LkSG-ready DMC criteria for DACH procurement teams

Birtour is a Baku-based DMC running corporate programs for DACH procurement teams under contracted vendor terms. Germany's Lieferkettensorgfaltspflichtengesetz has not been amended: the statute still binds companies with 1,000 or more employees in Germany, and its annual reporting duty is still printed in §10(2). What changed is enforcement. BAFA stopped reviewing reports and closed the submission channel on 1 October 2025, and the bill that would repeal the duty is still moving. Most regional DMCs have read that as "LkSG got easier". In vendor onboarding it did not, because the duty that reaches a supplier was never the reporting duty. Every legal date on this page was rechecked on 10 August 2026.

What this guide covers:

• What actually changed, what did not, and what is still only a bill
• Where the EU CSDDD sits after the Omnibus I directive
• What DAX-tier procurement still needs from a DMC vendor
• The 12 specific questions to ask a DMC during LkSG due diligence

Why does LkSG still matter when picking a Baku or Caucasus DMC?

Because the duty that reaches a DMC was never the reporting duty. Germany's supply-chain act still binds companies with 1,000 or more employees in Germany, and their risk analysis, preventive measures, and complaints channel all reach down into tier-1 suppliers. An event-logistics DMC running a German corporate's offsite sits inside that ring.

• The supply-chain reach is global. A German in-scope corporate's LkSG obligations extend to its tier-1 suppliers, and event-logistics DMCs running an offsite, product launch, or incentive program outside Germany sit inside that tier-1 ring. Jones Day's September 2025 client alert on the Cabinet draft was explicit that what was on the table narrowed reporting, not the supplier-side documentation expectation.
• The change is misread regionally. Most Caucasus and Central Asian DMCs we cross-quote with assume the act was repealed in 2025. It was not. The reporting duty stopped being collected; the risk-analysis, prevention, and complaints duties in §§5 to 8 were untouched, and BMAS's own position is that the Act continues to apply without a gap until a successor law transposes the CSDDD. ICLG's 2026 Germany public-procurement overview and BME's procurement guidance treat the supplier-side requirements as unchanged. A DMC that says "LkSG was repealed" is reading headlines, not the statute.
• The vendor-disqualification risk runs downstream. A DMC that cannot evidence its due-diligence chain becomes a vendor-risk flag on the corporate side. That flag travels into the next RFP cycle, the next compliance review, and the next sourcing committee. Procurement teams do not de-flag vendors quietly; they reassign briefs.

What actually changed in the LkSG, and when?

Enforcement changed, not the statute. Following the Federal Cabinet decision of 3 September 2025, BAFA stopped reviewing company reports on 1 October 2025 and closed the submission channel. The amending bill had its Bundestag first reading on 16 January 2026 and, on the BMAS legislative tracker we read on 10 August 2026, is still recorded as not concluded and not in force.

Four points cover the practical effect on DMC sourcing, and the ordering matters because two of them are law and two are administration.

• Threshold: still 1,000 employees in Germany. §1(1) sets 3,000 from 1 January 2023 and 1,000 from 1 January 2024. Agency workers count where deployed for more than six months, and German employees of group companies roll up to the parent. Companies with a German branch under §13d HGB meeting the same headcount are caught too. Do not let anyone tell you the LkSG threshold is now 5,000; that number belongs to a different instrument.
• Reporting duty: still in the text, no longer collected. §10(2) still requires an annual report published free on the company website within four months of financial year end and kept up for seven years. BAFA's own notice says it will not review reports and that submission through BAFA is no longer possible. The draft would remove the duty retroactively and cut the administrative-offence catalogue from 13 items to 4. Until it passes, the duty is legally alive and administratively dead.
• Due-diligence duties: unchanged. Risk analysis (§5), preventive measures (§§6 to 7), remedial action, the complaints procedure (§8), and internal documentation with seven-year retention (§10(1)) all stand. This is the part a DMC is responsible for evidencing.
• Fines: last resort only. BAFA has said it will exercise a very restrictive discretion and pursue fines, in pending and future proceedings alike, only for violations that are grave by scale, reach, or irreversible character, and only where a serious human-rights violation has actually occurred. We had this page saying enforcement was now "more focused, not less", which read the direction wrong. The honest version is that the enforcement risk sitting on a German buyer fell sharply, and their contractual risk appetite toward suppliers did not.

If you are sourcing a Baku DMC in 2026 for a German corporate program, none of this lets you skip vendor due diligence. It changes what the buyer has to publish, not what the buyer has to know.

Does the EU CSDDD omnibus change what you ask a DMC?

Not before 2029, and not for most buyers. The Omnibus I directive narrowed the CSDDD to companies above 5,000 employees and €1.5bn net turnover, with member-state transposition due 26 July 2028 and company application from 26 July 2029. Until then the German act, at its 1,000-employee threshold, is what reaches a DMC.

Two honesty notes on that table. First, the Omnibus I dates and thresholds come from law-firm summaries published between December 2025 and March 2026, not from the Official Journal text, which we could not retrieve; treat them as indicative and have your legal team confirm against EUR-Lex before you write them into a policy. Second, BMAS's own page on the amending act still cites the older stop-the-clock transposition deadline of 26 July 2027, so a German ministry page and the law-firm timetable currently disagree. That is worth knowing before someone in a sourcing committee quotes one at the other.

For a procurement team, the practical read is narrow: the CSDDD is not a 2026 vendor question. Keep asking the LkSG questions.

What does DAX-tier procurement still need from a DMC vendor?

Five documents, all of which feed the buyer's own surviving duties rather than a report nobody files any more. A Code of Conduct acknowledgement, a named sub-supplier risk map, a grievance channel reachable by drivers and kitchen staff, a completed vendor questionnaire, and an annual review cadence with a date on it.

Where we sit on each is noted in parentheses. We have written this conservatively rather than claiming a shrink-wrapped pack.

• Code of Conduct attestation, BME-aligned. A signed Code of Conduct covering the DMC's own operations and its named sub-suppliers. The BME Code is the reference most often named in the DACH RFPs that reach us; across Birtour's own DACH pipeline it is the single most-cited standard in the compliance section of a brief, which is a statement about our inbox rather than about German industry as a whole. (We are BME-aligned; we share the attestation language on signed-NDA RFP basis.)
• Risk-assessment chain for named sub-suppliers. A documented risk map covering the DMC's tier-1 sub-suppliers used on a typical program: anchor hotels, ground-transport providers, F&B and banquet kitchens, AV and production partners. (We maintain the map for our standard 100-pax program shape, the same shape costed on our 100-pax Baku conference pricing page; we share it on request inside a vendor questionnaire.)
• Documented grievance mechanism accessible to downstream workers. A way for hotel housekeeping, transport drivers, banquet kitchen staff, or AV crew to raise a complaint that reaches a named recipient at the DMC. It has to be reachable by people without an email account, which in Baku means a phone number a driver will actually use. (We publish a phone-and-WhatsApp grievance line and document who receives the cases.)
• Vendor due-diligence questionnaire on file. A completed vendor questionnaire the procurement team can store in its supplier-management system. The questionnaire is usually the BME OpenSourcing template or a corporate-specific variant. (We publish our vendor due-diligence questionnaire on request.)
• Annual review cadence. A documented annual cycle for re-assessing the sub-supplier map, the Code of Conduct attestations, and any incidents raised through the grievance line. (Our cycle runs in Q1 each year against the prior calendar year's program book.)

Frame these as what you ask any DMC, not as what Birtour uniquely ships. We have not found another Baku DMC publishing what the Act still requires of a supplier inside a German procurement chain, and that is not the same as being the only one; we would rather say so than claim a first we cannot check.

What questions should you ask a DMC during LkSG due diligence?

Ask these 12, which map to the duties that survive in §§5 to 10 of the Act. They cover the Code of Conduct, the sub-supplier list, the ILO-derived prohibitions in §2(2), the grievance mechanism, the data-processing agreement, incident history, insurance, and subcontracting policy. Numbered for use directly in an RFP or vendor onboarding questionnaire:

1. Do you have a signed Code of Conduct attestation covering your own operations and your named sub-suppliers (anchor hotels, ground transport, F&B, AV)?
2. Can you provide the list of your tier-1 sub-suppliers used on a typical 100-pax program?
3. What is your annual review cadence for sub-supplier compliance, and when did the last review run?
4. Do you operate a documented grievance mechanism accessible to downstream workers without an email account?
5. Who is the named recipient at your company for grievance cases, and what is the escalation path?
6. Can you provide a Data Processing Agreement (Auftragsverarbeitungsvertrag) compatible with GDPR/BDSG for guest passport and dietary data?
7. Have any human-rights or environmental incidents been raised against you or your sub-suppliers in the last 24 months, and how were they resolved?
8. Do you carry liability insurance with named cover for sub-supplier failures and what is the per-incident ceiling?
9. Can you evidence sustainability practices aligned with BME guidance (group transport over individual transfers, low-emission ground fleet on request, single-venue clustering)?
10. What is your written policy on subcontracting outside the named tier-1 list, and what notification do we receive when it happens?
11. Will you complete the BME OpenSourcing vendor questionnaire (or our corporate-specific equivalent) and keep it current for the duration of the contract?
12. Will you confirm in writing, for your own operations and your named sub-suppliers, the positions listed in §2(2) of the Act: no child labour, no forced labour, no unsafe working conditions, no denial of freedom of association, no discrimination, and no withheld wages?

Question 12 is the one that moved. With the report gone, a buyer no longer needs a supplier declaration "for our BAFA report"; what they need is evidence feeding their own §5 risk analysis and §6 preventive measures, and a written position on the §2(2) prohibitions is the cleanest single artefact for that. A DMC that cannot answer at least 9 of these 12 is a vendor risk in any German RFP cycle, and the gaps cluster on the same items every time: 4, 5, and 7. We answer all 12 in our vendor questionnaire, available on request.

What we don't do

Five limits, named here so a procurement reader does not have to ask, and because a compliance page that only lists strengths is not a compliance page. Two of these are about the boundary of our own authority rather than our scope of work, and those are the ones worth reading twice.

• We don't publish our full client-side LkSG documentation pack publicly. The pack is shared on signed-NDA RFP basis only. Public publication weakens its value to the procurement teams who rely on it.
• We don't claim certification we don't hold. Birtour is BME-aligned but not currently BME-certified. The distinction matters in procurement scoring and we have seen vendors disqualified for overclaiming on this exact point.
• We don't quote LkSG-readiness as a pricing premium. The documentation is included in standard contracted scope; we do not break it out as a line item.
• We don't speak for the legislator, and we don't issue legal opinions. What appears here is our reading of the consolidated statute at gesetze-im-internet.de, BAFA's own notice of 1 October 2025, and the BMAS legislative tracker, all reread on 10 August 2026, plus Jones Day's September 2025 client alert on the Cabinet draft and ICLG's 2026 Germany public-procurement chapter. We have not read the Official Journal text of the Omnibus I directive, so its dates here are indicative and sourced to law-firm summaries. Any team making a material decision should take its own legal advice on all of it.
• We don't guess at what the Bundestag will do next. The amending act may pass in this session, a later one, or not at all. We will restate this page against the statute rather than against the forecast.

For DACH procurement teams running RFPs that include vendor LkSG due diligence, see our DACH auto VIP launch case study and the EU SaaS product summit for the documentation chain in practice, the DMC selection criteria guide for the wider scoring matrix, and reach out through the Azerbaijan DMC page for our vendor questionnaire.