Supply Chain Act

Companies from sectors whose added value is created exclusively in Germany are hardly affected by the regulation, as the human rights risks in Germany are minimal. These sectors include mining and minerals, waste disposal, forestry, real estate and water supply. Companies in the construction, agriculture and fishing, cleaning and security services, transportation and logistics sectors have fewer international ties, but higher human rights risks. Large companies that import goods from non-European countries are generally categorized as very heavily affected. All other companies that import from European countries but not from countries outside Europe are particularly severely affected.

Companies with their head office or registered office in Germany are affected. From January 1, 2023, the law will cover companies with at least 3,000 employees, and from January 1, 2024 also those with at least 1,000 employees. Employees include all employees of affiliated companies in accordance with Art. 15 AktG (German Stock Corporation Act), including group companies abroad and, where applicable, temporary workers. For reasons of fair competition, companies based abroad may also be affected by the regulations, whereby the number of domestic employees is particularly important in this respect.

An extension of the regulations to smaller companies seems possible, in particular in order to ensure far-reaching control of the supply chain.
 

Generally, companies are responsible for the entire supply chain, although there is no civil or criminal liability. The supply chain includes all inputs the company uses in order to manufacture a product or provide a service.

These inputs cover all processes, from the extraction of raw materials to delivery to the end customer. The implementation of this responsibility is to be monitored by the Federal Office of Economics and Export Control. This includes the companies’ obligation to use reasonable efforts, but does not include any guarantee liability that the supply chain is free of human rights violations. However, the necessary risk management must be introduced and effectively implemented by integrating it into the relevant internal business processes through appropriate measures.

A breach of these due diligence obligations can result in fines of up to EUR 50,000 and penalties of EUR 100,000 and up to EUR 8 million.
 

Affected companies should start implementing the processes necessary for the implementation of the Supply Chain Act as early as possible, as some of them will become more demanding and therefore more complex. Almost all companies must appoint a human rights officer, whose work must be reported to management at least once a year. In addition, a complaints procedure must be set up allowing to follow up on reports of possible violations.

If the company obtains substantiated knowledge of possible human rights violations by indirect suppliers, it must conduct a risk analysis and establish preventive measures. The complaints procedure must then include an opportunity for these suppliers to provide information. In addition, companies must document the fulfillment of their due diligence obligations internally and retain them for at least seven years.

In addition, the company must conduct a risk analysis in order to identify human rights risks and risks of violations of environmental obligations, both for the company’s own business area and for that of the supplier. Such a risk analysis serves as the basis for determining effective preventive and remedial measures. The scope of the analysis depends on the scope of the respective company’s business activities, as it must be conducted for each direct supplier. In addition, each company needs a policy statement describing prevention procedures, relevant risks, a definition of human rights-related expectations placed on companies and suppliers.

An annual report on the fulfillment of due diligence obligations in the previous year provides an overview of the measures taken by the company to fulfill its due diligence obligations and helps to identify risks. If there are no risks, it must be possible to plausibly demonstrate this. This report can be submitted via an online portal and should be published on the company’s own website.