The fulfilment of the due diligence obligations under the Act must be documented on an ongoing basis within the company, and the documents must be retained for at least seven years from the date on which they are drawn up (Section 10(1)). The Directive requires documentation to be kept for at least 5 years (Article 5(4)) and the annual statement to be published no later than 12 months after the balance sheet date (Article 16(1)(b)); companies reporting under the CSRD are exempt from that statement (Article 16(2)).
The company must prepare an annual report on the fulfilment of its due diligence obligations in the past financial year and must make this report publicly available free of charge on the company’s website for seven years, no later than four months after the end of the financial year.
The report must, as a minimum, set out in a comprehensible manner:
- whether the company has identified any human rights or environmental risks, or any breach of a human rights or environmental obligation, and if so, which ones;
- what the company has undertaken in order to fulfil its due diligence obligations, the elements of the policy statement, and the measures the company has taken as a result of the complaint procedure;
- how the company assesses the impact and effectiveness of the measures;
- the conclusions drawn from the assessment made for measures that may be taken in the future.
The report must be published on the company’s own website no later than four months after the end of the financial year to which it relates (Section 10(2)). The duty to file the report electronically with BAFA (Section 12) remains on the statute book, but by its notice of 7 November 2025 BAFA ceased all review under Sections 12 and 13 and closed the submission portal, so filing is no longer possible in practice.
The competent authority checks whether a report exists with the content and in the form prescribed by the Act, and whether the requirements have been complied with. If it is established that the report has not been drawn up in accordance with the Act, the competent authority may request the company to rectify the report within a reasonable period. That review is not in fact being carried out: BAFA stopped its supervision under Sections 12 and 13 by its notice of 7 November 2025; the duty itself formally stands.
Practical guidance on documentation and reporting
Documentation should be organised so that, for every due diligence step, the company can show what was examined, what was found, and what was decided. In practice this means a central filing structure covering the risk analyses, the policy statement, preventive and remedial measures, complaints received, and training records — kept for the statutory seven-year period and protected against subsequent alteration.
For the annual report, responsibilities and the timetable should be fixed well before the four-month deadline: who collects the data, who drafts, who approves. The report should follow the statutory minimum content — identified risks and violations, the measures taken including those triggered by the complaint procedure, the company’s assessment of their effectiveness, and the conclusions drawn for the future — in language a supervisory authority can verify. Companies that coordinate this exercise with their other sustainability disclosures can run both workstreams under one LkSG/CSDDD compliance programme.
