After long and tough negotiations, the German Federal Parliament (on 11 June 2021) and the German Federal Council (on 25 June 2021) have passed the Supply Chain Due Diligence Act (the “Act”), which is to come into force on 1 January 2023. In legal terms, the Act primarily means that companies will need to adapt and update their compliance, purchasing and contract drafting processes.

Who is affected?

• As of 1 January 2023: Companies with at least 3,000 employees that have their head office, administrative seat or statutory seat in Germany OR companies that have a branch in Germany and usually employ at least 3,000 employees in this branch;
• As of 1 January 2024: Companies with at least 1,000 employees that have their head office, administrative seat or statutory seat in Germany OR companies that have a branch in Germany and usually employ at least 1,000 employees in this branch.
  
  Note: Group companies are included in the calculation of the number of employees of the parent company. Temporary workers are only included in the calculation if the duration of the assignment exceeds 6 months.
  
  Note: Even if companies with fewer employees are not addressees of the Supply Chain Act, they may still be indirectly affected. This is because the companies directly affected would be obliged to enforce compliance to the best of their ability with human rights in their supply chain. The measures necessary for this can have a direct impact on their suppliers, for example, through the implementation of a code of conduct. In addition, the directly affected companies will often be dependent on the active support of their suppliers and thus have this support be contractually assured, e.g. in the form of reporting obligations as part of their risk analysis.

What is the Act requiring?

The companies concerned must make reasonable efforts to ensure that there are no violations of human rights in their own business operations and in the supply chain. The Act explicitly clarifies that a mere duty of effort is established and not a duty to succeed or guarantee liability.

Own business operations

This covers any activity for the production and exploitation of products and for the provision of services, regardless of whether it is carried out at a domestic or foreign location.

Supply chain

In addition to the company’s own business operations, this primarily includes direct suppliers. However, the company must also carry out a risk analysis and preventive and remedial measures for indirect suppliers, if it gains substantiated knowledge of possible human rights violations or violations of environmental obligations.

Note: If any attempt is made to circumvent these due diligence requirements through an intermediary of a direct supplier, indirect suppliers would count as direct suppliers.

Note: Due diligence obligations can be greatly extended by “substantiated knowledge”.

Human rights

These are derived from internationally recognized agreements, in particular the International Labour Organization (ILO) core labour standards, to which the draft bill makes exhaustive reference. The Supply Chain Act defines as human rights risks in particular child and forced labour as well as slavery, disregard of labour protection obligations and freedom of association, inequality and withholding of an adequate wage, certain environmental pollution relevant to human rights as well as land deprivation, torture and cruel, inhuman or degrading treatment.

Note: The Act references the environment once to the extent that environmental damage leads to human rights violations (which will often be the case) and once in that corporate due diligence obligations include environment-related obligations arising from the Minamata Convention (risks from involvement in the production and disposal of mercury-containing products), the PoPs Convention (risks from the production or use of certain persistent organic pollutants) and the Basel Convention (risks from the import and export of waste).

Reasonable

What a company must do depends on (i) the nature and scope of its business, (ii) the company’s ability to influence the immediate violator, (iii) the expected severity of the violation, (iv) the reversibility of the violation, (v) the likelihood of the violation occurring, (vi) the nature of the contribution to causation.

What measures must be taken?

Risk management and risk analysis

Companies must implement appropriate or adapt their existing risk management accordingly. Companies must determine whether there is a risk that their own business activities or business activities in the supply chain violate human rights.

Policy statement

Companies must adopt a so-called policy statement on their human rights strategy. This policy statement must contain the procedure for abiding by human rights and environmental due diligence obligations in the supply chain, the specific risks identified and the company’s human rights and environmental expectations of its employees and suppliers.

Preventive and remedial measures

Based on the risk analysis, companies must take or review appropriate preventive and remedial measures. This applies, for example, to supplier selection and supplier monitoring, the creation of codes of conduct, the implementation of training courses, and also sustainable contract drafting.

Complaints procedure

Companies shall establish, implement and publish a complaint mechanism in writing through which (potentially) affected persons and persons with knowledge of possible violations can point out human rights risks and violations.

Documentation and reporting obligations

The fulfilment of human rights-related due diligence obligations must be documented. In addition, a report on this must be prepared and published annually. This report must also be submitted to the competent authority.

A detailed guide on what companies can specifically do to comply with the legal requirements, can be found here.

How is compliance with the Act monitored and enforced?

Authority measure

The Act provides for far-reaching powers of intervention by the competent authority to enforce human rights standards. The competent authority is the Federal Office for Economic Affairs and Export Control (BAFA). It can act at the request of an affected person or on its own initiative and impose measures on the company concerned to ensure compliance with human rights standards. To this end, it has extensive rights to information and access; the company concerned must support it in enforcing the measures.

Special litigation authority

Trade unions and non-governmental organisations can be granted the authority to conduct litigation for an affected party.

Note: Anyone along the supply chain can be affected, not just the employees of the obligated company or the direct supplier.

What are the penalties for violations?

• Fines for violations of due diligence and reporting obligations of up to EUR 8 million depending on the nature and gravity of the violation.
  
  Note: Companies with an average annual turnover of more than EUR 400 million may be fined up to 2% of their average annual turnover for breaches of the obligation to take remedial action or to implement an appropriate remedial action plan at a direct supplier.

• Exclusion from public tenders for up to three years.
• The Act does not provide for any extension of civil liability.
  
  Note: Even if it is therefore unlikely that a German company will be liable for misconduct on the part of a supplier abroad, liability under the general (tort) principles in German law (in particular, duties of care) is still possible.

• The draft bill also does not provide for an extension of the international applicability by drafting it as an overriding norm (= mandatory application of the Act, even if the law of another country is actually applicable).
  
  Note: Thus, if the damage occurs in another country, the law of that country – and thus not the Act – will be generally applicable.

Overview of the German Supply Chain Due Diligence Act (pdf download)