Due diligence in supply chains

From the year 2023, numerous companies will be required to observe new legal obligations aimed at improving the human rights situation in Germany and abroad and the environment. Violations of these obligations will be subject to significant sanctions under the German Supply Chain Due Diligence Act (“Supply Chain Act”), enacted on 16 July 2021. To avoid incurring such sanctions, companies will have to implement comprehensive compliance processes and observe organisational due diligence obligations. Furthermore, through at least annual risk analyses, they must check whether there are any human rights risks or even violations of humans rights or of certain environmental obligations in their own business operations or on the part of their direct suppliers along the supply chain (from the extraction of raw materials to the delivery of the product to the end customer). This will require adjustments to be made to contractual bases and purchasing conditions between companies and their business partners. And the companies’ own employees will need to be trained on the new obligations.

The German Act on Corporate Due Diligence in Supply Chains (“Supply Chain Act”) will apply to companies that have their headquarters, their principal office or a branch office or their registered office in Germany. Initially, from the year 2023, it will apply to companies of the aforesaid type with 3,000 employees or more. After a one-year transition period, i.e. from the year 2024, it will then also apply to companies with 1,000 employees or more. From this second stage, at the latest, several thousand German-based companies will be directly or indirectly affected by the Supply Chain Act.

As regards the calculation of the number of employees, the Supply Chain Act clarifies that employees posted abroad must also be taken into account. Temporary workers are taken into account in the calculation of the number of employees of the hiring company if they work there for more than six months. Within affiliated companies, as defined in § 15 of the German Stock Corporation Act, all employees of all group companies who are employed in Germany must be taken into account when calculating the number of employees of the parent company.

Irrespective of these statutory criteria, it can already be seen in individual industries that powerful customers want to contractually require their suppliers to comply with the obligations under the Supply Chain Act even if these suppliers are not actually covered by this Act due to their company size. As a result, even small or medium-sized enterprises who, according to the Supply Chain Act, are not (yet) subject to obligations are de facto required to act in accordance with the obligations stipulated therein. The demands made in this context on small enterprises are not always reasonable, which can lead to negotiation processes to find more practicable solutions.

The German Supply Chain Act focuses first and foremost on the protection of elementary human rights and environmental obligations. The specific requirements include:

• An active risk analysis (§ 5) to identify the human rights and environmental risks in the company’s own business operations and on the part of direct suppliers. Important aspects to be considered in this context include, without limitation, the prohibition of child labour and forced labour, the obligation to ensure occupational safety, compliance with working time requirements, the obligation to pay the statutory minimum wage and the right to organise. Companies are required to observe the human rights and environmental due diligence stipulated in the Supply Chain Act in Germany and abroad, along the entire supply chain (§ 3 (1)). This requirement only ends when the product is delivered to the end customer, which means that the collaboration with transport companies and parcel services is also covered by the human rights due diligence obligations.
• According to § 4 of the Supply Chain Act, a special risk management system must be set up to identify human rights risks and prevent, put an end to or minimise violations of protected legal positions or environmental obligations. This risk management system can and should be combined with the compliance system already in place especially in larger companies; the exact design will, as is often the case, depend on the circumstances of the individual case. Regardless of the exact design chosen, it is always important to clearly define who is responsible for risk management – the Supply Chain Act provides for the appointment of an internal human rights officer (§ 4 (3)).
• Documentation and reporting obligations (§ 10): The fulfilment of the due diligence obligations imposed by the Supply Chain Act must be documented internally on an ongoing basis. In addition, the company must prepare and publish an annual report on the fulfilment of its due diligence obligations.
• Preventive measures (§ 6): If a company identifies human rights risks in the course of its risk analysis, it must promptly issue a policy statement regarding its human rights strategy. Furthermore, it must take appropriate preventive measures. Such measures can also take the form of contractual agreements with suppliers and training for employees.
• Internal complaints procedure (§ 8): Every company that is included within the scope of the Supply Chain Act must offer an (internal or external) complaints procedure. This is intended to allow employees and other persons affected along the supply chain to report human rights and environmental risks, as well as violations of human rights-related and environmental obligations.
• If an imminent or actual violation of a protected legal position is identified within the company’s own business operations or in the supply chain, the company concerned must promptly take appropriate remedial action to prevent, put an end to or minimise such violation (§ 7). With regard to the specific obligations to act, a distinction is made between the company’s own business operations, the operations of the direct supplier and the operations of indirect suppliers. Different obligations to respond apply in each of these cases.
• In the company’s own business operations, the remedial action must put an end to the violation. In the event of a violation by the direct supplier, the supplier must be influenced in such a manner as to prevent the violation or ensure it is terminated. As a last resort, the business relationship must be discontinued (§ 7 (3)). In the case of indirect suppliers, if the company obtains substantiated knowledge of a possible violation of a protected legal position or an environmental obligation, it will be required in future to promptly carry out a risk analysis, take preventive measures and develop and implement a plan to prevent or minimise the violation of a protected position (§ 9 (3)).

The basic due diligence obligation under the German Supply Chain Act regards the implementation of a risk management system. Companies should, therefore, set up the relevant processes as early as possible in order to fully comply with the requirements imposed by the Act.

Within the company, a responsible person must be designated to determine the implementation effort and develop the internal measures aimed at firmly establishing and communicating a human rights and prevention strategy. If necessary, this person should receive pertinent training as a precaution.

It is particularly important to implement contractual safeguards by introducing appropriate clauses into the supply contracts. In addition to imposing the obligation to comply with, and contractually pass on, the due diligence obligations, to the extent required by law and reasonable and feasible, companies should also make sure they stipulate rights of termination, rights to be indemnified and the right to audit all supplier operations. Regardless of the findings of the risk analysis, companies would be well-advised to draw up a code of conduct for suppliers, as well as a code of conduct for their own employees. The verification and monitoring should be carried out using the existing practices for business partner audits and supplier risk management. In addition, we recommend appointing external, independent third parties to carry out audits in the supply chain. Human rights violations are often linked to criminal offences, which, in the case of supply relationships, can also involve money laundering risks. For companies that fall within the scope of the Supply Chain Act, supplier due diligence reviews should, therefore, be standard practice.

As far as due diligence in the company’s own business operations is concerned, companies should check their processes in the areas of health and safety at work and quality and environmental management and enhance them to the point that they also cover the human rights and environmental requirements under the Supply Chain Act.

Finally, a complaints procedure must be set up to ensure that information regarding human rights violations or violations of environmental obligations can be received. The wise thing to do might be to take into account the upcoming implementation of whistleblower protection under the German Whistleblower Protection Act in the process.

The human rights and environmental due diligence obligations set out in the German Supply Chain Act represent an addition to the existing compliance requirements. Companies are generally obliged to systematically work towards preventing violations of the law and other rules by implementing a compliance management system (CMS).

In order to create synergies, the measures adopted to comply with the Supply Chain Act should be integrated as best as possible into the existing compliance structures. This applies not only to the required risk analysis and risk control but also and in particular to preventive measures, such as training, communication measures and whistleblowing systems. The existing compliance function can generally also be used when appointing a human rights officer. In the same manner, documentation and reporting processes can also be organised efficiently – if possible, even in combination with sustainability reporting.

Accordingly, if not already in place, companies should use the introduction of the Supply Chain Act as an opportunity to establish adequate and effective compliance structures that offer protection not only with regard to human rights and environmental requirements but also with regard to other relevant legal risks, such as corruption, antitrust law, money laundering or export control.

Synergies can be achieved in particular when integrating preventive and control measures in procurement. The human rights and environmental requirements for suppliers and service providers should be expressly formulated in the procurement strategy and then be consistently implemented in all relevant subsequent processes. This includes the invitation to bid, the definition of the criteria to be applied in the selection of suppliers and the weighting of these criteria when awarding the contract. It is important to note in this context that the term “supplier” does not only refer to suppliers of raw materials but also to service providers and consultants and even the transport company that delivers the product to the end customer.

To ensure that the new due diligence obligations are handled in a legally compliant manner, the supply contracts may have to be amended.

The suppliers of the companies concerned must be contractually required to support the companies included in the scope of the German Supply Chain Act in fulfilling their human rights and environmental due diligence obligations. This also includes the obligation to comply with the requirements under the Supply Chain Act, as well as being required to comply with a code of conduct issued by the company.

It is also important to amend the supply contracts to include comprehensive rights to audit all suppliers, be it through the company’s own staff or – as might frequently be the case in future – through independent, external third parties.

Moreover, it should be specified in the contract that any non-compliance by the supplier with human rights and environmental obligations and/or any failure by the supplier to try and get its own suppliers to ensure compliance can constitute cause to terminate the supply contract without notice.

As part of a graded process detailed in § 7 (1) to (3), the new German Supply Chain Act provides for an obligation to prevent or put an end to the violation of rights, as well as for an obligation to exert an influence on the direct supplier with a view to preventing or putting an end to the violation of human rights. To this end, the supplier may be required to develop and implement a plan designed to put an end to or minimise the violation or threat of violation of the human rights-related or environmental obligation.

To ensure compliance with the due diligence obligations set out in the Supply Chain Act, the Supply Chain Act, as a last resort, even provides for an obligation to discontinue the business relationship with the supplier. Such a discontinuation will be required if the violation of a protected legal position or of an environmental obligation is classified as very serious, the implementation of the measures worked out in the plan developed by the supplier for the prevention of violations of rights has not produced any remedial effects after the expiry of the time period set for this purpose, there are no other, less drastic means available to the company and an enhancement of the ability to exert influence does not seem promising.

The appropriate response will, however, depend on the particular circumstances of the respective individual case.

Compliance with the obligations set out in the German Supply Chain Act is ensured by the threat of a fine, the amount of which will depend on the company’s turnover, amongst other things, and can be as high as two percent of the average worldwide annual turnover, calculated on the basis of the average turnover of the last three fiscal years! The German legislator has opted for public enforcement of the new Supply Chain Act by a higher federal authority, the Federal Office for Economic Affairs and Export Control (BAFA).

Companies punished with a fine in accordance with § 24 of the Supply Chain Act due to a violation that has been established by a final decision are additionally threatened with a temporary ban on participating in public invitations to tender (§ 22). The exclusion may be for a period of up to three years.

Civil liability for violation of the obligations under the Supply Chain Act has been expressly excluded in the Act. However, civil liability established “independentlyof this Act” is conceivable, for example, based on national or foreign tort law. A good example in this respect is a judgment by the Regional Court of Dortmund from the year 2019 regarding damages for a fire in a Pakistani-based factory of a supplier of the textiles manufacturer Kik: according to the Regional Court, the only reason why the company could not be held liable by the surviving relatives of the victims of the fire under Pakistani law, the so-called law of the place of effect, was that the limitation period had already expired, according to Pakistani law (for specific information on this matter: Regional Court of Dortmund, Judgment of 10 January 2019, case no. 7 O 95/19).

The enforcement of any claims for damages in connection with human rights violations is to be facilitated in future by a special right to sue in one’s own name with regard to a third-party right, as provided for in § 11 of the Supply Chain Act. According to this provision, persons concerned can authorise trade unions or non-governmental organisations to file a suit in Germany. This may lead to an increase in legal actions brought by NGOS against German-based companies, as can be observed already today in the case of some of the first “climate lawsuits”.

At Luther, we have already been dealing with issues relating to the Supply Chain Act and its introduction since the spring of 2021. The Act and the specific obligations thereunder are, of course, new to us, but not the fundamental approach taken by the legislator to involve companies in the protection of human rights and the environment, to also impose on them obligations that regard their customers and suppliers (“know your customer”) and to officially monitor compliance with these obligations and, if necessary, impose sanctions. We are familiar with this approach and know the related issues and challenges and also the requirements for compliance structures from many other fields. Moreover, we are also familiar with the Federal Office for Economic Affairs and Export Control (BAFA) – the authority responsible for enforcing the Supply Chain Act – and know very well how it works from lots of client work carried out in fields such as export control, the promotion of economic development and environmental energy law.

Our range of advisory services

We offer a broad range of legal advice and support with regard to the Supply Chain Act and its implementation in the company. We can provide assistance both with the introduction from scratch of compliance management systems and with the implementation of individual requirements under the new Act – and we can also help defend against excessive demands made by contractual partners and the enforcement agency:

• Advising on the scope and fundamental obligations
• Advising on the concrete definition of obligations and on implementation issues, also taking into account official guidelines and best practice guidelines
• Examining existing compliance structures and advising on any adjustments needed
• Reviewing and revising contracts and model clauses
• Reviewing, revising and drafting sustainability and supplier’s declarations
• Carrying out GAP analyses to identify risks and determine the status quo upon introduction of the Supply Chain Act
• Assisting with the legally required annual risk analysis
• Advising on necessary and appropriate measures within the framework of risk management
• Assisting with the creation of the documents required by the Supply Chain Act (policy statement, code of conduct, code of conduct for suppliers, documentation and reports)
• Providing antitrust advice in connection with cooperation among companies
• Advising on how to set up a complaints procedure in conformity with the Supply Chain Act
• Providing training for management, staff and suppliers/customers
• Advising and assisting with administrative proceedings, conducting the defence in fine proceedings and providing representation in court proceedings