Your large customers can ask for ESG data — but not unlimited data.
For its own CSRD reporting, from financial years beginning 1 January 2027, EU law stops a CSRD-reporting buyer from requiring more sustainability information than a defined list from a supplier of 1,000 employees or fewer — and as of 24 September 2026, the standard fixing that exact list is in force too. It isn't simply the VSME Basic Module. Here is what the list actually covers and what to say when a questionnaire goes further.
Based on Directive (EU) 2026/470 (in force since 18 March 2026) and Commission Delegated Regulation (EU) 2026/1560 (in force since 24 September 2026). This page is a summary for SMEs, not legal advice.
A directive in force since 18 March 2026 bars a CSRD-reporting buyer from requiring, for its own CSRD reporting, more sustainability information than a defined list from a value-chain supplier of 1,000 employees or fewer — but as a directive, it binds EU Member States, which must transpose the relevant provisions by 19 March 2027, so whether a particular buyer is already bound can depend on their Member State's own implementing law.
The standard fixing that exact list — Commission Delegated Regulation (EU) 2026/1560 — has been in force since 24 September 2026. The cap applies to financial years beginning on or after 1 January 2027; SMEs can use the Voluntary Standard now.
That list (Annex II) is not the same as the VSME Basic Module. For suppliers above 10 employees it also reaches yes/no confirmations that a code of conduct or human-rights policy and a workforce grievance channel exist, plus employee turnover and confirmed human-rights incidents.
The cap only limits what a CSRD-driven request can require. A buyer can still ask for more, you can still choose to answer, and commercial or contractual requests are untouched.
It protects suppliers with 1,000 employees or fewer, and only inside an EU CSRD buyer's chain — it has no effect on a request from outside that chain.
EcoDiligence's Free Passport covers the baseline most first requests need. Pro's Comprehensive layer reaches two items further out on that list — a code-of-conduct disclosure and a grievance-mechanism confirmation. Other items on the list, such as employee turnover, are not collected completely in the VSME flow at either tier; see below.
What's in force, and what the cap actually covers
The Corporate Sustainability Reporting Directive (CSRD) requires large European companies to disclose sustainability information about their own operations and about their value chain. Naturally, they turn to their suppliers for the data — and without a limit, that demand tends to cascade down to companies far smaller than the CSRD itself was ever meant to reach. The value-chain cap is the EU's answer to that cascade, and it has two separate pieces that are now both in force, on different dates.
The mechanism is in force. The Omnibus I directive — Directive (EU) 2026/470 — was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026 (Member States must transpose the relevant provisions into national law by 19 March 2027). It establishes the cap itself: a company in CSRD scope may not require, for its own CSRD reporting, a value-chain company of 1,000 employees or fewer to provide sustainability information beyond the voluntary reporting standard.
The standard that defines the ceiling is now in force too. On 3 July 2026 the European Commission adopted the delegated act setting out that voluntary reporting standard, alongside the revised European Sustainability Reporting Standards. Both went before the European Parliament and Council for a scrutiny period and have since cleared it: the voluntary standard was published as Commission Delegated Regulation (EU) 2026/1560 in the Official Journal on 21 September 2026 and entered into force on 24 September 2026. That settles the cap's exact scope. The cap applies to financial years beginning on or after 1 January 2027; SMEs can use the Voluntary Standard now.
And the cap is not the VSME Basic Module. It's worth being precise here, because this page previously simplified the two together. Regulation 2026/1560's Annex II sets out its own datapoint list, split by supplier size: a short list for suppliers of 10 employees or fewer — general undertaking information and six workforce datapoints, with no environmental datapoints at all — and a fuller list for suppliers of 11 to 1,000 employees. For that larger group, the list draws mostly from the Basic Module but also reaches items usually associated with the Comprehensive Module: products, services, markets and main business relationships (C1), employee turnover (C5), yes/no confirmations that a code of conduct or human-rights policy and a workforce complaints-handling (grievance) mechanism exist (C6), and confirmed human-rights incidents in your own workforce and awareness of confirmed incidents in the value chain (C7). New to the standard itself? See our complete VSME guide.
Four limits worth keeping in mind
It binds requirements for the buyer's own CSRD reporting only. A buyer can still ask you for more, and you can still choose to answer — the cap stops a requirement, not a request.
It stops at the EU CSRD chain. Outside that chain — a non-EU buyer, or an EU buyer not itself in CSRD scope — nothing here applies, and global supply chains routinely ask for far more.
It protects suppliers of 1,000 employees or fewer. Above that headcount, the cap does not apply to you.
Commercial and contractual requests are unaffected. A buyer's procurement terms, code of conduct, or contract can still call for information the sustainability-reporting cap does not reach — a tender or supplier-onboarding requirement is not, by itself, a CSRD-reporting request.
The Comprehensive Module beyond what Annex II reaches sits above the cap — a CSRD reporter cannot make an in-scope CSRD-reporting request for it. That is different from saying nobody can ever ask: a buyer's own commercial or contractual terms (a tender, an onboarding form, a code of conduct) can still call for it, cap or no cap; the cap just doesn't force you to answer for CSRD purposes. The Annex II breakdown on this page was checked against Annex II as published in the Official Journal (OJ L 2026/1560, 21.9.2026).
What buyers actually ask, beyond the standard
The cap is real, but so is the gap between it and what a questionnaire in your inbox looks like. Across the supplier ESG questionnaires we have processed on EcoDiligence, length has ranged from about 42 to 101 questions — well beyond what the cap reaches. This is our own observation from the requests we have seen, not a published study, and it will not match every buyer. The categories that most often account for the gap are human rights and labour, management practices, and evidence and document requests (policy documents, certificates, and similar attachments). One correction from earlier on this page: for suppliers above 10 employees, the cap does reach two specific human-rights/labour questions — do you have a code-of-conduct/human-rights policy, and does a workforce grievance channel exist. What the cap does not reach, in any of these categories, is depth beyond a yes/no or brief disclosure: detailed human-rights due-diligence narratives, the underlying policy documents or certificates themselves, management practice specifics, and anything in the management-practices or evidence-request categories.
What's inside the cap, and what's outside
A simplified view of the areas the value-chain cap covers versus items that fall outside it and are therefore optional for an SME to provide. The cap's legal text (Annex II to Regulation (EU) 2026/1560) is now final, but this table is a simplified summary of it, not a reproduction — check the VSME guide for how the cap relates to the wider standard before relying on specifics.
Topic
Inside the value-chain cap
Applies to
Outside the cap (optional to provide)
Company profile
General undertaking information (VSME B1): module option, individual or consolidated basis, and the geolocation of sites owned, leased or managed
Both tiers (≤10 and 11–1,000 employees)
Full corporate structure, beneficial ownership, sensitive ownership disclosures
Energy & Scope 1/2 emissions
Total energy consumption in MWh; Scope 1 GHG emissions and location-based Scope 2 GHG emissions
11–1,000 employees only — not in the ≤10-employee list
Renewable / non-renewable energy breakdown; full Scope 3 inventory with granular category-by-category breakdown
Waste & pollution
Total waste generated and the hazardous vs non-hazardous split; whether circular-economy principles are applied; the share of waste diverted to recycling or reuse
11–1,000 employees only — not in the ≤10-employee list
Annual material mass-flow; detailed pollutant registers, site-level air/water emissions inventories
Water
Total water withdrawal
11–1,000 employees only — not in the ≤10-employee list
Water consumption and water-stress figures; facility-by-facility water balances and effluent chemistry
Workforce
Employees by contract type and by gender; number and rate of recordable work-related accidents; pay at or above the minimum wage; collective-bargaining coverage (%); average training hours
Both tiers (≤10 and 11–1,000 employees)
Fatalities, gender pay gap and country of contract; individual salary bands, disciplinary records, personal identifiers
Governance & ethics
Not part of the cap at any tier
—
Presence of a code of ethics, anti-corruption and anti-harassment policies; convictions and fines; full board minutes, internal audit reports, litigation registers
Code of conduct & workforce grievance mechanism
Yes/No on whether a code of conduct or human-rights policy exists, and Yes/No on whether a workforce complaints-handling mechanism exists (VSME C6) — asked in our Comprehensive layer (Pro), not the default Free flow; the policy question isn't currently a standalone Yes/No on whether one exists at all
11–1,000 employees only — not in the ≤10-employee list
What the policy covers (child labour, forced labour and similar topics); details of how any complaint was investigated or resolved
Value chain & business model
Products and services, markets, and main business relationships (VSME C1, three datapoints)
11–1,000 employees only — not in the ≤10-employee list
Sustainability-related elements of strategy; full supplier list with commercial terms and contract copies; scenario analysis; capex allocation
Employee turnover
Employee turnover rate (VSME C5)
11–1,000 employees only — not in the ≤10-employee list
—
Human-rights incidents in your own workforce
Confirmed incidents in your own workforce (VSME C7)
11–1,000 employees only — not in the ≤10-employee list
—
Human-rights incidents in the value chain
Awareness of confirmed incidents involving value-chain workers, affected communities or consumers (VSME C7)
11–1,000 employees only — not in the ≤10-employee list
—
Reduction targets
Not part of the cap at any tier
—
Voluntary — you may share reduction targets you've set, but neither the cap nor the Basic Module requires it (Comprehensive-only)
Simplified view for SME orientation, not a reproduction of Annex II to Commission Delegated Regulation (EU) 2026/1560. The cap is not the same list as the VSME Basic Module — for suppliers above 10 employees it draws in Comprehensive-module items alongside the Basic ones. Framework text prevails wherever this summary is ambiguous.
What to say to a demanding customer
Three short replies you can adapt. The tone is deliberately calm and cooperative — the goal is to redirect the conversation to a standards-based Passport, not to escalate.
1. Share what's inside the VSME scope
Use when: Your buyer sent a long questionnaire. Start here — offer the standards-based data first, before discussing anything beyond it.
Hello,
Thank you for the ESG data request. We have prepared our disclosures using the EU Voluntary Standard (Annex I to Commission Delegated Regulation (EU) 2026/1560), which is based on EFRAG's VSME.
You can access our ESG Passport here:
[insert your EcoDiligence public profile link]
The Passport covers energy, Scope 1 and Scope 2 emissions, workforce data, and governance policies — the areas the VSME Basic Module addresses. If you need the data in a machine-readable format, we can send the EFRAG VSME Digital Template (Excel), which EFRAG's official converter turns into XBRL.
Please let us know if this covers what you need.
Best regards,
[Your name]
2. Politely decline items outside the standard scope
Use when: The buyer follows up asking for items that clearly fall outside the value-chain cap's Annex II list — not just outside the VSME Basic Module, since Annex II reaches a few Comprehensive-level items too (code of conduct, grievance mechanism, employee turnover, confirmed human-rights incidents) for suppliers above 10 employees. Full Scope 3, detailed pollutant registers, and supplier lists are safe examples; a code-of-conduct or grievance question is NOT, if you're above 10 employees. Only applicable if this is a CSRD-driven request, from an EU CSRD reporter, for a financial year from 2027 onward — check those first (see the four limits on this page). Not a substitute for those checks, and not for a tender, onboarding form, or other commercial request.
Hello,
Thank you for the follow-up. If this request is for your own CSRD reporting under EU law, and for a financial year beginning on or after 1 January 2027, a number of the additional items fall outside the limit that applies to a supplier our size.
Directive (EU) 2026/470 bars a CSRD-reporting buyer from requiring more than a defined list for its own CSRD reporting, for financial years from 2027 onward, once your Member State has transposed it into national law; Commission Delegated Regulation (EU) 2026/1560 sets out that list in its Annex II. We would prefer to keep our disclosure within that scope so it stays consistent across all our customers.
If this request isn't for your own CSRD reporting, or any of these items are essential for your reporting regardless, we are happy to discuss them individually — please let us know which are must-haves and why, and we will see what we can prepare.
Best regards,
[Your name]
3. Ask the buyer to confirm the cap's scope
Use when: The questionnaire looks like a generic large-enterprise template. Redirect the conversation by asking the buyer to confirm whether the legal limit applies at all — and only claim it does once they confirm this is a CSRD-driven request for a financial year the cap actually reaches.
Hello,
Before we work through the questionnaire, could you help us align on scope?
If this request is for your own CSRD reporting, for a financial year beginning on or after 1 January 2027, and your Member State has transposed the underlying directive, EU law limits what you may require from a supplier our size: Directive (EU) 2026/470 sets the limit itself, and Commission Delegated Regulation (EU) 2026/1560's Annex II defines the exact list — not the same as the general VSME standard, and not something we understand to apply to procurement, onboarding, or other commercial requests.
Could you confirm whether this request is for your own CSRD reporting and, if so, that it stays within that list — or let us know which items go beyond it and why they are needed? This will help us reply with the right level of detail without over- or under-reporting.
Best regards,
[Your name]
How EcoDiligence keeps you inside the scope
Free covers the baseline most first buyer requests need. Where a request goes further — for suppliers above 10 employees, the cap can reach several Comprehensive-module items — the opt-in Comprehensive layer on Pro reaches two of them, self-reported and not independently audited: a clean Yes/No on whether a workforce grievance channel exists, and what a code of conduct or human-rights policy covers if you have one (not currently a standalone Yes/No on whether one exists at all). The cap also includes employee turnover, which EcoDiligence does not collect in the VSME flow (Pro suppliers in an ASEAN country other than Malaysia who select the ASEDG module are asked a turnover percentage), and confirmed human-rights incidents, which it collects only in part on Pro — an upgrade would not fully answer an in-scope request for those specifically.
Free baseline by default
The standard wizard collects VSME Basic Module data points, which covers most first buyer requests. Several cap items live in the opt-in Comprehensive layer on Pro instead — see above.
Shareable Passport + PDF
A permanent public URL and a PDF you can send to any buyer. Both carry the same standards-based data and self-report attestation.
Advanced disclosures on your terms
If you choose to share more, the Pro plan adds optional VSME Comprehensive and IFRS S2 transition topics — always your choice, never compelled.
Machine-readable exports
Buyers who need structure receive the VSME Digital Template (Excel), which EFRAG's official converter turns into XBRL — from the same source of truth as your Passport.
Create your free Passport — most SMEs finish in under ten minutes and can share the link the same day.
Frequently asked questions
Both pieces are now law at the EU level. The mechanism has been in force longest: Directive (EU) 2026/470 (Omnibus I), in force since 18 March 2026, bars a CSRD-reporting buyer from requiring more sustainability information than the voluntary standard from a value-chain supplier of 1,000 employees or fewer. As a directive, though, it binds EU Member States rather than private parties directly — each must transpose the relevant provisions by 19 March 2027 (Directive 2026/470, Art. 5(1)) into its own national law, so a specific buyer's actual obligation can depend on their Member State's implementing law. The standard that defines exactly what that voluntary scope covers — Commission Delegated Regulation (EU) 2026/1560 — was published in the Official Journal on 21 September 2026 and entered into force on 24 September 2026 (a regulation, so it applies directly, no transposition needed). So both the right not to be over-required, and the specific list (Annex II) of what you can be required to answer, are now settled EU law. The cap applies to financial years beginning on or after 1 January 2027; SMEs can use the Voluntary Standard now.
Indirectly, yes. The cap operates on the buyer's side: EU-based CSRD reporters (and non-EU groups above the CSRD third-country thresholds) are the ones told not to over-request from SME suppliers. If your customer is an EU-based CSRD reporter, the same rule shapes what they may require from you for their own CSRD reporting, from financial years beginning 1 January 2027 and once their own EU Member State has transposed the underlying directive — regardless of where you are located. A non-EU group reporting under the CSRD's third-country provisions sits outside that Member-State mechanic; we have not separately verified what governs their obligation, so treat the cap as applying to them with less certainty than to an EU-based buyer. The voluntary standard's disclosures are structured to be jurisdiction-neutral, so a non-EU supplier can reply with a standards-based Passport just as easily as an EU one.
The framework limits what buyers may require for their own CSRD reporting, from financial years beginning 1 January 2027 and once their EU Member State has transposed the underlying directive, but it does not force them to source from any particular supplier, and it does not reach a buyer's ordinary commercial or contractual requests. Commercial pressure is real, and a large buyer can choose their suppliers freely. The practical response is usually not confrontation but redirection: offer the standards-based data first (which covers most legitimate procurement questions), explain that additional items sit outside the value-chain cap's own scope, and offer to discuss specific items case-by-case if there is a genuine reason. Buyers who understand the framework will typically accept a well-structured Passport as their starting point.
Absolutely. The cap defines what a buyer can require, not what you can choose to share. Many SMEs go beyond it to differentiate themselves — for example, by adding a transition-plan narrative, a certification, or supplementary metrics. EcoDiligence's optional Advanced Disclosures (Pro) exist for exactly this: a structured way to share additional depth without leaving the framework.
Free covers the core self-reported baseline most small suppliers need for a first buyer request — general information, energy and emissions, workforce basics and core policies, all with a public profile, a PDF export, and no time limit on any of it. The cap's Annex II, for suppliers with more than 10 employees, also reaches several items further out. Pro's Comprehensive module reaches two of them, though not both with equal precision: it cleanly asks Yes/No whether a workforce complaints-handling (grievance) channel exists, and separately asks what a code of conduct or human-rights policy covers if you have one — it doesn't currently ask a plain Yes/No on whether one exists at all. The cap also includes employee turnover (C5), confirmed human-rights incidents in your own workforce, and awareness of confirmed incidents in the value chain (C7); EcoDiligence does not collect employee turnover in the VSME flow (only Pro suppliers in an ASEAN country other than Malaysia who select the ASEDG module are asked a turnover percentage) and collects the incident items only partly on Pro, so upgrading would not fully answer an in-scope request for those specifically.
The primary source is EUR-Lex (eur-lex.europa.eu), which publishes Commission Delegated Regulation (EU) 2026/1560 and its Annex II datapoint list, and Directive (EU) 2026/470. EFRAG (efrag.org) publishes implementation guidance and the Digital Template. This page summarises for SMEs; always defer to the original texts for definitive wording.
This page summarises Directive (EU) 2026/470 and Commission Delegated Regulation (EU) 2026/1560 (Annex II) for orientation only. It is not legal advice, and nothing here substitutes for the texts themselves — the Annex II breakdown on this page was checked against Annex II as published in the Official Journal (OJ L 2026/1560, 21.9.2026). Always check the official texts at finance.ec.europa.eu and eur-lex.europa.eu for the current status. EcoDiligence ESG Passports are self-reported summaries structured for ESG disclosure workflows, built on the EFRAG VSME Basic Module with optional IFRS S2 climate inputs. Content is not independently assured and does not constitute compliance, certification or an audit.
Ready to answer buyer requests the smart way?
Generate a shareable ESG Passport structured for the VSME Essential scope — free, no consultant, ~10 minutes.