How supply chain law reaches SMEs
4-minute read
Germany’s supply chain law already requires companies above a certain size to consider human rights and environmental risks in their supply chains. Smaller suppliers may also receive questions and contractual requirements from their customers as a result. The European supply chain directive provides for separate obligations at a later date and, following its amendment, covers a narrower group of large companies. For SMEs, the key is to distinguish between legal obligations and specific customer requirements.
Key points at a glance
- The German law already applies. Subject to the statutory conditions, it covers companies that generally have at least 1,000 employees in Germany.
- Customers can request evidence. Whether a supplier provides particular documents or allows an audit also depends on the relevant agreement.
- The EU rules follow a later timetable. Member states are to transpose them by 26 July 2028. They are due to apply from 26 July 2029.
Which companies are directly affected
Subject to the conditions set out in it, the German Supply Chain Due Diligence Act has applied since 2024 to companies that generally have at least 1,000 employees in Germany. These can include medium-sized companies. Special rules apply when calculating employee numbers at affiliated companies.
The European supply chain directive, known as the CSDDD, was amended in 2026. One central category covers EU companies with more than 5,000 employees and more than €1.5 billion in worldwide net turnover. The amending directive also contains rules for certain parent companies and franchise or licensing models, as well as for companies from third countries. Member states must transpose the requirements into national law.
How requirements reach suppliers
Companies that are directly subject to the law must address human rights and environmental risks in their supply chains. The German law provides for risk analyses and preventive measures relating to direct suppliers, among other things. Customers may request information about working conditions, sourcing or existing measures.
A customer may also present a code of conduct or contractual assurances. What information a supplier is obliged to provide and whether inspections are agreed depend on the applicable law and the specific contract. This does not create a general obligation for every smaller supplier to provide a particular certification or agree to every audit.
For the in-depth assessment of business partners, the amended EU directive provides that information should be requested only to the extent necessary. It also contains safeguards for smaller business partners. How the requirements are transposed nationally and what a customer requests in each case remain decisive.
What applies until 2029
The EU amending directive was published on 26 February 2026. Member states are to transpose the supply chain directive into national law by 26 July 2028 and apply the corresponding provisions from 26 July 2029. Until then, the current German law governs companies in Germany.
The German federal government has presented a draft amendment to the German supply chain law. It provides for reporting relief, among other things. A draft, however, is not yet an enacted amendment. Companies should therefore monitor both the ongoing legislative process and the subsequent national transposition of the EU directive.
Preparing for customer requests and reviewing contracts
A first step is to take stock: what information is already available about your own sites, sourcing routes and known risks? Gathering existing policies, responsibilities and evidence in one place can help companies deal with recurring customer questions in an organised way. Documents should contain only information that the company can substantiate and keep up to date.
When considering new contractual clauses, it is worth examining their scope and consequences: what assurances does the customer require? Do they relate to the company’s own operations or also to upstream suppliers? Who bears the cost of an inspection and how are trade secrets protected? Companies should seek legal advice on unclear or wide-ranging obligations before signing.
Frequently asked questions
Are medium-sized companies directly subject to the German supply chain law?
That is possible. Subject to its other conditions, the law applies to companies that generally have at least 1,000 employees in Germany. Special calculation rules apply to affiliated companies.
Must smaller suppliers meet every customer requirement?
There is no blanket answer. The applicable law and the specific agreement with the customer are decisive. Extensive information and audit clauses should be reviewed before acceptance.
When are the EU requirements due to apply?
Member states are to transpose the amended requirements by 26 July 2028. They are due to apply from 26 July 2029. The German supply chain law already applies.
Read more on MyBusinessFuture
MyBusinessFutureFunding programmes hold SMEs backMyBusinessFuturePSD3: What finance chiefs need to know nowMyBusinessFutureProcess optimisation without an endless projectMore from the MBF Media Network
cloudmagazinCloud trends for SMEsDigital ChiefsIT strategy for decision-makersSecurityTodayThe security landscape in briefImage source: AI-generated (July 2026)
Translated from the German original using artificial intelligence. The German version is authoritative.
