The requirement: an appropriate and effective system
Companies are required to establish an appropriate and effective risk management system in order to fulfil the due diligence obligation (Article 3(1)). Risk management must be ensured at all stages of the relevant business by means of appropriate measures.
Which measures count as effective?
Where a company causes or contributes to the risks or violations listed in the Act within its supply chain, measures that make it possible to identify and minimise human-rights-related and environmental risks, and also to prevent, end, or minimise the extent of violations of human rights or environmental obligations, are deemed to be effective measures in the fulfilment of the due diligence obligation.
The human rights officer and reporting to management
By appointing a human rights officer, the company is obliged to ensure a determination of who within the company is responsible for monitoring risk management. Management must obtain information about the work of the responsible person or persons on a regular basis, at least once a year.
Affected interests and the risk plan
In establishing and implementing the risk management system, the company is obliged to give due consideration to the interests of its employees, of the employees within the supply chain, and of persons who may otherwise be directly affected in any way, in a protected legal position, through the company’s economic activity or through the economic activity of a company in its own supply chains.
For this reason, both the Act and the Directive seek and require that all companies within their scope draw up a risk plan relating to the due diligence obligation.
Practical starting points
In practice, an effective risk management system rarely needs to be built from nothing. Companies can anchor supply chain due diligence in structures that already exist — compliance management, quality management, and procurement controls — provided that responsibilities, reporting lines, and documentation are defined in writing. The starting point is transparency about the company’s own supply chain: which products and services are sourced, from which suppliers, and from which regions.
What this means for suppliers in Türkiye
The Act has been in force since 1 January 2023, so a risk management system should by now be established and have been run at least once. Three steps have proven useful as a first stage: mapping suppliers and sourcing countries; assigning responsibility for monitoring risk management to a clearly designated function, such as a human rights officer, with regular reporting to management; and integrating due diligence criteria into supplier selection and onboarding. Suppliers in Türkiye that are not yet in scope themselves are worth preparing on the same lines, because German customers pass their own obligations down the chain by contract — and moving early on supply chain due diligence is what secures the continuity of the commercial relationship. How these elements combine into one coherent structure is described in our LkSG/CSDDD compliance programme service.
