LkSG representative: Duties, appointment and report to BAFA

The Supply Chain Due Diligence Act (LkSG) has been in force since January 1, 2023 for companies with 3,000 employees and more and since January 1, 2024 for companies with 1,000 employees or more. It obliges the companies covered to exercise human rights and environmental care in their own business areas, with direct suppliers and, where appropriate, with indirect suppliers. The obligations include risk management according to § 4, a named responsible person (often called a human rights officer) according to § 4 paragraph 3, annual risk analysis according to § 5, preventive measures according to § 6, remedial measures according to § 7, a complaint procedure according to § 8 and annual report to the BAFA according to § 10.

Violations are punishable by fines of up to 800,000 euros § 24 LkSG is punished, for companies with an annual turnover of more than 400 million euros even up to 2 percent of the average annual turnover. In addition, there is exclusion from public procurement for up to three years. The EU Supply Chain Directive (CSDDD, Directive (EU) 2024/1760) will gradually tighten the requirements from 2027 and expand the reach to other companies. This article explains the duties of the LkSG officer, the operational implementation of the risk analysis, the BAFA reporting path, the interfaces to GDPR, HinSchG and ESG reporting as well as the consequences of sanctions and shows how CIVAC as a compliance platform and officer-as-a-service secures the mandate. The appointment certificate, signed, filed, verifiable.

The LkSG standardises seven core obligations, which are formulated in paragraphs 4 to 10. Firstly, risk management in accordance with Section 4, which is anchored in all relevant business processes and is the responsibility of a named responsible person. Secondly, an annual and event-related risk analysis in accordance with Section 5, which identifies, weights and prioritises human rights and environmental risks in one's own business activities and those of direct suppliers. Third, prevention measures under Section 6, including policy statements, training, contractual assurances and controls. Fourth, remedial measures in accordance with Section 7 in the event of identified violations, with the consequence of terminating the business relationship as a last resort.

Fifth, a complaint procedure in accordance with Section 8, which provides whistleblowers from the company's own business area and along the supply chain with a confidential and effective means of complaint. Sixth, documentation obligations according to Section 10 Paragraph 1, which record risk management, risk analysis, measures and the complaint procedure in a comprehensible form. Seventh, the annual report to the Federal Office of Economics and Export Control (BAFA) in accordance with Section 10 Paragraphs 2 to 4, which is submitted within four months of the end of the financial year and at the same time made publicly accessible. Operational implementation requires an integrated view of purchasing, legal, compliance, human resources and ESG. The LkSG representative coordinates this view and reports directly to the management. The appointment certificate, signed, filed, verifiable. In practice, the list of duties must be concretized through a RACI matrix that assigns to each step a responsible person, an accountable person, a consulted person and an informed person. Without this assignment, risk management remains in a conceptual state and fails in a special official audit due to the details. The LkSG representative ensures that the RACI matrix is ​​maintained and remains linked to the risk register.

Since January 1, 2023, the LkSG has covered companies with headquarters, headquarters, headquarters or statutory headquarters in Germany with at least 3,000 employees in Germany, and since January 1, 2024 with at least 1,000 employees in Germany. Foreign corporations with branches in Germany are also included if the employment threshold is reached in Germany. The threshold includes temporary workers if the duration of the assignment exceeds 6 months. Groups are viewed consolidated: the number of employees in the subsidiaries is allocated to the parent company if the parent company exercises a certain influence on the subsidiary.

Indirectly recorded are thousands of smaller companies that work as suppliers to companies subject to reporting requirements. These companies receive supplier questionnaires, self-disclosures, codes of conduct and audit requirements from their customers, which de facto require LkSG-compliant risk management. Anyone who is not required to report themselves but is audited as a supplier benefits from a documented LkSG structure because it makes supplier questionnaires easier to answer and strengthens their competitive position. The EU supply chain directive CSDDD will bring further tightening measures from 2027: expansion to companies with 1,000 employees or more and a turnover of 450 million euros with staggered introduction, recording of the entire upstream value chain as well as selected downstream activities, civil liability for breaches of duty of care. Anyone who sets up the LkSG solidly today already has the basic structure for the CSDDD. Others run compliance like a filing cabinet. We run it like software. It is already advisable to record the indirect supplier chain according to tier structures (T1, T2, T3), because the CSDDD will require this in-depth view anyway. Anyone who starts data collection today will have a substantial lead when introducing CSDDD compared to competitors who have to follow suit under time pressure. The EU Commission's Omnibus Initiative of 2025 has postponed parts of the CSDDD application, but the mandatory nature and basic structure remain.

The risk analysis according to Section 5 LkSG is the methodological heart of the due diligence obligations. It identifies human rights and environmental risks in its own business activities and with direct suppliers. The law lists eleven protected legal positions, including prohibition of child labour, prohibition of forced labour, protection from slavery, right to occupational safety, right to fair wages, freedom of assembly, prohibition of discrimination and protection from unlawful eviction. There are also eight environmentally-related obligations from international agreements such as the Minamata, Stockholm and Basel Conventions.

The risk analysis is methodically carried out in four steps: recording your own business activities and your direct suppliers with country, industry and product information, assessing the risks according to probability of occurrence and severity, taking into account recognised indices such as ITUC Global Rights Index, Children's Rights and Business Atlas or Environmental Performance Index, prioritizing risks according to severity and ability to influence, planning measures Responsible persons and deadlines. The analysis is carried out at least annually, depending on the event and in the event of significant changes such as new business areas, new procurement markets or substantiated information. CIVAC provides an LkSG risk analysis template that is linked to the ESG risk register and supplier management. In multi-level corporations, the risk analysis is conducted for each subsidiary and consolidated at group level. This consolidation is a prerequisite for the group report to BAFA and is supported in the workspace with reporting group configuration. Audit-proof, documented, § 5-LkSG-proof. The risk analysis data is stored for at least seven years because the BAFA must be able to trace previous reporting years in subsequent audits. The retention period is configured by default in the workspace. According to the LkSG justification, the risk analysis method itself is risk-based and not universal. This means that high-risk suppliers are checked more deeply and more frequently, while low-risk suppliers receive easier self-disclosures. This differentiation can be mapped in the workspace using risk classes.

Preventive measures in accordance with Section 6 LkSG anchor LkSG care in operational business. The mandatory element is the policy statement in accordance with Section 6 Paragraph 2, which communicates the expectations of employees and suppliers. It is approved by the company management, made publicly accessible and contains the procedure for fulfilling the due diligence obligations, the identified priority risks and the expectations of employees and suppliers. In addition, there are training courses, procurement guidelines with social and environmental criteria, contractual assurances and risk-based controls of direct suppliers.

For indirect suppliers, prevention measures take effect on an ad hoc basis if there is substantiated knowledge of a possible violation. Substantiated knowledge can arise from information about the complaints procedure, from NGO reports, from media reports or from our own findings. Remedial measures in accordance with Section 7 are required if a violation is discovered in one's own business area. The law requires immediate action here. For direct suppliers, remedial measures are required that minimise the risk in the future, including concept development if necessary. Termination of the business relationship is a last resort and is only recommended in precisely defined cases, such as particularly serious injuries without a realistic prospect of remedial action. CIVAC structures prevention and remedial measures in the workspace with a list of measures, those responsible, deadlines and impact documentation. Licence the workspace for your internal representatives, or have our representatives order it. Both paths lead to the same depth of documentation and the same ability to audit the BAFA. If there are several group companies, the list of measures can be maintained for each company and consolidated. Measuring the impact of prevention measures is methodologically demanding and is regularly asked about in the BAFA report. CIVAC suggests an impact indicator for each measure, such as training rates, audit results or complaint numbers, so that the effectiveness assessment is data-based.

The complaints procedure according to Section 8 LkSG is the core of supply chain care because it makes information from those affected and whistleblowers from the supply chain accessible. It must be confidential, protect the identity of the whistleblower and be accessible in a reasonable manner for employees in the company's own business area, for employees of suppliers and for other affected parties. Accessibility includes languages, channels (telephone, written, digital), information on confidentiality and communication of the procedural steps.

In practice, three models are common: your own internal procedure with a designated body, an external ombudsperson or a specialised digital whistleblower platform. External solutions lower the inhibition threshold for whistleblowers because confidentiality towards one's own employer is better protected. The LkSG complaint procedure can be combined with the HinSchG whistleblower system, provided the respective requirements of both laws are met. CIVAC offers an integrated solution that covers LkSG and HinSchG and manages the complaint procedure in the workspace with case code, deadline control and processing status. Every complaint is confirmed within 7 days, and the whistleblower receives feedback on measures taken within 3 months, as long as confidentiality allows. The process is checked for effectiveness at least annually and documented in the report to BAFA. Deadline begins as soon as we become aware of it. A procedural code describes responsibility, input channels, processing paths, escalation and documentation. These rules of procedure are publicly available, usually on the company website, and communicated together with the policy statement. What is critical to the audit is the consistency between the rules of procedure, current practice and complaint protocols. For multilingual requirements, at least English and the respective national language of the most important procurement markets are usually offered. CIVAC offers the rules of procedure and input channels in several languages, the usual ones being English plus three to five procurement languages.

The annual report to the BAFA is the most visible duty of the LkSG. It must be submitted electronically via the BAFA online tool within four months of the end of the financial year and must also be made available free of charge and publicly accessible on the company website for at least seven years. In terms of content, the report follows a fixed pattern with standardised questions that BAFA publishes annually. The scope of the report varies depending on the size of the company, the BAFA announced relief for certain companies in 2025, but the reporting obligations remain.

The report must document the risk analysis, the identified risks, the preventive and remedial measures taken, the complaint procedure and the assessment of effectiveness. Detected violations must be named transparently without revealing the identity of the affected people. Trade secrets can be blacked out if BAFA agrees to this. Late or incomplete reports are punished with fines of up to 175,000 euros in accordance with Section 24 Paragraph 3 No. 8. CIVAC supports the reporting process with a LkSG report template that mirrors the BAFA schema, is linked to the risk register and the list of measures and accelerates the preparation of the final report. In the workspace, the content can be released with versioning and formally approved by management. Audit-proof, documented, § 10-LkSG-proof. In the case of group structures, the group report is created centrally in the workspace, while at the same time each subsidiary receives its own view of its contribution so that the distribution logic remains comprehensible. This dual view is often crucial in the audit because the BAFA specifically asks questions about the consolidation logic. The report is released jointly by the LkSG representative, management and legal department; a written release record in the workspace ensures responsibility and allows later traceability.

The fines according to Section 24 LkSG are graded according to the severity and type of violation. Violations of the reporting obligation are punished with up to 175,000 euros. Serious violations of the risk analysis, prevention or remedial obligations range up to 800,000 euros. For companies with an average annual turnover of over 400 million euros, the fine can be up to 2 percent of the average annual turnover for particularly serious violations. There are also consequences for reputation, bank and investor relationships and customers.

Another consequence of sanctions under Section 22 LkSG is the ban on procurement: If a legally binding fine exceeds a minimum threshold, the company can be excluded from awarding public contracts for up to three years. This consequence particularly affects companies with a high proportion of public contracts. Liability risks under civil law do not exist directly under the LkSG itself (Section 3 Paragraph 3), but they do exist under general tort law and contract law if contractual LkSG assurances are violated. The EU Supply Chain Directive CSDDD imposes explicit civil law liability for breaches of duty of care from the start of application, so that the civil law level will become significantly more important from 2027. The auditor calls, the evidence is ready. CIVAC bundles fine, procurement and civil law risks in the LkSG risk register and links them to the respective obligations. A documented LkSG structure has a mitigating effect on fines and can prevent the award being blocked because the BAFA imposes more lenient sanctions if the due diligence organisation is documented. Documented LkSG structures also have a positive effect on the insurance side because D&O insurers take the existence and documentation of compliance structures into account when assessing risk. In representative actions under the Consumer Rights Enforcement Act or comparable EU mechanisms, reliable LkSG documentation can have a positive influence on the outcome of the lawsuit because it provides objective evidence of the due diligence efforts.

The LkSG does not work in isolation, but rather in a dense network with other compliance domains. The CSRD reporting (ESRS S2 workers in the value chain, S3 affected communities, G1 business behaviour) overlaps thematically with the LkSG risk analysis and with the LkSG reporting obligation. Integrated control prevents duplication of work and ensures consistent statements. The GDPR applies to the processing of personal data in the complaint procedure and in supplier communication, such as whistleblower data or supplier employee data in audits.

The Whistleblower Protection Act (HinSchG) requires an internal reporting office that can also record LkSG tips, provided the additional LkSG requirements are met. A combined reporting point is organizationally efficient and transparent for whistleblowers because a single entry path is used. The EU Supply Chain Directive CSDDD and the EU Deforestation-Free Products Regulation (EUDR, Regulation (EU) 2023/1115) further expand the scope of obligations, making supply chain due diligence a key compliance function. CIVAC links LkSG officers, ESG officers, data protection officers and internal reporting offices in a common workspace. The risk register, the action list and the complaint procedure are linked so that thematic overlaps can be recorded once and referenced in every report. This bundling reduces the effort and risk of inconsistency that is typical with separate systems. The supplier master data can also be maintained centrally and used for several tasks at the same time, which noticeably reduces operational effort, especially with large supplier portfolios. A common training matrix for employees addresses the requirements of LkSG, GDPR, HinSchG and ESG reporting in a central system. The EU Deforestation-Free Products Regulation (EUDR) and the US Uyghur Forced Labour Prevention Act (UFLPA) create additional reporting and verification requirements for certain product groups and target markets. Upon request, CIVAC can supplement the risk register with appropriate regulation dimensions so that several legal regimes are maintained in one system.

If you want to reorganize or better organise LkSG obligations, you need three components: a named LkSG representative with an appointment document and reporting line to management, a risk analysis methodology with reliable data sources and a complaints procedure that is confidential, multilingual and actually accessible to the target groups. CIVAC is a compliance platform and officer-as-a-service that bundles all three components in a workspace with EU data residency and interlinks them with the other 24 officer roles.

Licence the workspace for your internal officers, or have our officers appoint them. External orders are processed within 2 working days instead of the industry standard 2 to 6 weeks. The risk analysis template is pre-populated with current country and industry indices, the complaints procedure is available in several languages, and the BAFA report template reflects the current BAFA schema. In the first month, the risk analysis is carried out, in the second month, preventative measures are adopted, and in the third month, the rules of procedure for the complaint procedure are public. The first annual report to BAFA will be submitted the following spring. Turn reading into an assignment. Contact: info@civac.de or the contact form on civac.de. We recommend a 30-minute inventory meeting in which we review your LkSG reporting level, your reporting circle and your existing supplier processes and propose a 90-day plan. The appointment certificate, signed, filed, verifiable. For groups with several subsidiaries, we determine together whether a group LkSG representative with local contacts or a completely decentralized solution is responsible. We are planning the transition to the CSDDD in parallel so that the system does not have to be converted again from 2027 and the investment in the LkSG structure is effective over several reporting years. For suppliers who are severely indirectly affected and below the legal threshold, we offer a reduced version that makes it possible to answer supplier questionnaires from large customers without additional effort.