Before you send your next supplier questionnaire, check the CSRD value-chain cap

If you work in sustainability or procurement at a company caught by the Corporate Sustainability Reporting Directive, you have almost certainly done this already: built a supplier questionnaire, listed every emissions figure, policy and certification your ESRS materiality assessment says you need, and pushed it down the supply chain. It felt like diligence. As of this reporting cycle, some of those questions are ones your smaller suppliers now have a legal right to refuse.

The Omnibus I simplification package quietly redrew the line between what you may ask a supplier for and what you may not. Most teams have not updated their questionnaires to match, which means they are over-asking — and over-asking is no longer just inefficient, it is a compliance and commercial risk. By the end of this article you will know exactly where the new line sits, who it protects, and why the questionnaire you are about to send may need a rewrite before it goes out.

What changed: the value-chain cap

The CSRD leans heavily on the European Sustainability Reporting Standards, and those standards require you to disclose not only your own impacts but the impacts across your value chain — suppliers, customers and end-users. Left unchecked, that turns every reporting company into a data-collection engine pointed at everyone it buys from, including businesses far too small to have a sustainability function at all.

The problem Omnibus I set out to solve

The European Commission designed Omnibus I, in part, to stop the reporting burden cascading down the supply chain onto companies that were never meant to carry it. The Omnibus I Directive — Directive (EU) 2026/470 — was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026. Among its changes to the CSRD is a mechanism now widely referred to as the value-chain cap.

The rule, in one sentence

The cap prevents a company in scope of the CSRD from requesting sustainability information that goes beyond what is set out in the voluntary reporting standard from value-chain companies with fewer than 1,000 employees. Those smaller companies — sometimes called protected undertakings — have the right to decline any request that reaches past that boundary. The point to internalise is this: your right to ask is no longer open-ended.

The line, precisely: what you can and cannot ask

The distinction is not about how important the data is to your report. It is about the size of the supplier you are asking. That is the part most teams get wrong.

You can ask a sub-1,000-employee supplier for…

• The data points covered by the voluntary reporting standard for SMEs.
• Information within that defined, limited standard set
• The same standardised request you would send any comparable supplier

‍You cannot ask that same supplier for……

• Additional, bespoke or more granular sustainability data
• Anything beyond it, even where your own ESRS materiality assessment says you need it
• A custom questionnaire calibrated to your reporting obligations rather than their size

Read the second group of bullet points carefully, because it overturns a common instinct. Under the old approach, a strong materiality argument justified asking for almost anything — if the data was material to your disclosures, you asked for it. That logic no longer holds for smaller suppliers. The cap is calibrated to supplier size, not to your own reporting obligations. Your materiality assessment does not unlock more data from a protected undertaking.

Who is protected, and who is not

The threshold that matters here is the supplier's headcount.

Suppliers with fewer than 1,000 employees

These are protected. You may ask them only for the voluntary-standard data set, and they may decline anything more. Note this is a different number from the one that determines whether you are in scope of the CSRD in the first place — your own scope turns on exceeding both €450 million net turnover and 1,000 employees. The cap is a separate test, applied to the company you are asking, not to you.

Suppliers with 1,000 or more employees

These are not shielded by the cap. A larger supplier can be asked for more than the voluntary-standard set, subject to the usual reasonableness of the request.

The open question: large non-EU groups

There is currently uncertainty over whether the value-chain cap extends to companies and groups reporting under the separate regime for certain large non-EU groups with significant EU operations. That standard is still in draft, so the position should be monitored as it develops rather than assumed either way.

What the voluntary standard actually covers

The ceiling on your requests is defined by the voluntary reporting standard for SMEs. That standard is based on the Commission's Recommendation on voluntary sustainability reporting for non-listed SMEs, adapted by the Commission when it adopted the revised ESRS and the voluntary reporting standard on 3 July 2026. It sets out a defined, deliberately limited set of data points — a floor of information a smaller company can reasonably provide, rather than the full ESRS data universe.

One caveat worth flagging to your legal and reporting colleagues: the revised standards are going through a two-month scrutiny period with the Council and the European Parliament, extendable by a further two months. The final detail is therefore not yet fully locked down, so treat the precise contents of the voluntary set as firm in principle but confirm the specifics before you hard-code them into a template.

Why over-asking is now a risk, not just wasted effort

It is tempting to treat the cap as a courtesy — a nice-to-know that changes nothing if a cooperative supplier answers anyway. That underrates it on three counts.

• It is a right, not a guideline. A protected supplier can decline the excess questions outright, which means a questionnaire built on the old assumptions will come back with gaps you cannot compel them to fill — and you will discover that late in the cycle, not early.
• Over-collection carries its own exposure. Demanding sustainability data a supplier has the right to refuse invites friction, contractual pushback and, at the margins, the appearance that you are imposing obligations the law was specifically amended to remove.
• It wastes the scarcest resource you have. Supplier engagement bandwidth is finite. Every question a supplier is entitled to ignore is a question crowding out the data you actually can — and must — obtain.

The teams that come out ahead this cycle are the ones that ask precisely, not maximally.

What to do in the next 90 days

1. Pull your current supplier questionnaire and mark every field against the voluntary-standard data set. Anything outside it, going to a sub-1,000-employee supplier, is a field you cannot compel.
2. Segment your supplier list by headcount — under 1,000 versus 1,000-plus — because that single cut determines which version of the request each supplier receives.
3. Build two request templates: a capped, voluntary-standard request for protected suppliers, and a fuller request for larger suppliers where more is defensible.
4. Reroute the data you can no longer demand from small suppliers. Decide where you will use estimates, sector averages or proxies for the value-chain data points your materiality assessment still needs.
5. Confirm the final voluntary-standard content once the revised standards clear scrutiny, and lock your templates to it before FY2026 collection ramps up.
6. Brief procurement and legal, so that contracts and supplier onboarding stop asking for data the company has no right to require.

‍