Why do EU customers send you ESG questionnaires?
Because they report on their value chain, and your data is part of it. The Corporate Sustainability Reporting Directive (CSRD), Directive (EU) 2022/2464, requires large companies to publish a sustainability report under the European Sustainability Reporting Standards (ESRS), covering their own operations and their value chain: suppliers, subcontractors, carriers. The electricity and fuel your plant uses, for instance, are part of your customer's indirect emissions.
The framework was cut back sharply in 2025 and 2026. This is what we read on EUR-Lex on 11 November 2026:
- the "stop-the-clock" directive, Directive (EU) 2025/794 of 14 April 2025, moved companies due to report for the first time on financial years 2025 or 2026 to financial years starting on 1 January 2027 or 2028;
- the Omnibus I directive, Directive (EU) 2026/470 of 24 February 2026, published in the Official Journal on 26 February 2026 and in force from the twentieth day after, 18 March 2026, limits reporting to companies with net turnover above EUR 450 million and more than 1,000 employees on average. Member States must transpose it by 19 March 2027;
- the simplified ESRS, Delegated Regulation (EU) 2026/1563 of 3 July 2026, entered into force on 10 November 2026 and apply to financial years starting on or after 1 January 2027; for 2026, companies may use either the simplified ESRS or the amended 2023 ESRS;
- the voluntary standard, Delegated Regulation (EU) 2026/1560 of 3 July 2026, published on 21 September 2026 and in force since 24 September 2026, takes over the VSME and sets the value-chain cap, which applies to financial years starting on or after 1 January 2027.
Not every request comes from the CSRD. Customers also question suppliers for their procurement policy, risk management or, later, due diligence; a supplier sustainability rating platform asks its own questions and gives a score; a bank may ask for the same data. The first thing to ask about any questionnaire is: what is it based on?
Who has to do what after Omnibus I?
Only the largest companies publish a CSRD report; a supplier in Morocco, Africa or the Middle East is almost always affected as part of a customer's value chain. The table summarises the cases, based on the texts read on EUR-Lex on 11 November 2026.
Profile | Obligation | Legal basis | From | What it means for you |
|---|---|---|---|---|
Large EU company: net turnover above EUR 450 million and more than 1,000 employees on average | Sustainability report in the management report, under the ESRS | Directive 2013/34/EU, Article 19a, as amended by Directive (EU) 2026/470; Delegated Regulation (EU) 2026/1563 | Financial years starting on 1 January 2027 for companies not yet reporting; the first group has reported since financial year 2024 | This is your customer: it asks you for value-chain data |
Non-EU group: net turnover in the EU above EUR 450 million in each of the last two years, with an EU subsidiary, or failing that a branch, above EUR 200 million | The subsidiary or branch publishes the group's sustainability report | Directive 2013/34/EU, Article 40a, as amended by Directive (EU) 2026/470 | Financial years starting on 1 January 2028 | Rare for an exporter; check if your group has a large EU subsidiary |
Company with 1,000 employees or fewer in the value chain of a reporting company, wherever it is based | No reporting obligation; a "protected undertaking" under the value-chain cap | Article 19a(3), as amended by Directive (EU) 2026/470; Delegated Regulation (EU) 2026/1560, Annex II | Financial years starting on 1 January 2027 | Your customer can only require, for its report, the Annex II datapoints |
Company with more than 1,000 employees and EUR 450 million turnover or less | Outside the CSRD | Article 19a, as amended | — | No reporting obligation, but no protection from the cap either |
Any company outside the scope, SME or mid-sized | Voluntary reporting under the voluntary standard | Delegated Regulation (EU) 2026/1560, Annex I (based on Recommendation (EU) 2025/1710) | In force since 24 September 2026 | A VSME report answers most requests |
Supplier receiving ESG requests | Whether to answer is a matter of contract and commercial relationship | Contract, procurement policy, rating platform, due diligence | Depends on the request | Qualify each request before answering |
The 2028 date for non-EU groups comes from Article 5 of Directive (EU) 2022/2464, which Directive (EU) 2025/794 did not change on that point.
What does the value-chain cap change for a supplier outside the EU?
It limits what a customer subject to the CSRD can require from you for its report, and gives you a right to refuse anything beyond it. We read the two texts behind it: Article 19a(3) of Directive 2013/34/EU as amended by Directive (EU) 2026/470, and Delegated Regulation (EU) 2026/1560.
What the texts say:
- who is protected: a company whose average headcount in the previous financial year did not exceed 1,000 employees at its balance sheet date, and which is in the value chain of a reporting company. There is no condition on where the company is established: a supplier in Morocco is protected on the same terms as an EU supplier;
- proof of status: the reporting company may rely on your self-declaration without checking it, unless it knows the declaration is manifestly wrong;
- the maximum: only the datapoints listed in Annex II of Delegated Regulation (EU) 2026/1560, with a shorter list for companies with 10 employees or fewer;
- the right to refuse: you may decline to provide, for that report, information going beyond it;
- the duty to inform: a customer asking for more must tell you which items exceed the cap and remind you of your right to refuse;
- contracts: a clause requiring more, for reporting purposes, is not binding, without affecting the rest of the contract;
- the date: Article 3 of the delegated regulation, which sets the cap, applies to financial years starting on or after 1 January 2027.
Three limits are written into the directive. The cap does not stop voluntary sharing of information commonly exchanged in a sector. It does not affect requests made for other purposes, such as due diligence or the customer's risk management. And it creates no obligation to answer.
Two further points from the delegated regulation. Its recital 5 states that from its entry into force, Recommendation (EU) 2025/1710 on the VSME should be considered as no longer producing legal effects: the reference is now the voluntary standard in Annex I, based on the original version of that recommendation. And a company applying the voluntary standard does not need an assurance opinion.
Which VSME module does each question belong to?
Almost every question in an ESG questionnaire fits one of the 20 disclosures of the voluntary standard: 11 in the basic module (B1 to B11) and 9 in the comprehensive module (C1 to C9). EFRAG delivered the VSME to the Commission on 17 December 2024, designed to replace the many uncoordinated questionnaires and ESG data requests that SMEs receive.
The table maps common wording to the disclosures of Delegated Regulation (EU) 2026/1560. The "cap" column applies to a company with more than 10 employees.
Typical questionnaire question | Disclosure in the voluntary standard | Within the cap? | Evidence to prepare |
|---|---|---|---|
Who are you? Headcount, sites, turnover, sector | B1 — Basis for preparation | Yes (general information) | Articles of association, tax return, staff register |
Do you have an environmental or climate policy? | B2 — Practices, policies and future initiatives | No | Signed policy, action plan |
What is your energy consumption? | B3 — Energy and GHG emissions | Yes (total energy in MWh) | Electricity and fuel invoices |
What are your scope 1 and 2 emissions? | B3 — Energy and GHG emissions | Yes (estimated gross emissions) | Documented calculation, sourced emission factors |
What are your scope 3 emissions and reduction targets? | C3 — GHG reduction targets and climate transition | No | Carbon footprint, trajectory |
Are you exposed to climate risks? | C4 — Climate risks | No | Risk assessment |
Emissions to air, water and soil | B4 — Pollution | No | Permits, discharge analyses |
Sites in or near biodiversity-sensitive areas | B5 — Biodiversity | No | Site locations |
How much water do you withdraw? | B6 — Water | Yes (total withdrawal) | Invoices, meter readings |
Waste generated, hazardous and recycled | B7 — Resource use, circular economy, waste | Yes (principles, weight, share recycled) | Waste tracking slips, collection contracts |
Employees by contract type and gender | B8 — Workforce, general characteristics | Yes | Staff register, social security filings |
Work accidents | B9 — Health and safety | Yes (number and rate) | Accident register and declarations |
Minimum wage, collective agreements, training | B10 — Remuneration, collective bargaining, training | Yes | Payroll, collective agreement, training plan |
Corruption convictions and fines | B11 — Corruption and bribery | No | Statement, litigation register |
Products, markets, main business relationships | C1 — Strategy and business model | Yes | Company presentation |
Staff turnover | C5 — Additional workforce characteristics | Yes | Starters and leavers register |
Code of conduct, human rights, grievance mechanism | C6 — Human rights policies and processes | Yes (code or policy, grievance mechanism) | Signed code, complaints procedure |
Human rights incidents | C7 — Human rights incidents | Yes (confirmed cases) | Grievance register and follow-up |
Sensitive activities: controversial weapons, tobacco, fossil fuels, chemicals | C8 — Revenue from certain sectors | No | Turnover breakdown |
Gender diversity of management | C9 — Gender diversity ratio in the governance body | No | Board or management composition |
Two remarks. Disclosure B3 asks for scope 1 and location-based scope 2 estimates taking into account the GHG Protocol Corporate Standard (2004 version): this is the core of a carbon footprint under ISO 14064-1:2018. And a question beyond the cap is not illegitimate: it may come from the customer's procurement policy, or from a commitment worth making.
What can a customer ask under the EU Taxonomy?
Evidence about what you sell, when the customer presents its purchases as linked to sustainable activities. Article 8 of Regulation (EU) 2020/852 requires companies that publish a sustainability report to disclose the share of their turnover, capital expenditure and operating expenditure associated with environmentally sustainable activities.
Under Article 3, an activity is sustainable if it contributes substantially to an environmental objective, does no significant harm to the others, meets minimum safeguards and complies with the technical screening criteria set by the Commission. A customer buying equipment, a service or a component for an activity it wants to report as aligned may therefore ask you for performance or compliance data. The Taxonomy imposes nothing on you directly; it explains certain precise questions.
Delegated Regulation (EU) 2026/73, applicable since 1 January 2026, simplified these disclosures: a non-financial company no longer has to assess eligibility or alignment for activities below 10% of its turnover, capital expenditure or, under conditions, operating expenditure. It also removed generic criteria on certain hazardous substances whose collection along the supply chain weighed on reporting companies.
How do you answer ESG questionnaires without spending the whole year on them?
By building one documented ESG database aligned with the voluntary standard, and answering from it. In our work with exporters, the problem is rarely the data itself: it is different figures sent to different customers.
- Qualify the request: which customer, which basis (CSRD, procurement, due diligence, lender), which deadline, which level of evidence.
- Check your status: average headcount in the previous financial year against the 10- and 1,000-employee thresholds, and a self-declaration ready to send.
- Start from the common core: the voluntary standard's modules cover most questions; Annex II datapoints first.
- Link each figure to its source: energy invoices, water meters, social security filings, accident register, health and safety committee minutes, waste tracking slips.
- Only declare what is done: separate the written policy, the action under way and the measured result.
- Handle questions beyond the cap one by one: answer, estimate, propose a timetable or refuse with an explanation.
- Keep a record of each answer sent, by customer and date, to stay consistent from one year to the next.
On a supplier sustainability rating platform the logic is the same: it scores evidence, not intentions. Upload the policies and figures from your single data file; an undated policy or a figure without a method is worth very little.
Which other frameworks might a customer use?
A customer outside the EU, or one that also reports under other frameworks, may question you along GRI or IFRS S1 and S2 lines. The data stay the same; only the vocabulary and the breakdown change.
Framework | Who uses it | Status on 11 November 2026 | What it changes for your answers |
|---|---|---|---|
GRI Universal Standards 2021 | Companies reporting under GRI | Applicable; GRI 102 (climate) and GRI 103 (energy), published in 2025, apply to reports from 2027 | Same energy and climate data, different breakdown |
IFRS S1 and IFRS S2 (ISSB) | Listed groups, banks, investors | Issued June 2023; IFRS S2 amendments on GHG emissions issued December 2025, applicable from 2027 | Questions on climate risks and value-chain emissions |
GHG Protocol Corporate Standard | Emissions calculation in almost every questionnaire | Revised edition 2004, under revision (consolidated standard with ISO, publication estimated Q4 2028) | Method for your scope 1 and 2 |
For climate risk and ISSB standards, see climate risk and ISSB. Some ISO standards also provide strong evidence: ISO 14001:2026 (formerly ISO 14001:2015) for environmental data, ISO 45001:2018 for health and safety, ISO 37001:2025 (formerly ISO 37001:2016) for anti-bribery, and ISO 30414:2025 (which replaces ISO 30414:2018) for human capital reporting. See ISO 14001 certification.
Are your ESG answers ready?
Review with management, quality, HR, finance and procurement.
Why work with ACG on your ESG questionnaires?
Because we start from your systems and your evidence, not from a report template. ACG has delivered 502 projects and trained more than 120,000 people; the team brings together 10 in-house consultants and more than 100 qualified external experts. We work with exporters and manufacturers in Morocco, Africa and the Middle East, particularly in food, packaging and industry and energy.
We prepare, calculate, structure and train; we do not certify your data. For climate data, see carbon footprint under ISO 14064; for due diligence requests, supply chain due diligence; for your teams, our training catalogue. The overview is on our ESG and CSR page. To discuss your requests, contact us.