Supply chain act software: CSDDD and LkSG software for procurement
What software for the CSDDD and the German Supply Chain Act (LkSG) has to do, which tasks Ovenca handles in procurement and where you need a second tool.
Ovenca is eProcurement software with a supplier portal, catalog management, approvals and an audit trail. It covers the part of supply chain due diligence that happens in operational procurement: connecting suppliers, collecting self-disclosures and evidence, steering orders to approved suppliers and logging decisions so they can be traced.
- Supplier portal
- Audit trail
- ERP and SAP integration
- On-premise or private cloud (EU)
What is supply chain act software?
Supply chain act software, often called CSDDD software or LkSG software, helps companies meet human rights and environmental due diligence duties towards their suppliers in an organised way: registering suppliers, collecting disclosures and evidence, assessing risks, tracking measures and documenting all of it so that it stands up to an audit.
Two kinds of tools are on the market. Specialised compliance platforms come with risk databases, country and sector indices, whistleblowing channels and report templates. Procurement systems start where the supplier relationship actually takes place: onboarding, catalog, purchase order and approval. Ovenca belongs to the second group.
The useful selection question is therefore not which product has the longest feature list, but which duty is fulfilled in which system and how data moves between procurement, compliance and the ERP.
Legal status at a glance (October 2026)
- LkSG
- Germany's Supply Chain Due Diligence Act has applied since 2023. Under section 1 it has covered companies that normally have at least 1,000 employees in Germany since 1 January 2024.
- Due diligence duties
- Section 3 lists, among others, risk management, risk analysis, a policy statement, preventive and remedial measures, a complaints procedure and documentation.
- Reporting
- The government bill amending the LkSG would remove the reporting duty. BAFA, the supervising authority, has not reviewed company reports since 2025. The internal documentation duty is not affected.
- CSDDD
- The EU directive must be transposed into national law by 26 July 2028 and applied from 26 July 2029. It applies to companies from a threshold of 5,000 employees and EUR 1.5 billion net worldwide turnover.
- Outlook
- The German government has announced that it will replace the LkSG with an act transposing the CSDDD. Thresholds and individual duties may change before then.
This overview is not legal advice. The authoritative status is the one published in the German Federal Law Gazette and the Official Journal of the EU. Current information on the LkSG is published by the Federal Office for Economic Affairs and Export Control (BAFA).
What CSDDD and LkSG software has to do, and what Ovenca covers
The tasks follow the due diligence duties that the LkSG and the CSDDD set out in similar form. The right-hand column states whether Ovenca handles the task, contributes part of it or does not cover it.
| Task | What the software has to do | Coverage in Ovenca |
|---|---|---|
| Supplier onboarding and self-disclosure | Register suppliers in a structured way, collect questionnaires and self-disclosures, file certificates and the code of conduct as evidence, review and approve the answers. | Covered, with a limitationIn the Vendor Portal, suppliers go through onboarding with questionnaires, self-disclosures and certificates; procurement reviews and approves. Access is granted by procurement. Open self-registration is not part of the standard. |
| Risk analysis | Assess suppliers by country, sector and commodity group, weight and prioritise risks, update the results annually and when circumstances change. | Not coveredOvenca has no risk scoring with country or sector indices. The platform supplies the procurement data to build on: suppliers, catalogs, commodity groups and order statistics as an export. For the assessment itself you use a specialised tool or our template. |
| Preventive measures | Steer purchasing practices, anchor expectations towards suppliers in contracts, plan and follow up training and controls. | PartlyRequesters order from approved catalogs; catalog access can be restricted by company, plant and user, and multi-level approvals apply by role and value. Contract clauses, training and supplier audits are managed outside Ovenca. |
| Remedial measures | When a violation is identified, set up action plans with deadlines, track implementation and document escalation up to suspending the business relationship. | Not coveredAction tracking with deadlines and effectiveness checks is not part of Ovenca. Operationally, a supplier's catalogs and items can be blocked so that nothing more is ordered. |
| Complaints procedure | Provide a reporting channel for internal and external whistleblowers, protect confidentiality, publish rules of procedure, handle cases. | Not coveredOvenca is not a whistleblowing system. You need a separate solution, which many companies already operate under whistleblower protection rules. |
| Documentation and audit trail | Record every decision with user, time and content, keep records available for the retention period, export them for auditors and authorities. | Covered for procurement processesOvenca logs logins, catalog changes with old and new value, orders, approvals and administrative actions with user and timestamp. Logs are searchable and can be exported as CSV or JSON. The retention period is configurable. |
| Reporting | Prepare figures and measures for management, customers and, where required, for published statements. | PartlyOvenca provides reports on orders, usage and catalogs as well as exports for Excel and external BI tools. The platform does not generate finished LkSG or CSDDD reports. |
Not part of Ovenca
Risk scoring with country and sector data, a whistleblowing system, action tracking, media and sanctions-list screening, and report generation. If you want all of this in a single system, a specialised compliance platform is the better fit. Ovenca complements it with the procurement processes and supplies the data.
Who needs supply chain act software
The duties reach two groups in different ways: companies that fall under the law themselves, and their suppliers.
Companies in scope
Companies within the scope of the LkSG have to meet their due diligence duties in their own business area and towards direct suppliers. For indirect suppliers they have to act once there are actual indications of a violation.
- Many suppliers whose disclosures and evidence have to be kept current
- Risk analysis once a year and when circumstances change
- Documentation that has to be retained for seven years
- Coordination between procurement, compliance, legal and internal audit
Suppliers of companies in scope
Companies below the thresholds are affected as well: their customers ask for self-disclosures, a code of conduct and evidence, often in their own portals and formats. The CSDDD limits information requests to smaller business partners but does not remove them.
- Questionnaires from several customers with similar content
- Evidence about their own upstream suppliers
- Deadlines and recurring updates
- Supplier selection also depends on reliable answers
However the thresholds change, structured supplier data, current evidence and traceable decisions remain the basis. They are needed for customer requirements and audits just as much as for the law.
What Ovenca contributes to supply chain due diligence in procurement
Four building blocks that procurement uses every day anyway. They do not replace compliance management, but they make sure its rules arrive in the ordering process.
Supplier portal
Suppliers receive protected access and maintain their own data. Procurement reviews, comments and approves.
- Onboarding with questionnaires, self-disclosures and certificates
- Upload of documents such as data sheets and safety documents
- Status and queries in the portal instead of by email
- Changes versioned, with timestamp
Catalog and guided demand
Orders are placed from catalogs that procurement has approved. Demand therefore goes to suppliers that have been through onboarding.
- Catalog access controlled by company, plant and user
- Catalogs and items can be blocked
- Validation of catalog data on upload
- Fewer orders that bypass procurement
Approvals with roles and value limits
Multi-level approvals follow role, organisational unit and amount. Rejections and comments stay with the transaction.
- Role-based, multi-level approval
- Comments and reasons in the history
- Reminders by email
- Approval paths that depend on the individual supplier cannot be configured in the standard
Audit trail and reports
Who changed or approved what, and when: the log answers that question without evidence having to be gathered after the fact.
- Log with user, action and timestamp
- Export as CSV or JSON
- Report access controlled by role
- Order and usage statistics, exportable for Excel
Duties, risk analysis and documentation in detail
Three subpages from the procurement perspective: what the law requires, how a risk analysis is structured and what makes documentation hold up.
LkSG duties in procurement
The due diligence duties under section 3 LkSG, which of them arise in procurement and which system carries which duty.
LkSG risk analysis
Abstract and concrete risk analysis, prioritisation and a template as a starting point for procurement.
Documentation and audit trail
What has to be documented continuously, how long it has to be kept and what Ovenca logs in procurement.
Template for the LkSG risk analysis in procurement
The template walks through abstract and concrete risk analysis, a scoring matrix for country, sector and commodity group, and the derivation of measures. It is a working aid for getting started and does not replace legal advice. The template is in German and dated October 2026. Because the legal framework is changing, check its legal references against the current state of the law before use.
- Pages
- 7
- Size
- PDF, 235 KB
Choosing CSDDD and LkSG software: checklist for procurement, compliance and IT
These questions make offers comparable, whether you are evaluating a compliance platform, a procurement system or both.
Coverage of duties
- Which due diligence duties does the system support itself, and which only through interfaces?
- Is a complaints procedure included, or does it have to be run separately?
- Can measures be tracked with deadlines and effectiveness checks?
- How are indirect suppliers recorded when indications arise?
Supplier connection
- How much effort do registration and questionnaires cause for suppliers?
- Can suppliers update evidence themselves?
- Are suppliers charged fees?
- In which languages is the portal available?
Risk analysis and data sources
- Which country and sector indices are included, and how current are they?
- Is the scoring logic visible and adaptable to your own method?
- Can an event-driven analysis be triggered and documented?
- Are purchasing volumes and commodity groups taken from the ERP?
Documentation and audit trail
- Is every change logged with user and timestamp?
- Can the retention period be set to at least seven years?
- Can logs be exported without involving the vendor?
- Can internal audit have read access without operational rights?
Integration with ERP and procurement
- Which system is the master for supplier data?
- Does a block or rating take effect in the ordering process, or does it remain information in the compliance tool?
- Are SAP ECC and S/4HANA connected through standard routes?
- How are one-time vendors handled that have no master record of their own in the ERP?
Operation and vendor
- Where are data and backups stored, and is on-premise or private cloud possible?
- How does the vendor respond to changes in the law, for example to thresholds and reporting duties?
- Does the licence model depend on the number of suppliers?
- Is there a reference of comparable size and system landscape?
How supply chain act software works with ERP and SAP
Due diligence processes only have an effect when their result reaches the ordering process. A rating that exists only in the compliance tool does not stop a purchase order. Which system holds the supplier master and where blocks take effect therefore belongs at the start of the selection.
In most landscapes the ERP remains the master for suppliers, purchase orders and invoices. Ovenca is built as an upstream platform: requesters order from approved catalogs, and the approved requisition is passed to the ERP. The connection runs via OCI, cXML or the API, in SAP landscapes and elsewhere alike. A compliance tool can obtain order and log data through exports or the API.
| Interface | Use | Direction |
|---|---|---|
| OCI punchout | Catalog is called from the ERP, the shopping cart is returned as a purchase requisition | ERP → Ovenca → ERP |
| API | Transfer of contracts and material numbers from the ERP, handover of approved requisitions and purchase orders, connection of third-party systems, export of order and log data | Both directions |
| CSV, Excel, BMEcat | Import and update of supplier catalogs with validation | Supplier → Ovenca |
Questions and answers on supply chain act software
Supply chain act software, also called CSDDD software or LkSG software, supports companies with due diligence in the supply chain: registering suppliers, collecting self-disclosures and evidence, assessing risks, tracking measures, handling complaints and documenting everything. Some products cover all of these tasks; others, like Ovenca, cover the part that arises in procurement.
Yes. According to the text of the act, the LkSG covers companies that normally have at least 1,000 employees in Germany. The government has introduced a bill that removes the reporting duty and limits fines to serious violations; the due diligence duties are to remain. BAFA has not reviewed company reports since 2025. Because the law is changing, check the current status with BAFA. This answer is not legal advice.
The LkSG is the German act; the CSDDD is the EU Corporate Sustainability Due Diligence Directive. The CSDDD was amended in 2026 by the Omnibus Directive (EU) 2026/470: it must be transposed by 26 July 2028, applies from 26 July 2029 and covers companies from a threshold of 5,000 employees and EUR 1.5 billion net worldwide turnover. The German government intends to replace the LkSG with an act that transposes the directive.
Often yes, on a smaller scale. Suppliers of companies in scope receive questionnaires, have to accept a code of conduct and provide evidence. If you keep your own supplier data and evidence in order, you can answer such requests faster and consistently. That does not always require a full compliance system.
No. Ovenca covers the processes in procurement: supplier onboarding with self-disclosures and evidence, ordering from approved catalogs, approvals and the audit trail. Risk scoring with country and sector data, the complaints procedure, action tracking and reports are not part of the product. For those, Ovenca is combined with a compliance tool or, where the number of suppliers is manageable, with a maintained risk analysis based on our template.
A supplier master with self-disclosure and evidence, a traceable risk analysis, tracking of preventive and remedial measures, a channel for complaints, complete documentation with retention for seven years, and exports for auditors and customers. In addition, a connection to the ERP so that ratings take effect in the ordering process.
That depends on the product. Ovenca is connected to SAP ECC and S/4HANA via OCI, cXML or API; the supplier master stays in the ERP. Requesters order from catalogs that procurement has approved, and the requisition is passed to SAP. Order and log data are available to compliance tools through exports and the API.
In SAP, CpD accounts (one-time vendor accounts) bundle suppliers that have no master record of their own. For supply chain due diligence this is a blind spot, because spend, commodity group and evidence cannot be assigned to an individual supplier. It makes sense to steer recurring demand to catalog suppliers that have been onboarded and to limit one-time vendor orders to genuine exceptions. Catalogs and approvals in Ovenca support this; the rules for the one-time accounts themselves are set in the ERP.
Ovenca can be operated on-premise in your own data centre or as a private cloud in EU data centres. Access is controlled through roles and permissions, single sign-on (SAML 2.0, OIDC) and multi-factor authentication (TOTP), and transport is TLS-encrypted. A data processing agreement under the GDPR is provided.
LANXESS AG has worked with Onveda since 2014 and uses Ovenca worldwide as its eProcurement platform, with SAP integration. Modules in use include catalog management, supplier management, approval processes and reporting. The case study describes procurement as a whole, not a supply chain act project.
The building blocks in detail
Product pages and background on the functions mentioned on this page.
Vendor Portal
Suppliers maintain catalogs and documents themselves, with approval by procurement.
Catalog Management
Import, validate and approve supplier catalogs.
Source to Pay
The procurement process from supplier selection to payment, with system boundaries.
Admin Area
Manage roles, approval paths and the audit trail centrally.
S/4HANA Procurement
Running Ovenca alongside SAP ECC and S/4HANA.
LANXESS case study
eProcurement in worldwide corporate use, working together since 2014.
Related pages
Anchor supply chain due diligence in procurement
In a technical discussion we clarify which tasks Ovenca takes on in your landscape, where a compliance tool is needed and how both work with the ERP.