EU Supply Chain Due Diligence | Vestas Business GmbH

European customers are still asking suppliers for human-rights and environmental information. The legal picture in 2026 is narrower than the headlines of 2023, and it is not finished.

Two regimes, not one slogan

Two texts matter. Germany’s Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz, LkSG) is in force. The EU Corporate Sustainability Due Diligence Directive (CSDDD, Directive (EU) 2024/1760) has been narrowed by the Omnibus I Directive (EU) 2026/470 and is not yet applicable to companies.

Suppliers feel the first regime immediately. Questionnaires, contract clauses and audit requests do not wait for the directive’s application date.

What the LkSG still requires

The LkSG has applied since 1 January 2023. Since 1 January 2024 it covers companies with at least 1,000 employees in Germany. In-scope companies must run a risk analysis, take preventive and remedial measures, and keep a complaints procedure. The duty covers their own operations and direct suppliers. Indirect suppliers come into scope when there is substantiated knowledge of a possible violation.

Berlin has discussed easing parts of the Act, including reporting, and public comment in 2026 describes a lighter supervisory practice focused on serious violations. That is not a repeal. Until an amending statute is published in the Federal Law Gazette, companies in scope still organise their diligence against the Act as written.

What the CSDDD looks like after the Omnibus

The amended directive applies to companies with more than 5,000 employees and more than EUR 1.5 billion in net worldwide turnover. The obligation to adopt a climate transition plan, and the EU-wide civil-liability regime, were removed. Maximum penalties are capped at 3 percent of net worldwide turnover. Member States must transpose the amended directive by 26 July 2028. Company-level obligations apply from 26 July 2029.

The German government has said it intends a 1:1 transposition and has signalled a narrower LkSG in the meantime. Those are political commitments. They are not yet the statute a supplier can rely on.

What global suppliers should do now

Treat this as a customer-access issue. Map one tier down from the European buyer: production sites, subcontractors that touch the product, and the commodities with the highest human-rights or environmental risk. A documented, risk-based map is what a buyer can use. A claim to have mapped every indirect supplier usually is not.

Align contracts before the tender, not after the award. Buyers in scope will ask for positions on forced labour, child labour, worker safety, freedom of association, and selected environmental harms. Keep a short evidence pack: policies, site lists, the last risk review, and how a complaint would be handled. Do not invent data. A precise pack survives enhanced due diligence. A glossy one often does not.

Check which customers are actually in scope. A German importer may still sit under the LkSG at 1,000 employees. A group that will fall outside the future CSDDD can still push the same questions down its contracts.

How this shows up in a mandate

We connect the legal threshold to the operating picture: which entities are in scope today, which supplier questions are proportionate, and which gaps will block a tender. The statute will move again before 2029. The commercial fact — European buyers asking for a chain they can defend — is already here.

General information as of October 2026, based on public texts including the LkSG and Directive (EU) 2024/1760 as amended by Directive (EU) 2026/470. Not legal advice.

All insights