Supply Chain Act and EU Directive: What Reaches Small Suppliers

Why a law for corporations reaches small suppliers

A metalworking business with 40 employees receives a questionnaire with 60 questions on human rights, occupational safety, and the environment from a major customer, plus a code of conduct to sign. The Supply Chain Act does not apply to the business. It does apply to the customer. Many suppliers have experienced this or something similar since 2023.

At the same time, you hear that the law is being softened and that the EU has withdrawn its plans. This article therefore asks: What actually reaches small suppliers from the Supply Chain Act and the EU directive, and how should they respond? To answer it, we first set out the legal status, then explain a thinking model for how pressure is passed on, weigh two readings, and derive preparations for your own business.

What the Supply Chain Act requires and where it stands

Since 2023, the Supply Chain Due Diligence Act (LkSG) has required companies to respect human rights and certain environmental standards in their supply chains. Due diligence here means that the company must make reasonable efforts to identify and reduce risks. It is not liable for nothing ever happening anywhere in the chain. The obligations include risk management, an annual risk analysis, preventive measures, a complaints procedure, and remedial action in case of violations. The responsible authority is the Federal Office for Economic Affairs and Export Control (BAFA).

1. 2023: start for the largest

   The law initially applies to companies with at least 3,000 employees in Germany.

2. 2024: extension

   The threshold drops to 1,000 employees in Germany; employees of affiliated group companies count toward the parent.

3. September and October 2025: relief in practice

   The federal cabinet adopts an amending bill on September 3, 2025. Since October 1, 2025, BAFA no longer reviews annual reports, and fines are reserved for serious violations.

4. January 2026: first reading

   The Bundestag debates the bill on January 16, 2026, and refers it to the Labour and Social Affairs Committee. It provides for abolishing the reporting obligation retroactively from 2023 and reducing the number of fineable offenses from 13 to 4.

5. July 2026: a new plan

   On July 2, 2026, the coalition committee decides to limit the scope to companies with at least 5,000 employees and more than 1.5 billion euros in turnover. This is to be legislated in fall 2026.

According to the overview on lieferkettengesetz.org, no amending act had been promulgated in the Federal Law Gazette by the end of October 2026. Legally, the previous version with the 1,000-employee threshold therefore still applies, even though BAFA has already relaxed its practice. The due diligence obligations themselves remain.

What the EU directive still provides after the Omnibus reform

In parallel, the EU adopted the Corporate Sustainability Due Diligence Directive (CSDDD), a directive on due diligence in supply chains. With the so-called Omnibus I package, it scaled this back considerably. The amending directive entered into force on March 18, 2026, as Sustainability as a sales argument describes. Since then, the CSDDD applies only to companies with more than 5,000 employees and more than 1.5 billion euros in turnover, from mid-2029. Member states must transpose it by July 26, 2028. Large companies are to take a risk-based approach, acting where they have identified risks.

The direction is clear: the legal obligation is being restricted to ever fewer, ever larger companies. For a supplier with 40 or 400 employees, however, this does not automatically mean fewer requests. Its customers remain the same.

The thinking model: pressure to conform through dependence

Why do obligations for corporations reach small businesses? In 1983, the sociologists Paul DiMaggio and Walter Powell described why organizations become alike. One cause they name is coercive isomorphism: organizations adopt rules and practices because others they depend on demand it. These may be lawmakers, but equally large customers, banks, or rating agencies.

For the supply chain, this means that the law hits the corporation. The corporation passes part of its obligations on to its direct suppliers through contracts, codes, and questionnaires, because it must demonstrate that it has made an effort. The direct supplier in turn asks its own suppliers. An everyday analogy: as with a stone dropped into water, the wave is highest in the middle but also reaches the shore, where nobody saw the stone.

The law addresses the big companies. The questions land with the small ones.

Two readings: a burden or an opportunity for small and mid-sized firms?

A qualitative study by Bebic, Badie, Tyll, and colleagues (2025) lends weight to both readings. In summer 2023, the authors conducted ten in-depth interviews with German mechanical and plant engineering companies with between 106 and 20,000 employees. As barriers to sustainability topics, respondents named a lack of staff, unclear terms, legal complexity, a lack of standards, and high time pressure. As drivers, they named above all customer requirements, attracting skilled workers, the influence of rating agencies, and their own conviction.

The authors explicitly describe how requirements of larger companies cascade down to small and mid-sized businesses. As good practice, they recommend clear responsibilities, a central point for the topic, and integration into existing processes. Ten interviews are not a representative sample, and the authors themselves note possible self-selection of participants. The findings nevertheless fit the thinking model: the strongest driver is the customer, not the law.

I therefore consider the second reading the more useful one, without downplaying the burden. The requests will come either way, as long as major customers need them for their own risk management. Answering them properly once saves time on every further request.

How to prepare as a supplier

From the model and the findings, I derive an evidence folder: a collection created once, from which you answer every customer request. It does not replace legal advice, but it turns many individual requests into a repeatable process.

1. Assign responsibility

   Designate one person who bundles all requests on supply chain and sustainability. In the study by Bebic and colleagues, clear responsibility was the most important recommendation.

2. Collect basic data

   Keep occupational safety briefings, records on working hours and minimum wage, environmental permits, certificates, and a list of your main upstream suppliers with country of origin in one place.

3. Check your own upstream suppliers

   Ask upstream suppliers from higher-risk countries where material comes from and under which conditions it is produced. Due diligence on business partners describes how.

4. Draft standard answers

   Write short answers to the most frequent questions and update them once a year. Documenting processes without filling binders shows how to document processes without piles of paper.

5. Have contracts checked

   Read clauses on audit rights, liability, and termination carefully before signing, and negotiate effort and deadlines.

A worked example shows why this pays off. Suppose you receive 12 customer requests a year. Without preparation, each costs about eight hours, so 96 hours. With an evidence folder, you need 30 hours once to set it up and then two hours per request, a total of 54 hours in the first year and 24 hours in each following year. The figures are freely chosen, but the order of magnitude shows that preparation pays for itself in the first year.

What carries over and what does not

Softening the LkSG and the CSDDD reduces the legal pressure on large companies. The pressure to conform on suppliers does not disappear completely, however, because major customers want to know their supply chains in their own interest too: because of supply failures, reputational damage, and requirements from their own customers. Geopolitics as a business risk discusses how geopolitical risks change supply chains. If a large part of your revenue depends on one customer with high demands, you should also keep an eye on concentration risk.

The limits of this analysis are clear. How many requests small businesses actually receive and what they cost has hardly been surveyed systematically for Germany. And the legal situation may change again with the law announced for fall 2026.

Conclusion: the pressure comes through the customer

To the guiding question: no direct obligation from the Supply Chain Act and the EU directive reaches small suppliers, but part of their large customers' obligations does, through codes, questionnaires, and contract clauses. The legal thresholds are rising, BAFA has not reviewed reports since October 2025, and the EU will apply its directive to the largest companies only from 2029. Customer requests will become fewer as a result, but they will not disappear. Building an evidence folder lets you answer them with little effort and turns reliability into a sales argument.

• Gather all customer requests on supply chain and sustainability from the last twelve months.
• Name one responsible person.
• Collect the basic data for the evidence folder in one place.
• List your main upstream suppliers with country of origin.
• Check the status of the LkSG amending act again in the first quarter of 2027.