Your large customers can ask for ESG data — but not unlimited data.
An EU directive already stops a CSRD-reporting buyer from requiring more sustainability information than the voluntary standard from a supplier of 1,000 employees or fewer. The standard that defines exactly how much is adopted but not yet in force. Here is what already applies, what's still pending, and what to say when a questionnaire goes further.
Based on Directive (EU) 2026/470 (in force) and the Commission's 3 July 2026 delegated act on the voluntary reporting standard (adopted, not yet in force). This page is a summary for SMEs, not legal advice.
Since 18 March 2026, a directive in force bars a CSRD-reporting buyer from requiring more sustainability information than a voluntary standard from a value-chain supplier of 1,000 employees or fewer.
The standard that fixes exactly what that ceiling covers was adopted by the Commission on 3 July 2026 but is still before the European Parliament and Council for scrutiny — it is not yet in force.
The cap only limits what a CSRD-driven request can require. A buyer can still ask for more, you can still choose to answer, and commercial or contractual requests are untouched.
It protects suppliers with 1,000 employees or fewer, and only inside an EU CSRD buyer's chain — it has no effect on a request from outside that chain.
EcoDiligence stays inside the voluntary standard's scope by default, so a Free-tier ESG Passport already answers what a CSRD-reporting buyer should be asking for.
What's actually in force, and what isn't yet
The Corporate Sustainability Reporting Directive (CSRD) requires large European companies to disclose sustainability information about their own operations and about their value chain. Naturally, they turn to their suppliers for the data — and without a limit, that demand tends to cascade down to companies far smaller than the CSRD itself was ever meant to reach. The value-chain cap is the EU's answer to that cascade, and it has two separate pieces with two separate legal statuses.
The mechanism is in force. The Omnibus I directive — Directive (EU) 2026/470 — was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026 (Member States have 12 months from publication to transpose it into national law). It establishes the cap itself: a company in CSRD scope may not require a value-chain company of 1,000 employees or fewer to provide sustainability information beyond the voluntary reporting standard.
The standard that defines the ceiling is adopted, but not yet in force. On 3 July 2026 the European Commission adopted the delegated act setting out that voluntary reporting standard, alongside the revised European Sustainability Reporting Standards (Commission Delegated Act C(2026) 5011 final). Both are now before the European Parliament and the Council for scrutiny — two months, extendable by two more — and only enter into force if neither objects and the act is published in the Official Journal. As of this page's last review, that publication had not happened. Once in force, the standard applies to financial years beginning on or after 1 January 2027, with early adoption for FY2026 allowed from the moment it takes effect.
In practice: the right not to be required to answer beyond a voluntary standard already exists for a 1,000-employees-or-fewer supplier in an EU CSRD reporter's chain. The precise list of what that voluntary standard covers — the exact disclosures that set the ceiling — is not finalised yet. New to the standard itself? See our complete VSME guide.
Four limits worth keeping in mind
It binds CSRD-driven requirements only. A buyer can still ask you for more, and you can still choose to answer — the cap stops a requirement, not a request.
It stops at the EU CSRD chain. Outside that chain — a non-EU buyer, or an EU buyer not itself in CSRD scope — nothing here applies, and global supply chains routinely ask for far more.
It protects suppliers of 1,000 employees or fewer. Above that headcount, the cap does not apply to you.
Commercial and contractual requests are unaffected. A buyer's procurement terms, code of conduct, or contract can still call for information the sustainability-reporting cap does not reach.
Some disclosures inside the future VSME framework are expected to be optional even at the Essential level — for example, several disclosures do not apply to micro-entities (typically ten employees or fewer). The Comprehensive Module is entirely optional and sits above the cap; nobody can require it from you.
What buyers actually ask, beyond the standard
The cap is real, but so is the gap between it and what a questionnaire in your inbox looks like. Across the supplier ESG questionnaires we have processed on EcoDiligence, length has ranged from about 42 to 101 questions — well beyond what any voluntary standard's Basic scope covers. This is our own observation from the requests we have seen, not a published study, and it will not match every buyer. The categories that most often account for the gap are human rights and labour, management practices, and evidence and document requests (policy documents, certificates, and similar attachments) — none of which the cap's mechanism, or the standard it points to, requires an eligible supplier to produce.
What's inside the scope, and what's outside
A simplified view of the areas the current draft VSME Basic Module covers versus items that fall outside its scope and are therefore optional for an SME to provide. This reflects the draft standard pending Parliament/Council scrutiny, not a finalised text — check the VSME guide for the current status before relying on specifics.
Topic
Essential (Basic Module)
Outside VSME scope (optional to provide)
Company profile
Basic identifiers, sector, size, location
Full corporate structure, beneficial ownership, sensitive ownership disclosures
Energy & Scope 1/2 emissions
Total energy, renewable share, Scope 1 & 2 GHG emissions
Full Scope 3 inventory with granular category-by-category breakdown
Waste & pollution
Total waste generated, hazardous vs non-hazardous split
Individual salary bands, disciplinary records, personal identifiers
Governance & ethics
Presence of code of ethics, anti-corruption and anti-harassment policies
Full board minutes, internal audit reports, litigation registers
Value chain
Description of principal customers, suppliers, and business model
Full supplier list with commercial terms and contract copies
Targets & strategy
Voluntary — you may share reduction targets if you have set them
Full transition-plan narrative, scenario analysis, capex allocation (Comprehensive-only)
Simplified view for SME orientation. The authoritative wording lives in the EFRAG VSME standard (Basic and Comprehensive modules) and the European Sustainability Reporting Standards (ESRS). Framework text prevails wherever this summary is ambiguous.
What to say to a demanding customer
Three short replies you can adapt. The tone is deliberately calm and cooperative — the goal is to redirect the conversation to a standard-aligned Passport, not to escalate.
1. Share what's inside the VSME scope
Use when: Your buyer sent a long questionnaire. Start here — offer the standard-aligned data first, before discussing anything beyond it.
Hello,
Thank you for the ESG data request. We have prepared our disclosures using the EFRAG Voluntary SME Standard (VSME) — the standard EFRAG has developed for SME reporting to value-chain partners.
You can access our ESG Passport here:
[insert your EcoDiligence public profile link]
The Passport covers energy, Scope 1 and Scope 2 emissions, workforce data, and governance policies — the areas the VSME Basic Module addresses. If you need the data in a machine-readable format (Excel / XBRL), we can send that as well.
Please let us know if this covers what you need.
Best regards,
[Your name]
2. Politely decline items outside the standard scope
Use when: The buyer follows up asking for items that clearly fall outside the VSME Basic Module — full Scope 3, detailed pollutant registers, supplier lists, etc.
Hello,
Thank you for the follow-up. We have reviewed the additional items and a number of them fall outside the scope of the EFRAG VSME standard that structures our disclosures.
Under the current EFRAG framework, the VSME Essential (Basic Module) sets out what is expected of SME suppliers in the value chain of larger reporters. We would prefer to keep our disclosure within that scope so it stays comparable and audit-ready across all our customers.
If any of these items are essential for your reporting, we are happy to discuss them individually — please let us know which are must-haves for your compliance work, and we will see what we can prepare.
Best regards,
[Your name]
3. Ask the buyer to confirm the VSME scope
Use when: The questionnaire looks like a generic large-enterprise template. Redirect the conversation by asking the buyer to confirm the framework limit that applies to them.
Hello,
Before we work through the questionnaire, could you help us align on scope?
Our ESG disclosures follow the EFRAG Voluntary SME Standard (VSME), which is the framework designed for SME suppliers reporting into the value chain of larger CSRD reporters. Under the current EFRAG framework, requests to SME suppliers are expected to remain within the VSME Essential (Basic Module) scope.
Could you confirm that the questionnaire is aligned with this scope, or let us know which items are outside it and why they are needed? This will help us reply with the right level of detail without over- or under-reporting.
Best regards,
[Your name]
How EcoDiligence keeps you inside the scope
Essential-by-default
The standard wizard collects only VSME Basic Module data points. Anything deeper lives in a separate, opt-in Advanced Disclosures layer.
Shareable Passport + PDF
A permanent public URL and a branded PDF you can send to any buyer. Both carry the same standards-aligned data and self-report attestation.
Advanced disclosures on your terms
If you choose to share more, the Pro plan adds optional VSME Comprehensive and IFRS S2 transition topics — always your choice, never compelled.
Machine-readable exports
Buyers who need structure receive the VSME Digital Template (Excel) or an XBRL feed — from the same source of truth as your Passport.
Create your free Passport — most SMEs finish in under ten minutes and can share the link the same day.
Frequently asked questions
Both, in different parts. The mechanism is already law: Directive (EU) 2026/470 (Omnibus I), in force since 18 March 2026, bars a CSRD-reporting buyer from requiring more sustainability information than a voluntary standard from a value-chain supplier of 1,000 employees or fewer. The standard that defines exactly what that voluntary scope covers was adopted by the European Commission on 3 July 2026 but is still before the European Parliament and Council for scrutiny, and had not been published in the Official Journal as of this page's last review. So the right not to be over-required already exists; the precise list of what you can be required to answer is not finalised yet.
Indirectly, yes. The cap operates on the buyer's side: EU-based CSRD reporters (and non-EU groups above the CSRD third-country thresholds) are the ones told not to over-request from SME suppliers. If your European customer is a CSRD reporter, the same guidance shapes what they should ask you for — regardless of where you are located. The VSME disclosures are structured to be jurisdiction-neutral, so a non-EU supplier can reply with a VSME-aligned Passport just as easily as an EU one.
The framework limits what buyers should request, but it does not force them to source from any particular supplier. Commercial pressure is real, and a large buyer can choose their suppliers freely. The practical response is usually not confrontation but redirection: offer the VSME-aligned data first (which covers most legitimate procurement questions), explain that additional items are outside the standard voluntary scope, and offer to discuss specific items case-by-case if there is a genuine reason. Buyers who understand the framework will typically accept a well-structured Passport as their starting point.
Absolutely. The cap defines what a buyer can require, not what you can choose to share. Many SMEs go beyond VSME Essential to differentiate themselves — for example, by adding a transition-plan narrative, a certification, or supplementary metrics. EcoDiligence's optional Advanced Disclosures (Pro) exist for exactly this: a structured way to share additional depth without leaving the framework.
The standard wizard collects only data points that map to VSME Basic Module topics — general information, energy and emissions, workforce, and core governance. Anything beyond that lives in a separate, opt-in Advanced Disclosures layer on the Pro plan. So a Free-tier ESG Passport, by construction, contains disclosures aligned with what buyers are entitled to request from an SME supplier under the current framework.
The primary source is EFRAG (efrag.org), which publishes the VSME standard, its implementation guidance, and the Digital Template. For the underlying reporting obligation on large buyers, see the Corporate Sustainability Reporting Directive (CSRD, EU 2022/2464) and the European Sustainability Reporting Standards (ESRS) on the European Commission's site. This page summarises for SMEs; always defer to the original texts for definitive wording.
This page summarises Directive (EU) 2026/470 and the Commission's 3 July 2026 delegated act on the voluntary reporting standard (C(2026) 5011 final) for orientation only. It is not legal advice, and nothing here substitutes for the texts themselves — the standard's exact scope is still pending and may change before it enters into force. Always check the official texts at finance.ec.europa.eu and eur-lex.europa.eu for the current status. EcoDiligence ESG Passports are self-reported summaries structured for ESG disclosure workflows. Content is not independently assured. Information aligned with EFRAG VSME and IFRS S2 (ISSB) frameworks does not constitute formal compliance or certification.
Ready to answer buyer requests the smart way?
Generate a shareable ESG Passport aligned with the VSME Essential scope — free, no consultant, ~10 minutes.