to file an LkSG report with the BAFA yourself.

The second side of the answer, however, is at least as important: indirect exposure is real, and if anything, it is increasing rather than decreasing. Large, directly obligated companies must not only implement their due diligence obligations internally, but also secure them along their own supply chain, both contractually and in practice. In practice, this means that these large companies pass on questionnaires, self-disclosures, codes of conduct, or corresponding contract clauses to their suppliers and business partners.

A code of conduct, at its core, is a self-commitment that usually covers topics such as fair working conditions, compliance with minimum wages, occupational safety, environmental standards, and a ban on corruption. So if your shop supplies products to a large marketplace, to a larger B2B customer, or to a contractual partner that is itself subject to the LkSG, it is quite possible that a request about your own suppliers, your countries of origin, or your internal controls will suddenly land in your inbox, without you ever having become directly obligated under the LkSG yourself.

This is especially relevant for shops with imported private-label goods, textiles, electronics, or generally products from countries where there is an elevated risk of human rights violations or environmental damage. If you operate in these areas, you should not dismiss the topic as purely a corporate concern, but rather as something that can, sooner or later, knock on your own shop's door too, usually in the form of an email with a questionnaire and a deadline for a response.

4. Thresholds and applicability at a glance

The following overview summarizes at what company size the direct obligation applies, how things stand for smaller suppliers and retailers, and what is foreseeable at the European level. It does not replace a legal assessment of your individual case, but it helps you roughly place your own situation.

At the European level, the so-called Corporate Sustainability Due Diligence Directive, abbreviated CSDDD or also CS3D, is an important point you should keep an eye on. This EU directive was adopted in 2024 and is intended to eventually apply to companies with lower employee numbers than the German LkSG, with staged implementation over several years.

In the European legislative process, however, there are ongoing discussions, among other things as part of so-called Omnibus simplification initiatives, about possible shifts and adjustments to thresholds and timelines. Fixed years cannot be stated reliably at this point, which is why shop owners should watch this development rather than commit to a specific date.

5. What you should do, even without a direct obligation

Even if you are not directly obligated to fulfill the due diligence requirements, taking a tidy look at your own supply chain is worthwhile for several reasons. On one hand, you will be prepared if a larger business partner asks for a self-disclosure or a questionnaire. On the other hand, a transparent, documented supply chain increasingly appears more trustworthy to customers and partners, regardless of whether a legal obligation stands behind it or not.

The first sensible step is always to properly write down your own supply chain in the first place: who produces or supplies what, and which country the respective goods come from. For imported goods, it is worth paying particular attention to countries of origin with elevated risk, without this having to turn into an elaborate compliance program right away.

If you additionally formulate simple, voluntary principles for your own supply chain, for example in the form of a short code of conduct, you remain a good fit for larger business partners and do not have to start from zero when a request comes in. Even in a small team, it is worth naming a fixed point of contact who is responsible for incoming supply chain requests, instead of a questionnaire getting lost between several inboxes.

6. Risks of non-compliance or lack of preparation

For the large, directly obligated companies, the BAFA can impose fines for violations of the due diligence obligations and can temporarily exclude these companies from public procurement procedures. Public procurement procedures are tenders through which government agencies or public contracting authorities award contracts, so an exclusion means temporarily not being allowed to participate in such public tenders. As described, this generally does not apply to smaller online shops themselves.

For them, the real risk lies elsewhere: the loss of business relationships with large partners if information obligations cannot be met, or not met in time. A large B2B customer or marketplace can, in practice, make orders and cooperation dependent on whether a supplier delivers the requested self-disclosures, even without an actual fine framework standing behind it.

On top of this comes a more gradual risk: growing expectations from customers and platforms regarding supply chain transparency. If you cannot provide any answers at all here, you quickly appear less professional compared to competitors who can already present simple documentation, even if neither side is subject to a legal obligation.

7. Common misconceptions

Probably the most common misconception is: the LkSG only concerns large corporations, it can never reach me as a small shop. That is too sweeping a statement. The direct legal obligation really does only apply to large companies, but indirect requirements through business partners, marketplaces, or larger B2B customers are possible and, in practice, no longer a rarity, especially for imported goods.

A second widespread misconception is: if I am not directly obligated, no consequences threaten me at all. That is not true either. As described in the previous section, contractual partners can, in practice, make orders or cooperation dependent on whether certain information obligations are met, even without an obligation of your own under the law.

A third, especially unsettling misconception is: the LkSG means I can be personally sued for any supply chain problem abroad. That is not accurate. The LkSG itself explicitly does not create any additional civil liability toward third parties. The law therefore does not create a new lawsuit route through which affected persons abroad could take action directly against a company solely because of an LkSG violation. This fear of a direct wave of lawsuits is one of the most widespread misunderstandings around the law, and is unfounded in this sweeping form.

A fourth misconception concerns the very nature of the due diligence obligation: some shop owners believe the law demands a guarantee that no problem will ever occur anywhere in the entire supply chain. That is not the case. The LkSG requires what is known as an obligation of effort, meaning reasonable, demonstrable efforts, not an obligation of result in the sense of an absolute guarantee. If you make appropriate use of your own possibilities and influence and document that, you fulfill the core of what is expected of a company.

8. What we can take care of for you

We are not a law firm and do not replace individual legal advice. What we are good at, though: helping you build a clear, documented structure for your supplier and origin information directly in your shop system, instead of managing this information scattered across emails, spreadsheets, and supplier folders. This way, if a partner questionnaire comes in, you have the relevant information ready in one place.

Beyond that, we support you in building your own transparency or content page on sustainability and supply chain for your shop, help you organize a clear process for incoming partner questionnaires, and keep an eye on further developments at the EU level, particularly around the CSDDD, so you do not have to constantly wade through specialist literature yourself.

Especially when several people within a company deal with suppliers at different points, it helps to bring this information together in one central, technical place, instead of starting from scratch with every new request. That is exactly the organizational part of the task we focus on, while the legal assessment of your individual case should always rest with appropriately qualified legal counsel.

Note: This article provides general information on the Supply Chain Due Diligence Act and does not replace individual legal advice.

9. Summary

The Supply Chain Due Diligence Act directly obligates only companies with generally at least 1,000, or since 2023, 3,000 employees in Germany, to conduct a risk analysis, prevention measures, a complaints procedure, documentation, and annual reporting to the BAFA. Smaller online shops therefore generally do not fall directly under the law.

Even so, paying attention is worthwhile: anyone supplying products to larger, directly obligated business partners can come into indirect contact with the topic through questionnaires, self-disclosures, or codes of conduct. Clean documentation of your own supply chain, particular attention to imported goods from higher-risk countries, and keeping an eye on the European CSDDD development are sensible, level-headed steps, regardless of whether a direct obligation exists.

10. FAQ: Supply Chain Due Diligence Act for small retailers