Meeting Lieferkettengesetz (LkSG) supplier due-diligence requirements as a mid-sized German manufacturer

We are a ~400-person German industrial-goods manufacturer with roughly 600 tier-1 suppliers across 22 countries. Since 1 January 2024 the Lieferkettengesetz (LkSG) has applied to our customers with ≥1,000 employees, and large OEMs have been cascading its human-rights and environmental due-diligence requirements down to us contractually. BAFA audit activity has visibly intensified in 2026 and fines can reach up to 2% of global turnover, so this is no longer theoretical. What we have to produce, at minimum: - a documented risk analysis across all tier-1 suppliers (human rights, forced labour, child labour, discrimination, occupational safety, freedom of association, wages, environmental protection, water & air pollution) - a working grievance mechanism accessible to workers along the supply chain, in their languages - preventive and corrective measures when we identify elevated risk, with documentation - an annual BAFA report in the official structured questionnaire format Where we are stuck: 1. Fragmented supplier data. Master data sits in SAP, certifications live as PDFs in SharePoint, audit findings are tracked in Excel workbooks owned by different procurement managers. Nothing is unified, nothing is versioned, and coverage is uneven — some high-spend suppliers have no current human-rights self-assessment on file at all. 2. Manual risk analysis. Our sustainability lead and one procurement analyst spend roughly 4–6 weeks per year walking through suppliers manually and producing a colour-coded spreadsheet. It does not scale, it is not reproducible, and the methodology would be difficult to defend to a BAFA auditor. 3. No grievance channel. We have a whistleblower tool for our own employees (from the HinSchG rollout), but nothing that a worker at a tier-2 supplier in Vietnam or Morocco can reach in their own language, anonymously. 4. No early-warning signal. When a supplier is named in NGO reports or local press for strikes, accidents, or pollution incidents, we typically learn months later from a customer questionnaire rather than in real time. 5. BAFA reporting format. The official questionnaire is structured and auditable; exporting an equivalent export from our current setup would mean reformatting data by hand every year. We have an internal budget for a 2026 pilot and cross-functional sponsorship from Procurement, Legal/Compliance, and Sustainability. We are explicitly open to startup solutions — we would rather co-develop with a focused vendor than wait for our ERP's roadmap. We are sharing this template publicly (but with the org name withheld) to help peer Mittelstand firms facing the same cascade, and to invite startups with relevant approaches to reach out. (Although this is a fictional dummy case, it is based on real, public cases)