What You May No Longer Ask Sub-1,000-Employee Suppliers

If your company reports under CSRD, the supplier ESG questionnaire you sent last year is probably no longer something you may send next year. The Omnibus I directive (in force 18 March 2026) created a statutory ceiling on the sustainability information a CSRD reporter may require from smaller business partners, and the delegated act of 3 July 2026 made the ceiling concrete. From financial years starting 1 January 2027 it is fully in force.

This page is the practical reading of that rule for the people who design supplier requests: what remains lawful to require, what does not, and how to audit an existing questionnaire against the line.

The Rule

For CSRD reporting purposes, an in-scope company may not seek sustainability information from a value-chain partner with fewer than 1,000 employees beyond what the voluntary standard (VS) specifies. The directive calls these partners “protected undertakings”. Two refinements matter:

• The ceiling is the standard’s disclosure set. The 3 July 2026 delegated act turned EFRAG’s VSME standard into the official VS and pins the cap to the disclosure requirements in its Annex II, keeping the familiar Basic and Comprehensive two-module structure.
• Micro-enterprises get a lower ceiling still. For partners with 10 or fewer employees, the cap is tighter than the full set — design your smallest-supplier requests to the minimum you genuinely need.

The cap has been law since March 2026; the FY2027 application date is when questionnaires must actually conform. Our Omnibus overview covers the wider reform.

What You May Ask: The Ceiling in Practice

The lawful core of a supplier request is the VSME disclosure set. In practice, that means questions shaped like these:

A question that maps to one of these codes is inside the ceiling. A questionnaire built from them — see our supplier questionnaire template — is compliant by construction.

What You May No Longer Require

The cap ends several habits of the pre-2026 era, for any request aimed at a sub-1,000-employee partner for CSRD purposes:

• ESRS datapoint dumps. Extracting your own ESRS disclosure requirements into a supplier spreadsheet and requiring them at full depth is exactly what the cap prohibits. Your suppliers are not in scope of the ESRS; the VS set is their maximum.
• Materiality exercises. Requiring a supplier to run or evidence a double materiality assessment has no basis in the VS, which replaced materiality with a simpler applicability principle.
• Blanket “everything you have” demands. Open-ended requests for all sustainability data, policies, and metrics fail the test that each required item map to the standard.
• Proprietary mega-questionnaires whose field count far exceeds the VS set, where the excess cannot be justified under a carve-out (below). Every question beyond the ceiling now needs a defensible basis.

The practical consequence is symmetrical: from FY2027 a protected supplier may decline the excess, and well-advised ones will. Requests that overreach convert into friction, delay, and refusals you cannot escalate.

What Still Flows: The Carve-Outs

The cap is a ceiling on CSRD-purpose requests, not a ban on knowing your supply chain. Four channels lawfully continue:

1. Climate targets and climate risks (C3/C4). These two Comprehensive disclosures sit outside the cap and may be requested regardless of module choice — significant, because they are the datapoints your E1 reporting and your lenders care about most.
2. Sector-customary information. Data customarily exchanged in a sector (product compliance in automotive, traceability in food) remains legitimate.
3. Other EU law. Requests grounded in taxonomy reporting, banking regulation, or due-diligence legislation are outside the cap’s scope — it constrains CSRD-purpose collection only.
4. Product-level Scope 3 data. Where you need product carbon footprints for your own product-level accounting, the cap does not block the ask.

Carve-outs are justifications, not loopholes: each above-ceiling question should be traceable to one of them, and “we have always asked this” is not on the list.

How to Audit Your Questionnaire

1. Map every question to a VSME code. B1–B11, C1–C9, or one of the four carve-outs. Anything unmapped is a candidate for deletion.
2. Segment by supplier size. Above 1,000 employees the cap does not apply; below 10 the tighter micro ceiling does. One questionnaire per segment beats one questionnaire for everyone.
3. Accept the report, not just the form. A supplier’s existing VSME report contains the capped set by definition. Accepting it as a response raises completion rates and drops your processing cost — suppliers can now generate one free of charge with tools like an ESG answer bank, which removes their cost objection entirely.
4. Rewrite before FY2027, not after. Buyers redesigning now set supplier expectations while goodwill is cheap; those who wait will be renegotiating under deadline.

The requester-side playbook in full is at how to request CSRD data from your suppliers.

Frequently Asked Questions

Does the cap apply to banks asking borrowers for ESG data?

Not directly. Bank requests grounded in prudential regulation fall under the other-EU-law carve-out, so the cap does not bind them. What exists on that channel is the Commission’s July 2025 Recommendation asking financial institutions to hold SME data requests to the VSME standard — guidance rather than a ceiling. The lending picture is covered in bank ESG questionnaires for SMEs.

What if a supplier volunteers more than the VSME set?

Entirely fine. The cap limits what you may require; a supplier may always share more, and some will, particularly those with mature programmes courting preferred-supplier status. The compliance question attaches to your demand, not their offer.

How is the cap enforced?

The cap sits in the CSRD as amended, so it takes effect through each Member State’s transposition, and its most immediate force is practical: protected suppliers may refuse above-ceiling demands, and your report’s value-chain data must be defensible as lawfully collected. Treating the audit above as a compliance task rather than a courtesy is the safe reading.

We are below 1,000 employees ourselves but collect data from our own suppliers — does the cap bind us?

The cap binds CSRD reporters, so if you are out of scope it does not constrain you legally. It still describes best practice: the VSME set is what your suppliers can realistically answer, and requests shaped to it get better data. If you are answering requests as well as sending them, see one VSME report for every ESG request.

Key Terms

• Value-chain cap — the statutory limit on sustainability information a CSRD reporter may require from business partners with fewer than 1,000 employees, for CSRD purposes.
• Protected undertakings — the directive’s term for those sub-1,000-employee partners.
• VS / Annex II — the voluntary standard adopted by delegated act on 3 July 2026; its Annex II disclosure set defines the cap’s ceiling.
• Micro-enterprise ceiling — the lower cap applying to partners with 10 or fewer employees.
• Carve-outs — the categories that lawfully exceed the ceiling: C3/C4 climate disclosures, sector-customary data, other-EU-law requirements, and product-level Scope 3.

Conclusion

The value-chain cap replaces an open-ended data relationship with a defined one: the VSME set as the core, four carve-outs as the justified exceptions, and FY2027 as the date the definition bites. For requesters the work is an audit and a rewrite; the reward is higher response rates from suppliers who can finally answer from one reusable report.

Map your questions, segment your suppliers, and let the ceiling the EU wrote become your template.