Supply-chain compliance 2026: LkSG, CSDDD, CBAM and sanctions

The regimes act in parallel with different triggers and evidence requirements:

• LkSG (DE): Due diligence for own operations and direct suppliers. Risk analysis, grievance mechanism, BAFA report.
• CSDDD (EU): Extends LkSG to the whole chain of activities incl. indirect suppliers, with civil liability.
• CBAM: Carbon Border Adjustment Mechanism – certificate obligation for imports of cement, iron/steel, aluminium, fertilisers, electricity, hydrogen from 2026.
• EUDR: Anti-deforestation regulation for soy, palm oil, coffee, cocoa, rubber, wood, cattle and derivatives.
• Sanctions EU/US/UK/CH: List- and goods-based (dual use, export control).
• DAC7 / platform reporting: Relevant for logistics marketplaces.

The challenge is not each rule alone – it is orchestration: who holds what data, who triggers which process, who answers in an audit?

The German Supply Chain Act requires nine elements to be reported annually to BAFA:

1. Policy statement by management
2. Risk analysis (at least annually, ad-hoc)
3. Risk management process
4. Prevention in own operations
5. Prevention with direct suppliers
6. Remediation of identified breaches
7. Grievance mechanism (internal and external)
8. Due diligence vs. indirect suppliers on substantiated information
9. Documentation and reporting

Logistics-specific: transport is part of own operations; carrier selection and subcontracting chain is the direct supplier layer. BAFA scrutinises driver hours, bogus self-employment and dumping structures.

CSDDD goes significantly beyond LkSG:

• Deeper scope: Entire chain of activities.
• Civil liability: Claimants can sue in EU courts.
• Thresholds: 1,000+ employees and EUR 450m turnover (phased from 2027, full 2029).
• Climate plan: Companies must set and execute 1.5°C transition plans.

For logistics: sub-tier transparency (to producer) becomes essential. Digital supplier platforms, blockchain chain-of-custody and standardised DD questionnaires become mandatory tools.

CBAM is in the definitive phase in 2026. Core obligations:

• CBAM registration: Importers must be authorised CBAM declarants.
• Quarterly reports: Emission data per shipment (PCF logic).
• Certificates: Purchased based on embedded emissions, priced to EU ETS.
• Supplier data: Non-EU producers deliver emission data, otherwise default values apply (higher, pricier).

For transport/customs providers: integrate CBAM data flows into customs declarations, educate customers, support producer networks. Fines EUR 10–50/t CO2-eq plus buyback.

Sanctions regimes (EU, US OFAC, UK, CH SECO) and export control (Dual Use Reg, US EAR) are the most dynamic compliance field since 2022. Core processes:

• List screening: All partners daily.
• Goods control: EU Dual-Use list, US ECCN, national annexes, sectoral bans.
• End-use / end-user: End-user statements, export-control proofs.
• Enhanced due diligence: On circumvention risk (AM, KZ, TR, UAE) higher scrutiny.

Penalties are existential: OFAC imposes million-dollar fines; BAFA revokes authorisations. Forwarders are co-liable along the chain.

To stay sharp in 2026, an integrated setup is key:

• Governance: Compliance officer with proxy, direct report to MD.
• Data: Master data for partners, goods (HS/ECCN), origin, CO2 footprint.
• Screening tool: Automated sanctions screening (Dow Jones, Refinitiv, AEB, MIC-Cust).
• Workflow: Hold/release rules, escalation guide, audit-ready decision log.
• Training: Annual ops, sales, procurement; dedicated export-control sessions.
• Audit readiness: 7-year retention, traceable decision chain, risk register.

The investment pays off at the first serious audit – or when a fine is avoided.