Compliance in the sourcing of made-to-order parts
In an increasingly globalised and regulated world, transparency in the supply chain is becoming ever more important in order to minimise risks and meet regulatory requirements. For technical buyers, this means that alongside price, quality and delivery date, the question of whether their suppliers comply with legal requirements on human rights, working conditions and environmental protection is coming to the fore. Violations can result in fines, exclusion from public contracts and reputational damage. Traceability, regular supplier evaluation and comprehensible documentation reduce these compliance risks in procurement.
What are compliance risks in procurement?
Compliance risks in procurement are risks that arise from violations of legal requirements in the supply chain. Regulations such as the German Supply Chain Due Diligence Act (LkSG) require companies to review their supply chains with regard to human rights, working conditions and environmental protection. Supplier compliance thus becomes a task for purchasing: anyone who cannot trace where materials come from and under what conditions they were produced risks legal consequences and reputational damage.
This article focuses on human rights and environmental due diligence obligations under the LkSG and the CSDDD. There are other compliance areas in procurement, such as corruption prevention, antitrust law, export control and sanctions lists, or substance regulations such as the EU chemicals regulation REACH. They follow their own rules and are not covered in detail here.
Regulatory pressure on the supply chain
Globalisation has made supply chains in the European manufacturing industry more complex and introduced numerous external risks into the sourcing of CNC made-to-order parts. How technical buyers identify and limit these risks is described in the article on supplier risk management.
Legal requirements add to this. The German Supply Chain Due Diligence Act (LkSG) and the EU Corporate Sustainability Due Diligence Directive (CSDDD) require companies to implement human rights and environmental due diligence obligations in their supply chains. A supply chain is therefore only resilient if it not only cushions disruptions but also meets these requirements.
Legal framework: LkSG and CSDDD as of October 2026
LkSG: current law and planned amendment
The LkSG applies to companies with, as a rule, at least 1,000 employees in Germany. Among other things, they must establish risk management, carry out risk analyses, take preventive and remedial measures and offer a complaints procedure (Section 3 LkSG). The risk analysis must be carried out once a year and on an ad hoc basis (Section 5(4) LkSG).
Since 1 October 2025, the Federal Office for Economic Affairs and Export Control (BAFA) no longer reviews company reports under Sections 12 and 13 LkSG and only imposes fines for serious violations (BAFA). The reporting obligation itself remains in the law.
The German government intends to abolish the reporting obligation retroactively to 1 January 2023 and to limit the offences subject to fines to serious violations; under the draft, the due diligence obligations themselves remain in place (Bundestag printed paper 21/2474). The Bundestag debated the draft at first reading in January 2026 (German Bundestag). The amendment has not yet been passed. In addition, on 1 July 2026 the coalition committee announced that it would transpose the CSDDD on a one-to-one basis and align the LkSG with its thresholds (epd, 2 July 2026).
CSDDD: adopted, transposition by 2028
With amending Directive (EU) 2026/470 from the so-called Omnibus I package, the EU has significantly narrowed the CSDDD. In future, it will cover companies with at least 5,000 employees and worldwide net turnover of at least EUR 1.5 billion (Noerr, 2026). Member states must transpose the directive by 26 July 2028, and the new obligations must be met from 26 July 2029. Companies may focus on a risk basis on the areas where adverse impacts are most likely to occur and most severe (Noerr, 2026).
A legal framework in motion
These developments show that the legal framework for supply chain due diligence is constantly evolving. The topic remains relevant for purchasing in any case, as the due diligence obligations under the LkSG continue to apply.
What this means for medium-sized suppliers
As a rule, medium-sized suppliers fall neither under the LkSG nor, in future, under the CSDDD. They are affected indirectly when large customers implement their due diligence obligations in the supply chain, for example through supplier self-assessments, codes of conduct or contractual assurances. In its guidance on cooperation in the supply chain, BAFA makes clear that obligated companies may not pass on their obligations under the LkSG to suppliers (FGS, 2023). Under the amended CSDDD, information may only be requested from business partners with fewer than 5,000 employees if it cannot reasonably be obtained in any other way (Noerr, 2026).
Sanctions and consequences of compliance violations
Regulation
Possible consequence
Condition
Status Oct 2026
LkSG
Fine of up to 2 percent of average annual turnover (Section 24(3) LkSG)
Companies with annual turnover of more than EUR 400 million; only for certain violations, such as failure to take remedial action.
Current law. Since 1 October 2025, BAFA only pursues serious violations. Planned amendment (not passed) would reduce the offences subject to fines.
LkSG
Exclusion from public contracts for up to 3 years (Section 22 LkSG)
Final fine of at least EUR 175,000; higher thresholds apply to certain violations
Current law (applies as a rule, "Soll-Vorschrift"). Planned amendment would remove one of the higher thresholds.
CSDDD
Pecuniary penalties with a maximum limit of 3 percent of worldwide net turnover (Noerr, 2026)
Companies within the scope of the CSDDD
Adopted; transposition into German law pending; obligations from 26 July 2029
Sanctions for compliance violations in the supply chain
Added to this is reputational damage: a lack of transparency increases the risk of legal consequences and loss of reputation with customers. For suppliers who are not themselves obligated, the risk lies primarily in the customer relationship. The LkSG provides for terminating a business relationship as a last resort if a very serious violation is not remedied despite agreed measures and no milder means are available (Section 7(3) LkSG).
Supplier compliance checks: a five-step approach
A supplier compliance check builds on regular supplier evaluation. In addition to quality and on-time delivery, the criteria include certifications as well as sustainability practices and ESG compliance. This evaluation is therefore an integral part of systematic supplier risk management.
1. Prioritise suppliers on a risk basis
Not every supplier needs the same depth of review. Relevant factors include the country of location, industry, materials and intermediate products, as well as purchasing volume. A contract manufacturer in Germany that processes semi-finished products with a mill certificate from a European producer requires a different depth of review than a supplier whose input material comes from regions with known human rights or environmental risks.
2. Obtain a supplier self-assessment
A standardised questionnaire records company data, locations, key sub-suppliers, the origin of materials, existing certifications and labour and environmental standards. A supplier code of conduct sets out expectations. Especially with smaller suppliers, the rule is: only ask for what is actually needed for the risk analysis, and reuse existing evidence.
3. Check certifications and evidence
Relevant evidence includes environmental management to ISO 14001, occupational health and safety to ISO 45001 and energy management to ISO 50001. Material certificates in accordance with EN 10204 document the properties and the manufacturer of the material used. Validity, scope and issuing body must be checked. A certificate proves a functioning management system, but not compliance with all requirements in each individual case.
4. Document and review regularly
Results, evidence with expiry dates and agreed measures belong in a central supplier file. The evaluation is repeated at fixed intervals and additionally on occasions such as a change of location, new sub-suppliers or indications of violations. For companies within the scope of the LkSG, this rhythm is prescribed by the annual and ad hoc risk analysis.
5. Take graduated action when risks are identified
The first step is usually a conversation with the supplier, followed by a joint remediation plan with clear deadlines, training or an on-site audit. Suspending or terminating the business relationship is the last resort. Those who already know a qualified alternative for critical made-to-order parts are best placed to act.
Traceability of materials and products
Transparent supply chains improve the traceability of materials and CNC made-to-order parts. Buyers can trace where materials come from, under what conditions they were extracted and which production steps they have gone through, provided that suppliers and upstream suppliers make the necessary data available. So far, only some companies manage this beyond their direct suppliers: in McKinsey's "Supply chain risk pulse 2025", risk visibility extended to sub-suppliers or beyond for only 42 percent of respondents (McKinsey, 2025). Traceability is particularly important in regulated industries where the highest precision and quality are required. Reliable documentation of the value chain can thus become a competitive advantage.
Sustainability criteria in procurement
Companies with transparent supply chains can better enforce and document their environmental and social standards. Technical buyers can check more specifically whether raw materials come from responsible sources and were produced under fair working conditions.
Typical criteria:
Suppliers' carbon footprint
Energy efficiency of production processes
Recyclability of materials
Social standards and working conditions
Environmental management systems
Monitoring compliance with environmental regulations such as emission limits or energy efficiency standards is made considerably easier by transparent processes.
Supply chain compliance: what digital platforms can do
Digital procurement platforms bundle supplier information in one place. On Techpilot, the profiles of more than 24,000 European manufacturing suppliers include information on certificates, among other things. When submitting a request, the selection can be narrowed down by required certificates (> Techpilot supplier pool). This makes it easier to preselect suppliers who already have the required evidence.
The compliance check itself, i.e. self-assessment, evaluation, documentation and measures, remains the responsibility of the purchasing company. Platforms do not replace it; they shorten the path to suitable suppliers and to alternatives if a business relationship has to be suspended.
Conclusion: compliance as an integral part of the supplier relationship
Compliance risks in procurement do not disappear when the legal situation changes. The LkSG amendment has not yet been passed and the CSDDD has not yet been transposed into German law, but both projects show that the topic remains in motion. The due diligence obligations under the LkSG continue to apply, and large customers pass their requirements on to suppliers. Risk-based checks, clear evaluation criteria and comprehensible documentation make supplier compliance verifiable. How compliance and resilience are connected is explained in the article > Supply chain resilience: Why European suppliers are essential.
For implementation in your team: the > checklist for the strategic sourcing of made-to-order parts contains check points on supply chain, compliance and geopolitical risks, including the LkSG.
FAQ: frequently asked questions about compliance risks in procurement
How do you check a supplier's compliance?
First prioritise suppliers by risk, then obtain a self-assessment, check certifications such as ISO 14001 or ISO 45001 and material certificates, document the results and repeat the check regularly. If risks are identified, a graduated approach follows, from a conversation through a remediation plan to suspending the business relationship as a last resort.
What are the consequences of compliance violations?
Under the LkSG, companies with annual turnover of more than EUR 400 million face fines of up to 2 percent of average annual turnover for certain violations; a final fine of EUR 175,000 or more should lead to exclusion from public contracts. From 2029, the CSDDD provides for pecuniary penalties with a maximum limit of 3 percent of worldwide net turnover. Added to this are reputational damage and, for suppliers, the risk of losing customer relationships (as of October 2026).
What is the German Supply Chain Due Diligence Act (LkSG)?
The LkSG obliges companies with, as a rule, at least 1,000 employees in Germany to implement human rights and environmental due diligence obligations in their supply chains. BAFA has not reviewed the annual reports since October 2025. A draft law abolishing the reporting obligation has not yet been passed. The due diligence obligations continue to apply (as of October 2026).
Does the CSDDD apply to medium-sized suppliers?
Directly, as a rule, no. Following the amendment by Directive (EU) 2026/470, the CSDDD covers companies with at least 5,000 employees and worldwide net turnover of at least EUR 1.5 billion; the obligations apply from 2029, and transposition into German law is still pending. Medium-sized suppliers are affected indirectly through their customers' requirements.
What does traceability mean in the supply chain?
Traceability is the ability to document and trace the origin, processing and path of materials and products through the supply chain. It is particularly important for compliance requirements and quality assurance.
What role do digital platforms play in compliance management?
Digital procurement platforms bundle supplier information such as certificates in one place and thus make it easier to preselect suitable suppliers. The actual compliance check with self-assessment, evaluation and documentation remains the responsibility of the purchasing company.
Sources
- German Bundestag: printed paper 21/2474, draft law amending the LkSG, 29 October 2025 (German)
- German Bundestag: Supply chain act proposals debated, January 2026 (German)
- BAFA: Supply chains, overview (announcement of 1 October 2025, German)
- BAFA: Guidance on cooperation in the supply chain (German)
- LkSG Sections 3, 5, 7, 22, 24 (statutory text via lxgesetze.de, German): Section 3 | Section 5 | Section 7 | Section 22 | Section 24
- Noerr: CSDDD amending directive published in the Official Journal of the EU, 11 March 2026 (German)
- EUR-Lex: Directive (EU) 2026/470 (Omnibus I), Official Journal of 26 February 2026
- FGS: Cooperation in the supply chain, guidance for SMEs and obligated companies, 13 November 2023 (German)
- epd/evangelisch.de: Coalition committee: transpose EU supply chain directive by autumn, 2 July 2026 (German)
- McKinsey & Company: Supply chain risk pulse 2025, 2 December 2025
About the author
Christian Semin is Team Lead Sourcing at Techpilot and has been immersed in the world of custom-manufactured parts for more than 20 years. With a background in mechanical engineering technology, a degree as a Certified Business Manager, and years of hands-on experience in a mechanical engineering company, he brings genuine industry expertise to the table. At Techpilot, he works closely with buyers and suppliers every day and knows exactly what matters when it comes to sourcing CNC parts.
