Supplier code of conduct

A supplier code of conduct translates a company's human rights policy statement into concrete requirements for the procurement side of the business. It names the expected standards – usually derived from the ILO core labour conventions, the UN Guiding Principles on Business and Human Rights, the OECD Guidelines for Multinational Enterprises and the relevant environmental conventions – and defines how compliance is evidenced, verified and sanctioned. Typical chapters cover the prohibition of child and forced labour, freedom of association, fair wages and working hours, occupational health and safety, non-discrimination, anti-corruption, and environmental duties such as the handling of mercury, persistent organic pollutants and hazardous waste.

Under German law the code sits within the preventive measures a company owes towards its direct suppliers. Section 6 (4) of the Supply Chain Due Diligence Act (LkSG) requires companies to factor human rights and environmental expectations into supplier selection, to obtain a contractual assurance that the supplier will comply with those expectations and pass them along its own supply chain, to provide training, and to agree appropriate contractual control mechanisms and actually apply them. A code on its own is therefore not enough: it must be incorporated into the contract, backed by information, audit and remediation rights, and verified on a risk basis. At EU level the CSDDD (Directive (EU) 2024/1760) foresees a comparable mechanism of contractual assurances supported by model clauses – but its timeline and parts of its substance have been deferred by the so-called stop-the-clock directive and remain under revision in the ongoing Omnibus process, so the final scope should not yet be treated as settled.

In practice, effectiveness depends on how tightly the code is wired into purchasing. It is attached to framework agreements and general purchasing terms, requested during supplier onboarding, and combined with an obligation to cascade the requirements to sub-suppliers. A graduated response logic matters: where a breach is identified, corrective action plans with deadlines come first, and commercial consequences up to termination only afterwards – under the LkSG scheme, walking away from a business relationship is a last resort. Equally weak is paper compliance: collecting signed codes without risk analysis, training and verification does not meet the appropriateness standard. For reporting purposes, the code also supplies evidence for the ESRS disclosures on workers in the value chain (ESRS S2) and on supplier relationship management (ESRS G1).