EU SME ESG Data Cap: What Buyers Can Request

The EU’s new value-chain cap changes what a company reporting under the Corporate Sustainability Reporting Directive (CSRD) may require from a smaller supplier for its own CSRD reporting. From financial years beginning on or after 1 January 2027, a reporting company cannot compel a value-chain business with an average of 1,000 employees or fewer to provide more than the essential datapoints listed in Annex II of the voluntary standard. It may ask for more, but the supplier must be told that the extra information is optional.

For procurement and ESG teams, the immediate task is to separate legally capped CSRD requests from other data needs, simplify questionnaires and preserve a clear reason for every additional field.

What changed in September 2026?

Commission Delegated Regulation (EU) 2026/1560 was published in the Official Journal on 21 September 2026. It establishes a voluntary sustainability reporting standard for undertakings protected by the value-chain cap and identifies, in Annex II, the datapoints that define that cap.1

The regulation entered into force on 24 September 2026. Voluntary use of the standard is already available to undertakings outside mandatory CSRD reporting, while the value-chain cap applies for financial years starting on or after 1 January 2027.2

This is more than another reporting template. The standard is also a legal boundary on the sustainability information that an in-scope CSRD company can demand from a protected supplier for the purpose of preparing its own sustainability statement. The European Commission describes the objective as limiting the “trickle-down effect” of CSRD reporting on smaller businesses.3

Who is protected by the value-chain cap?

The protection applies to undertakings in a CSRD reporter’s value chain that had an average of 1,000 employees or fewer during the preceding financial year. That can include suppliers, contract manufacturers, logistics providers and other business partners, whether they are located in the EU or elsewhere.

For a brand buying from China, Hong Kong, Taiwan or another Asian market, location is not the deciding factor. The relevant questions are whether the buyer is gathering information for its own CSRD reporting, whether the business partner falls within the employee threshold, and whether the requested datapoint is inside Annex II.

The voluntary standard and the cap are related but distinct:

• A protected company is not obliged to prepare a voluntary sustainability report merely because a customer is subject to CSRD.
• A CSRD reporter may require the Annex II datapoints that it genuinely needs for its reporting.
• The reporter may request information beyond the cap, but it must identify the excess and inform the protected company of its statutory right to decline.
• The cap does not prevent requests made for another legal purpose or on a genuinely voluntary commercial basis.

The Commission is explicit that buyers should not default to requesting every permitted datapoint. They should ask only for what is necessary.3

What can buyers require for CSRD reporting?

Annex II is the controlling list. It draws selected essential datapoints from the standard’s Basic and Comprehensive Modules. The list covers areas such as general company information and selected environmental, workforce and business-conduct metrics. It is narrower than the full voluntary standard and substantially narrower than many supplier ESG questionnaires.1

The regulation also provides greater protection to the smallest businesses. The capped set for undertakings with 10 employees or fewer is smaller than the set for those with 11 to 1,000 employees. The Commission’s explanatory material says that some disclosures classed as necessary for the larger group are voluntary for micro-undertakings.3

For buyers, this makes a single undifferentiated questionnaire risky. A defensible request process needs at least three pieces of metadata: the supplier’s size band, the purpose of the request and the Annex II basis for each mandatory field.

What remains outside the cap?

The cap is purpose-specific. It limits what a CSRD company can require from a protected value-chain undertaking for the requester’s own CSRD reporting. It does not automatically restrict information needed to comply with other EU or national laws.2

That distinction matters for procurement teams that use the same supplier portal for several regimes. Product-level emissions for the Carbon Border Adjustment Mechanism, due-diligence evidence, product compliance records and contractual quality data may have legal or commercial bases separate from CSRD. They should not be labelled as mandatory under CSRD simply because they are sustainability-related.

Likewise, a buyer can still invite a supplier to provide additional product carbon-footprint data, Scope 3 activity data or transition information. If those fields exceed Annex II and the purpose is CSRD reporting, the buyer must make the voluntary status clear and respect a refusal. A request can therefore remain useful without being presented as a legal obligation.

How to redesign a supplier ESG questionnaire

Start by mapping the existing questionnaire, field by field, rather than replacing one broad survey with another.

Questionnaire layer	Treatment from FY2027	Buyer action
Annex II datapoint needed for the buyer’s CSRD report	May be required from a protected supplier	Record the Annex II reference and why the datapoint is necessary
Annex II datapoint not needed for the buyer’s report	Should not be requested by default	Remove it or make it optional with a clear use case
Information beyond Annex II for CSRD reporting	May be requested, not required	Flag it as above-cap and state the right to decline
Information required under another law	Assessed under that separate legal basis	Identify the law and keep the request outside the CSRD workflow
Commercial or decarbonisation data	Voluntary unless another basis applies	Explain the operational purpose, benefit and confidentiality treatment

A practical implementation sequence is:

1. Inventory every field. Identify duplicated requests across procurement, finance, compliance and sustainability teams.
2. Tag the purpose. Distinguish CSRD reporting, another legal requirement, customer reporting, risk screening and voluntary decarbonisation support.
3. Map mandatory CSRD fields to Annex II. Do not rely on a broad “ESG required” label.
4. Segment suppliers. At minimum, distinguish 10 employees or fewer, 11–1,000, and above 1,000, using the regulation’s relevant average-employee test.
5. Rewrite supplier notices. Separate required fields from optional fields and explain the right to decline above-cap CSRD requests.
6. Add governance. Require legal or reporting-owner approval before a new mandatory sustainability field is introduced.

The Commission adopted the revised ESRS and voluntary standard together as part of the reporting simplification package, describing the voluntary framework as a proportionate reference for smaller companies outside CSRD scope.4 Its corporate reporting timeline records the two delegated acts adopted on 3 July 2026 and the policy objective of reducing burdens on smaller value-chain companies.5

What suppliers should prepare now

Protected suppliers should not interpret the cap as a reason to stop building sustainability data. A compact, repeatable dataset can reduce questionnaire effort, support customer conversations and improve access to finance. The better approach is to prepare the capped core first, then add voluntary information where it serves a clear business purpose.

For manufacturers, this usually means establishing ownership and controls for company information, energy use, greenhouse-gas estimates and other applicable metrics; documenting boundaries and methodologies; and maintaining evidence that can be reused across customers. EFRAG’s knowledge hub provides the 2026 voluntary standard, implementation materials and a digital reporting ecosystem.6

EFRAG’s non-mandatory guidance explains practical application of the Basic and Comprehensive Modules, including energy and greenhouse-gas emissions, climate targets and supplier relationships. It is guidance rather than an extension of the regulation, so it can help with implementation without adding legal datapoints to the cap.7

Where carbon data remains weak, use a staged improvement plan rather than forcing false precision. A factory can begin with energy bills, fuel records, production volumes and calculation assumptions, then improve emission factors and allocation methods. Our factory-level supplier carbon assessment checklist provides a practical structure for that work.

Risks for global procurement teams

The main compliance risk is not asking a supplier any question beyond Annex II. It is treating an above-cap request as compulsory for CSRD reporting, failing to disclose the right to decline or using an undifferentiated portal that obscures why information is needed.

There are also operational risks. Removing too many fields could weaken decarbonisation programmes, while retaining every legacy field could increase supplier resistance and create inconsistent data. The answer is governance: a smaller mandatory core, clearly labelled voluntary modules and separate workflows for other legal regimes.

Contracts and supplier codes may also need review. A general clause requiring “all ESG information requested by the buyer” may not reflect the new distinction. Procurement, legal and sustainability teams should agree how requests are classified, how refusals are handled and when additional data is commercially important enough to seek voluntarily.

Decisions to take before 2027

Buyers should complete three decisions before the first affected reporting period:

• which Annex II datapoints are actually necessary for their CSRD reporting;
• which additional data supports other laws or voluntary decarbonisation programmes; and
• how supplier communications will distinguish required, optional and separately mandated requests.

The strongest process will not simply shrink a questionnaire. It will make every field traceable to a purpose, reduce duplicate demands and give suppliers a workable route to improve data quality. For cross-border supply chains, that clarity is likely to matter as much as the standard itself.