German Supply Chain Due Diligence Act (LkSG)

LkSG Sections 12-23 - enforcement + sanctions. BAFA (Bundesamt fur Wirtschaft und Ausfuhrkontrolle - Federal Office for Economic Affairs and Export Control): the German federal enforcement authority + responsible for: (a) MONITORING + INSPECTION (Section 14-17): on-site inspections + document review + interviews + system review; (b) COMPLAINTS HANDLING (Section 17-19): receiving + investigating + escalating complaints from any party including affected individuals + civil society + employees; (c) GUIDANCE + INSTRUCTIONS to companies; (d) SANCTIONS PROCEEDINGS (Section 23-24). ADMINISTRATIVE FINES (Section 24): per-violation: (i) UP TO EUR 800,000 for failures regarding own business; (ii) UP TO EUR 8 MILLION for failures regarding direct/indirect suppliers OR failure to submit annual report; (iii) FOR COMPANIES WITH ANNUAL TURNOVER MORE THAN EUR 400 MILLION: fine of up to 2% of GLOBAL ANNU

• BAFA engagement procedure + inspection readiness
• Fine calculation + risk assessment
• Public procurement risk management
• Complementary civil claims awareness

• BAFA engagement reactive
• Fine risk underestimated
• Public procurement exclusion not addressed
• Complementary claims unconsidered

LkSG coordination with adjacent German + international frameworks. GERMAN HINWEISGEBERSCHUTZGESETZ (HinSchG, Whistleblower Protection Act of 31 May 2023 in force 2 July 2023; for >50 employees 17 December 2023): transposes EU Whistleblower Directive 2019/1937; mandatory internal reporting channel for companies >50 employees; external + public disclosure paths to BfJ (Bundesamt fur Justiz); anti-retaliation + reverse burden of proof; coordinates with LkSG Section 9 complaints procedure. CORPORATE SUSTAINABILITY REPORTING DIRECTIVE (CSRD, Directive (EU) 2022/2464): EU-mandated sustainability reporting + double materiality + European Sustainability Reporting Standards (ESRS); coordinates with LkSG annual report but covers broader ESG including environmental + social + governance + climate. ESRS S2 (Workers in the Value Chain) + ESRS S3 (Affected Communities) + ESRS G1 (Business Conduct) dir

• HinSchG + LkSG complaints integration
• CSRD + ESRS sustainability reporting
• UNGPs + OECD + ILO + German NAP alignment
• Industry initiative engagement

• HinSchG + LkSG complaints siloed
• CSRD reporting not integrated
• International frameworks not aligned
• Industry initiative engagement absent

LkSG crosswalk to international human rights + business frameworks. EU CSDDD (Directive (EU) 2024/1760): see separate control - 2024-2029 phased transposition + value-chain expansion + civil liability + climate alignment + harmonized EU framework. UN GUIDING PRINCIPLES ON BUSINESS AND HUMAN RIGHTS (UNGPs, 2011 Ruggie Principles): 3-pillar framework (State Duty to Protect + Corporate Responsibility to Respect + Access to Remedy); LkSG operationalises pillar 2 (corporate responsibility) in legal form. OECD GUIDELINES FOR MULTINATIONAL ENTERPRISES (2023 UPDATE): 11 chapters including human rights + environment + bribery + consumer interests; National Contact Points (German NCP at BMWK) mediate disputes. ILO FUNDAMENTAL CONVENTIONS: 8 + 1 fundamental Conventions covering forced labour + child labour + discrimination + collective bargaining + occupational health + safety + the latter included

• Multi-framework alignment + crosswalk
• UNGPs/OECD/ILO/NAP implementation
• Sectoral initiative participation
• CSRD reporting integration

• Multi-framework alignment ad-hoc
• UNGPs/OECD/ILO not implemented
• Sectoral initiatives ignored
• CSRD reporting siloed

LkSG status + EU CSDDD coordination + 2024-2025 pipeline. STATUS: LkSG in force since 1 January 2023 (>3,000 employees) + 1 January 2024 (>1,000 employees); BAFA active enforcement + first sanctions issued 2023-2024 against multiple companies for incomplete annual reports + insufficient risk analysis + supplier-DD gaps; complaints received by BAFA from civil society + NGOs + worker representatives. ANNUAL REPORTING (Sec.10) - first reports submitted in 2024 + 2025 covering 2023 + 2024 fiscal years + BAFA publishing aggregate findings + identifying sector + country + commodity risks. EU CSDDD (Corporate Sustainability Due Diligence Directive, Directive (EU) 2024/1760) entered into force 25 July 2024; phased transposition: (a) Member States must transpose by 26 July 2026; (b) Companies with >5,000 employees + EUR 1.5B turnover - 26 July 2027; (c) Companies with >3,000 employees + EUR 900M

• LkSG compliance + report tracking
• EU CSDDD readiness + transposition prep
• Value-chain expansion plan
• Civil liability + climate plan

• LkSG compliance immature
• CSDDD readiness gap
• Value-chain expansion not anticipated
• Civil liability + climate plan absent

LkSG Section 2(2)-(3) - protected human rights + environmental risks. PROTECTED HUMAN RIGHTS (Sec.2(2) - 11 categories): (1) PROHIBITION OF CHILD LABOUR; (2) PROHIBITION OF FORCED LABOUR + ALL FORMS OF SLAVERY (including debt bondage + serfdom + forced labour comparable to slavery); (3) PROHIBITION OF DISREGARD FOR OCCUPATIONAL HEALTH AND SAFETY OBLIGATIONS; (4) PROHIBITION OF DISREGARD FOR FREEDOM OF ASSOCIATION + COLLECTIVE BARGAINING; (5) PROHIBITION OF DISCRIMINATION in employment for prohibited reasons including national + ethnic origin + social background + health + disability + sex + sexual orientation + age + religion + political opinion + others; (6) PROHIBITION OF NON-PAYMENT OR WITHHOLDING OF AT LEAST MINIMUM WAGE + adequate income; (7) PROHIBITION OF DISREGARD FOR PROTECTION FROM ENVIRONMENTAL POLLUTION + ENVIRONMENT-RELATED HARM to health + sustenance + housing; (8) PROHIBIT

• Human rights risk register
• Environmental risk register + Minamata/Stockholm/Basel coverage
• Indigenous + community engagement

• Human rights categories not fully covered
• Environmental conventions not addressed
• Community + Indigenous rights not engaged

LkSG compliance program implementation roadmap. ORGANIZATIONAL ROLES: (a) HUMAN RIGHTS OFFICER (Sec.4(3) statutory mandate) - oversight + cross-functional authority + direct reporting to senior management; (b) PROCUREMENT LEAD - supplier engagement + contracts + audits + responsible procurement; (c) LEGAL + COMPLIANCE - regulatory monitoring + enforcement engagement + civil liability risk management; (d) HR + LABOUR RELATIONS - own-operations human rights + works councils + co-determination + collective bargaining; (e) ENVIRONMENT + SUSTAINABILITY - environmental risks + Minamata/Stockholm/Basel + climate transition plans + ESG coordination; (f) COMMUNICATIONS + STAKEHOLDER ENGAGEMENT - civil society + NGO + media + complaints; (g) IT/DATA - data management + supplier portal + risk analytics + reporting infrastructure. OPERATIONAL CONTROLS: (a) risk analysis platform integration; (b) sup

• Role inventory + RACI
• Operational controls + tooling investment
• Sectoral participation evidence
• Metrics + management review

• Roles undefined
• Tooling fragmented
• Sectoral engagement absent
• Metrics not tracked

LkSG Sections 1-3 - scope + applicability. APPLICABILITY THRESHOLDS: (a) FROM 1 JANUARY 2023 - applies to companies with MORE THAN 3,000 EMPLOYEES in Germany (including agency workers + temporary workers + employees of group companies based in Germany); (b) FROM 1 JANUARY 2024 - applies to companies with MORE THAN 1,000 EMPLOYEES (covering substantially more companies); (c) GERMAN BRANCHES OF FOREIGN PARENT COMPANIES are also covered if the German branch meets the employee threshold. ENTITY SCOPE: stock corporations (AG) + limited liability companies (GmbH) + cooperatives + partnerships + commercial entities + non-commercial entities meeting the threshold; SECONDARY EMPLOYERS like umbrella + group companies cascade based on Section 4(2) which expands coverage through group structures + supplier networks. SUPPLY CHAIN SCOPE: (a) OWN BUSINESS OPERATIONS - full due diligence; (b) DIRECT SUP

• Applicability assessment + employee count + cascade
• Group structure analysis
• Supplier classification + DD level

• Threshold miscalculated
• Group cascade not addressed
• Direct vs indirect supplier confused
• EU CSDDD readiness gap

LkSG Sections 4-5 - risk management system + risk analysis. SECTION 4 RISK MANAGEMENT SYSTEM: companies must establish an APPROPRIATE + EFFECTIVE risk management system to identify + prevent + mitigate + remediate human rights and environmental risks arising from own business operations + direct suppliers + (where substantiated knowledge) indirect suppliers; the system must be PROPORTIONATE + COMMENSURATE WITH the company's specific risk profile + size + sector + geographies. IN-HOUSE RESPONSIBILITY (Section 4(3)): companies must designate a HUMAN RIGHTS OFFICER or equivalent position with DIRECT REPORTING to senior management + adequate resources + independence + cross-functional authority. SECTION 5 RISK ANALYSIS (Annual + Ad-hoc): (a) ANNUAL risk analysis covering own business + direct suppliers; (b) AD-HOC analysis whenever new product + new business activity + new geography + substa

• Risk management system documentation
• Human rights officer appointment + RACI
• Risk analysis reports + methodology
• Priority risk register

• Risk system missing or insufficient
• Human rights officer not independent
• Risk analysis not annual
• Priority risks unrecognised

LkSG Section 6 - policy statement + preventive measures. POLICY STATEMENT (Section 6(2)): formal HUMAN RIGHTS STRATEGY published by senior management + addressing: (a) the company's procedure for fulfilling its due diligence obligations; (b) the human rights and environmental risks identified in the risk analysis; (c) the human rights and environmental expectations directed at the company's employees + the supply chain. Must be approved by senior management + reviewed annually + accessible to employees + suppliers + public. PREVENTIVE MEASURES (Section 6(3-4)): (a) FOR OWN BUSINESS: integration into business processes + procurement practices + remuneration systems + supplier selection + responsible procurement strategy + adequate funding + training for relevant personnel + procurement-control measures; (b) FOR DIRECT SUPPLIERS: contractual commitments + supplier code of conduct + trainin

• Policy statement document + approval
• Preventive measures evidence + supplier contracts
• Procurement practice review
• Annual review records

• Policy statement generic or outdated
• Preventive measures superficial
• Procurement practices contradicting human rights
• Annual review skipped

LkSG Sections 7-8 - indirect supplier due diligence + remedial action. SECTION 7 INDIRECT SUPPLIER DUE DILIGENCE: full due diligence NOT REQUIRED at outset for indirect suppliers; instead, RISK-BASED + SUBSTANTIATED KNOWLEDGE-TRIGGERED approach. SUBSTANTIATED KNOWLEDGE (Sec.9(3)): factual indications of human rights or environmental risks at indirect suppliers including: media reports + NGO investigations + audit findings + supplier-self-reports + government findings + whistleblower reports + civil society reports; once substantiated knowledge is triggered + the company must conduct RISK ANALYSIS of the indirect supplier + take PREVENTIVE + REMEDIAL ACTION + reflect findings in policy + reporting. INDIRECT SUPPLIER MEASURES: cascading contractual obligations through direct suppliers + multi-stakeholder initiatives + sector-collaboration + industry programs (e.g. amfori BSCI + SAI SA8000

• Substantiated knowledge monitoring + response
• Sectoral initiative participation
• Remedial action plans + milestones
• Escalation playbook + supplier termination procedure

• Substantiated knowledge ignored
• Sectoral participation absent
• Remedial timelines unrealistic
• Escalation reluctance

LkSG Sections 9-10 - complaints + documentation + reporting. SECTION 9 COMPLAINTS PROCEDURE: company must establish or participate in an APPROPRIATE COMPLAINTS PROCEDURE accessible to (a) individuals affected by human rights or environmental risks/violations in own business + supply chain; (b) employees; (c) workers in supply chain; (d) civil society + NGOs + journalists + advocates. PROCEDURE REQUIREMENTS: (i) RULES OF PROCEDURE published + transparent + fair + bias-free + confidential; (ii) ACCESSIBILITY in multiple languages relevant to supply chain + via multiple channels (web + phone + email + paper + in-person); (iii) CONFIDENTIALITY + PROTECTION against retaliation against complainants + whistleblower-protection-law alignment; (iv) ACKNOWLEDGEMENT + STATUS-UPDATES + RESPONSE within defined timelines; (v) DOCUMENTATION + tracking + trend analysis. WHISTLEBLOWER PROTECTION: Sec. 9 a

• Complaints procedure + multi-language + multi-channel
• Whistleblower protection alignment
• Documentation system + retention
• BAFA annual report + website publication

• Complaints procedure inaccessible or biased
• Whistleblower protection inconsistent
• Documentation gaps
• BAFA report incomplete or delayed