CSRD Data Requests to SME Suppliers: The Value Chain Cap Explained

If you are a small or mid-sized supplier, you have probably received a sustainability questionnaire from a large customer citing the CSRD. Since 2026 the rules have changed: the Omnibus simplification narrowed CSRD reporting to the largest companies, and a new value chain cap limits what those companies can require from suppliers with 1,000 employees or fewer. This guide explains where things stand in November 2026 and how to answer data requests sensibly.

This article is general information, not legal advice.

What is the CSRD and who has to report now?

The Corporate Sustainability Reporting Directive requires certain companies to publish sustainability information under European Sustainability Reporting Standards (ESRS). Its scope was cut back by the Omnibus I Directive, published as Directive (EU) 2026/470 in the Official Journal on 26 February 2026. Member states must transpose the reporting changes by 19 March 2027.

According to Latham & Watkins, the new CSRD thresholds cover EU companies or groups with more than 1,000 employees and net turnover above 450 million euro, plus certain non-EU groups with large EU turnover. Accountancy Europe's factsheet adds that listed SMEs are fully exempt and that companies newly in scope report for financial years starting on or after 1 January 2027.

What happened to the earlier waves?

The so-called stop-the-clock directive had already postponed the second wave by two years. Companies that were part of the first wave but have 1,000 or fewer employees no longer have to comply from 2027, and member states may exempt them for 2025 and 2026.

Why suppliers still get questionnaires

Far fewer companies report than originally planned, but those that do still need value chain information, for example for Scope 3 emissions. Banks, investors and public buyers also ask for sustainability data for their own reasons, regardless of the CSRD.

What is the CSRD value chain cap?

The value chain cap is the most important change for SME suppliers. Accountancy Europe summarises it this way: reporting companies cannot require protected undertakings, those with no more than 1,000 employees on average, to provide information beyond the voluntary standard. Protected suppliers can decline additional requests, contract terms that conflict with this are not binding, and the customer may rely on a self-declaration of protected status.

The voluntary standard (VS)

The voluntary standard sets the ceiling, and the European Commission adopted it on 3 July 2026 together with revised ESRS, describing it as a single, proportionate reference framework for smaller companies outside CSRD scope. It was published as Delegated Regulation (EU) 2026/1560. According to Garrigues, it entered into force on 24 September 2026, and the cap applies to financial years starting on or after 1 January 2027.

The voluntary standard builds on the VSME that EFRAG published in December 2024. EFRAG designed the VSME, with a Basic Module and a Comprehensive Module, to replace the many inconsistent questionnaires SMEs receive from banks, investors and large customers.

What the cap does not cover

• It only limits information collected for CSRD sustainability reporting. Requests based on other EU or national laws, for example deforestation due diligence, are outside the cap.
• It limits what a customer can require, but a customer can still ask, and you can still choose to share more.
• It does not apply to suppliers above 1,000 employees.

Key dates at a glance

National rules may still differ until transposition is complete, so a customer in one member state may be at a different stage from a customer in another. When a request arrives, check the date and the country of the company asking, and ask which reporting year the data is for.

How should SME suppliers answer CSRD data requests?

A practical approach that keeps customers happy without drowning your team:

1. Check whether you are protected. If you have 1,000 or fewer employees, the value chain cap applies to requests made for CSRD reporting.
2. Prepare one data set based on the voluntary standard. Basic figures such as energy use, greenhouse gas emissions, waste, workforce and governance cover much of what customers ask, so you can reuse the same file for every request.
3. Ask why the data is needed. If the request is for CSRD reporting, you can point to the voluntary standard. If it is for another law or a bank, the cap may not apply.
4. Answer what you can measure. State your methods and estimates openly, because a clear estimate is more useful to the customer than a blank field.
5. Keep product data separate. Certificates such as FSC, PEFC or ISO 14001 and product data such as recycled content often matter more in purchasing than company-wide figures.

What should buyers ask suppliers under the CSRD?

For purchasing teams in reporting companies, the cap is a reason to standardise requests rather than send long custom questionnaires.

• Ask protected suppliers for information in the format of the voluntary standard, and accept their existing VS or VSME report if they have one.
• Focus on what drives your own reporting, usually emissions and material data for your largest purchase categories. Our guide to Scope 3 emissions in purchasing explains which data helps most.
• Separate CSRD questions from other due diligence questions, so suppliers know which legal basis applies.
• Avoid contract clauses that require protected suppliers to report beyond the cap; they may not be binding.

The revised ESRS also reduce the burden on reporting companies: the Commission says mandatory datapoints fall by over 60% and total datapoints by over 70%.

Sustainability data in requests on Flobid

When you send a request for quotation on Flobid, you can ask suppliers for the certificates and product data that matter for the order, rather than a full sustainability report. Suppliers can show checked certificates on their profile. See our sustainability page for how we handle certificates and claims.

Sources

1. EU Sustainability Omnibus Published in the Official Journal, Latham & Watkins (2026)
2. CSRD: Amendments published in the Official Journal of the European Union, DRSC (2026)
3. Omnibus explained: key changes to the CSRD, Accountancy Europe (2026)
4. Commission adopts revised sustainability reporting standards, European Commission (2026)
5. Commission Delegated Regulation (EU) 2026/1560, EUR-Lex (2026)
6. EU publishes voluntary sustainability standard and caps value chain reporting requirements, Garrigues (2026)
7. EFRAG releases the Voluntary Sustainability Reporting Standard for non-listed SMEs, EFRAG (2024)