Supply Chain Due Diligence Act (LkSG): When Does the Obligation Apply and How Are Employees Counted Correctly?

The Supply Chain Due Diligence Act (LkSG) has applied since 1 January 2023 to companies with at least 3,000 employees in Germany, and was extended from 1 January 2024 to companies with at least 1,000 employees (§ 1 para. 1 LkSG). For German mid-sized businesses, one of the key questions is: how is the headcount correctly determined under the LkSG? Do subsidiaries count? How are agency workers and part-time employees treated?

The answer to these questions is decisive for many companies — not only regarding whether they are obligated, but also regarding the scope of due diligence obligations they must fulfil within their own business area. This article clarifies the threshold calculation, the BAFA audit practice, and what to prepare when a company falls under the LkSG obligation for the first time.

§ 1 para. 1 LkSG defines the scope of application: companies that have their registered office, central administration, or principal place of business in Germany and regularly employ at least 1,000 workers in Germany are obligated. Until 31 December 2023, the threshold was 3,000 employees; since 1 January 2024, it is 1,000.

An important distinction: the LkSG does not apply to foreign companies without a German establishment, even if they supply goods to Germany. However, it does apply to German companies domiciled in Germany, regardless of where they produce or where their suppliers are located. Operating production abroad does not exempt a company from LkSG obligations.

Companies that are just below the threshold should exercise caution: the BAFA assesses the employment situation on the basis of the annual average. Fluctuating headcounts — due to seasonal variation or growth-related new hires — can cause a company to fall unexpectedly under the obligation. Early preparation with the support of an LkSG officer is therefore advisable even for companies with 800 or more employees.

The calculation of the threshold under § 1 para. 1 LkSG is based on employees employed in Germany. The relevant figure is the number of employees within the meaning of § 5 of the Works Constitution Act (BetrVG), i.e. workers, salaried employees, and apprentices with German employment contracts. Civil servants are generally not included unless they are employed under private law.

For agency workers, the statutory reasoning and BAFA guidance state: they count towards the hiring company if they have been assigned for more than six months. Short-term project deployments of less than six months are attributed to the staffing agency. For companies with a high proportion of agency workers, this may mean that the threshold is reached earlier than expected based on the permanent workforce alone.

Part-time employees count as full employees, not as full-time equivalents. A company with 900 full-time and 150 part-time employees has 1,050 employees for LkSG purposes and is therefore obligated. This follows the practice under § 23 para. 1 of the Dismissal Protection Act (KSchG), but differs from the Posted Workers Ordinance, which uses full-time equivalents.

Practical recommendation: conduct a documented threshold review annually and retain the result in writing. The BAFA may, in the context of an audit under § 14 LkSG, request evidence of non-applicability.

A common misconception concerns the role of subsidiaries in the threshold calculation. For the threshold itself — i.e. the question of whether the LkSG applies — only the employees of the obligated company employed in Germany count, not those of subsidiaries.

The position differs when it comes to the scope of due diligence obligations. § 2 para. 6 LkSG defines the company's own business area as all activities of the company in pursuit of its business purposes, and explicitly includes subsidiaries over which the company exercises a controlling influence. Controlling influence is generally presumed where more than 50 per cent of voting rights are held.

This means that due diligence obligations must be fulfilled not only within the parent company, but also across all controlled subsidiaries, regardless of whether the subsidiary is domiciled in Germany or abroad. The BAFA report therefore requires a group-wide risk analysis covering all subsidiaries.

For larger mid-sized companies with multiple subsidiaries, this entails considerable organisational effort. A centralised officer workspace with multi-entity functionality significantly reduces this burden.

The European Corporate Sustainability Due Diligence Directive (CSDDD, Directive (EU) 2024/1760) was published in the Official Journal of the EU on 25 July 2024. It must be transposed into national law by 26 July 2026 and will in the medium term supplement or replace the LkSG.

The CSDDD applies to large EU companies with more than 1,000 employees and a worldwide net turnover exceeding EUR 450 million. Implementation is phased: initially, companies with more than 5,000 employees and EUR 1.5 billion in turnover are affected, with the 1,000-employee threshold applying from 2028.

For companies already subject to the LkSG, the CSDDD essentially represents an extension of the due diligence scope to include civil liability provisions and stricter scrutiny of indirect supply chains. The methodological foundations — risk analysis, action planning, complaints procedures, and reporting — are largely compatible with the LkSG.

Recommendation: implement an LkSG-compliant system now that is modular and scalable. Software and officer structures established today for LkSG compliance will form the foundation for CSDDD compliance from 2026 onwards.

Once a company exceeds the 1,000-employee threshold for the first time, the obligation to fulfil the LkSG requirements commences on 1 January of the following year, or — if the threshold is exceeded during the current financial year — at the beginning of the next financial year. This follows from § 1 para. 1 sentence 3 LkSG in conjunction with BAFA enforcement practice.

All eight due diligence obligations under § 3 LkSG must then be fully implemented: risk management, risk analysis, policy statement, preventive measures, remedial measures, complaints procedure, reporting, and documentation. The first BAFA report must be submitted no later than four months after the end of the first financial year under LkSG obligation.

Regarding formal appointment: § 4 para. 3 LkSG requires a named responsible person. This person must report directly to the management board and be provided with adequate resources. The appointment must be documented in writing. The deadline runs from the point of knowledge of the first threshold exceedance.

CIVAC recommends: begin structural implementation at least six months before the first reporting date. This provides sufficient time for the risk analysis, supplier survey, and formal appointment phase.

The LkSG divides due diligence obligations into eight areas, all of which are equally mandatory. A selective approach in which only individual areas are implemented is insufficient.

• § 3 LkSG: General due diligence obligations, policy statement, responsible persons
• § 4 LkSG: Risk management, annual review, appointment of officer
• § 5 LkSG: Risk analysis, weighting by likelihood and severity
• § 6 LkSG: Preventive measures, supplier contracts, training
• § 7 LkSG: Remedial measures upon identified violations
• § 8 LkSG: Complaints procedure — confidential and multilingual
• § 9 LkSG: Due diligence obligations regarding indirect suppliers upon specific indications
• § 10 LkSG: Documentation and BAFA report, four months after the end of the financial year

Audit-proof evidence must exist for each of these obligations. A properly established LkSG officer ensures that documentation is built in a structured manner and can be retrieved at any time — audit-ready, documented, and compliant with § 10 LkSG.

§ 24 LkSG provides for a tiered fine regime. Infringements of documentation and reporting obligations may result in fines of up to EUR 100,000. For serious breaches — in particular where preventive and remedial measures are absent — the maximum rises to EUR 400,000. For companies with annual turnover exceeding EUR 400 million, the fine may amount to up to two per cent of worldwide annual turnover.

In addition, there is a public procurement bar: § 22 LkSG enables authorities to exclude companies against which a fine of more than EUR 175,000 has been imposed with legal finality from public procurement procedures for up to three years. For companies with public-sector clients, this represents a significant business risk.

Since 2023, the BAFA has actively initiated review procedures and issued information requests to companies. The authority does not merely examine the formal existence of a risk management system, but also its effectiveness within the meaning of § 4 para. 1 LkSG. Purely formal compliance without operational implementation is insufficient.

Companies with fewer than 1,000 employees are formally not required to comply with the LkSG. However, they are in practice frequently required to do so when they act as suppliers to LkSG-obligated customers. § 6 para. 4 LkSG requires obligated companies to incorporate their expectations into supplier contracts and to offer training.

This means that mid-sized companies with fewer than 1,000 employees are increasingly receiving requests from LkSG-obligated customers demanding self-disclosure, supplier declarations, audit access, or certifications. Companies that cannot respond to these requests in a structured manner risk losing supplier relationships.

Recommendation for non-obligated suppliers: prepare a self-disclosure statement covering the key risk areas of the LkSG and document your own preventive measures. A compliance officer can assist in providing and maintaining the relevant information in a structured manner.

Note: in certain industries — notably the automotive and electronics sectors — full LkSG-compatible supplier documentation is already a prerequisite for new supplier approval.

Establishing that the LkSG applies is the first step. The second is the formal appointment structure: § 4 para. 3 LkSG requires a named responsible person who reports directly to the management board. This appointment must be documented in writing, communicated to the workforce, and supported by a clearly defined resource framework.

Without a proper appointment deed and documented reporting line, the company's entire LkSG compliance programme is at risk of being assessed as inadequate in a BAFA audit — regardless of how carefully the risk analysis was conducted. Appointment deed, signed, filed, verifiable.

CIVAC offers, as a compliance platform and Officer-as-a-Service, both approaches: licence the workspace for your internal officers or appoint our officers. Contract, named person, and deed are completed within two working days. This establishes the formal foundation for LkSG compliance at the required standard of documentation.

If you wish to determine whether your company falls under the LkSG or what steps are required following the first threshold exceedance, write to info@civac.de. Turn reading into a mandate.