Human rights risk analysis under the LkSG: step by step from identification to prioritisation

What section 5 LkSG requires

The risk analysis is the starting point of the due diligence obligations under the German Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz, LkSG). Under section 5(1) LkSG, a company must, as part of its risk management, carry out an appropriate risk analysis to identify the human rights and environmental risks in its own business area and at its direct suppliers. Where a company has structured a supplier relationship abusively in order to circumvent these obligations, an indirect supplier is deemed to be a direct supplier.

The risks identified must be appropriately weighted and prioritised (section 5(2)). The criteria in section 3(2) LkSG are decisive:

• the nature and scope of the business activities,
• the ability to influence the party directly causing the risk,
• the severity of the violation that can typically be expected, its reversibility and its probability,
• the nature of the company's own contribution to causing the risk.

The results must be communicated internally to the relevant decision-makers, such as the management board or the purchasing department (section 5(3)). The analysis must be carried out once a year and, in addition, on an ad hoc basis where the company must expect a significantly changed or significantly extended risk situation, for example through new products, projects or business fields. Findings from the complaints procedure under section 8 must be taken into account (section 5(4)). For indirect suppliers, section 9(3) applies: where there are factual indications that a violation may have occurred (substantiated knowledge), an ad hoc risk analysis must be carried out without undue delay.

The international benchmark: UN Guiding Principles and OECD Guidance

The LkSG builds on the UN Guiding Principles on Business and Human Rights of 2011. Under Guiding Principle 17, human rights due diligence comprises assessing actual and potential impacts, integrating and acting upon the findings, tracking responses and communicating how impacts are addressed. It is ongoing, because risks change as operations and the operating context evolve. Guiding Principle 18 calls for drawing on internal or independent external expertise and for meaningful consultation with potentially affected groups. Particular attention is due to groups at heightened risk of vulnerability or marginalisation. Under Guiding Principle 19, the appropriate response depends on whether a company causes or contributes to an impact or is only linked to it through a business relationship, and on the extent of its leverage.

The OECD Due Diligence Guidance for Responsible Business Conduct (2018) gives this concrete form. Under step 2.3, a company assesses its involvement in an impact. Under step 2.4, where not everything can be addressed at once, it prioritises the most significant risks based on severity and likelihood. For human rights, the Guidance states that severity is a greater factor than likelihood.

The analysis in five steps

The BAFA guidance “Identifying, weighting and prioritizing risks” (1st edition, August 2022) describes a staged approach. The following sequence can be derived from it:

1. Preparation: recording the group companies over which a decisive influence is exercised, their sites, activities and procurement categories, and the direct suppliers.
2. Abstract risk assessment: matching country and sector risks against the company's own business area and supplier portfolio. The result is a set of sites, countries or procurement categories with an increased risk disposition.
3. Concrete risk assessment: verifying plausibility in the specific context, for example through self-assessments, audits or findings from complaints channels. According to the guidance, probability and severity are to be assessed separately, for example on a scale or heat map. The results are documented systematically, for instance in a risk inventory.
4. Prioritisation: weighting according to the criteria in section 3(2) LkSG and assigning a person responsible for each priority risk. According to the guidance, the nature and scope of the business activities are to be considered overall, not as a separate prioritisation criterion.
5. Communication and measures: passing the results on to decision-makers and deriving preventive measures for the priority risks.

The guidance stresses a change of perspective. What matters is not how a risk affects business success, but whether employees, people in the supply chain or others affected may come to harm.

Risk-based means prioritising, not querying everything

In its FAQ on the risk-based approach (February 2025), BAFA makes clear that companies do not have to review all suppliers and do not have to address all risks at the same time. Undifferentiated questionnaires or passing the statutory obligations on to suppliers one-to-one are not in line with the risk-based approach. The EU Corporate Sustainability Due Diligence Directive (CSDDD) likewise provides in Article 9 for prioritisation based on severity and likelihood. Amending Directive (EU) 2026/470 of 24 February 2026 has replaced Article 8(2): first a scoping exercise, then an in-depth assessment in the areas where adverse impacts are most likely to occur and most severe.

Legal status

The obligation to carry out a risk analysis continues to apply unchanged. A deficient or late risk analysis is a regulatory offence under section 24(1) no. 2 LkSG, with a fine of up to EUR 500,000. The government bill amending the LkSG (Bundestag printed paper 21/2474 of 29 October 2025) retains the risk analysis as an obligation but deletes this offence. The Bundestag held the first reading of the bill on 16 January 2026 and referred it to the committees. According to the BAFA announcement of 1 October 2025, BAFA now imposes fines only for serious violations connected with particularly grave human rights violations.

This post provides a general overview of the legal position and does not replace legal advice on individual cases.

← All posts