The VSME Value Chain Cap: What It Means When a Customer Sends You an ESG Questionnaire

Your customer's sustainability team sends over a spreadsheet: forty tabs, references to GRI, SASB, half a dozen custom KPIs, and a deadline in three weeks. Somewhere in your head is the question nobody quite answers for you: do you actually have to fill all of this in? Since the Omnibus I Directive amended the EU's Accounting Directive, the answer for a lot of SMEs is no — and the mechanism that makes that true is called the value chain cap.

This article explains exactly what the value chain cap is, whether you count as a protected undertaking, and — the part most explainers skip — the specific gaps where your customer can still legitimately ask for more. If you want the underlying checklist of what's actually inside the cap, that's covered data point by data point in our guide to the VSME Basic Module’s 46 data points.

What Is the Value Chain Cap?

The value chain cap is a legal ceiling on how much sustainability data a company in scope of CSRD is allowed to demand from smaller counterparties in its value chain. It was introduced through the Omnibus I Directive, which entered into force on 18 March 2026 and, among other changes, raised the CSRD reporting threshold to undertakings with net turnover above €450 million and more than 1,000 employees on average. Alongside that narrower scope, the same reform capped what those large, CSRD-obligated companies can request from the smaller businesses that supply or work with them.

The cap itself was operationalised through a European Commission delegated act (C(2026) 5011, adopted 3 July 2026), which turns the VSME standard into the reference ceiling for value-chain sustainability data requests. It becomes mandatory for the value-chain reporting of CSRD-obligated undertakings from financial year 2027 onward. In plain terms: a CSRD-obligated customer can no longer legally require a smaller supplier to complete a bespoke questionnaire that goes beyond what the VSME standard already asks for.

One caveat worth stating plainly: this is a regulatory mechanism still bedding in, and the practical details below reflect the rules as adopted. If a specific request from a customer is high-value or contested, get it confirmed by your own counsel rather than relying on this article as legal advice.

Are You a "Protected Undertaking"?

The official term for the company on the receiving end of the cap's protection is a protected undertaking: any undertaking with 1,000 or fewer employees on average, regardless of whether it's listed, and regardless of whether it falls under any EU sustainability reporting law itself. In practice, that covers essentially every SME, most mid-caps, and plenty of companies that would once have worried about CSRD applying to them directly under the old 250-employee threshold.

There's an extra layer of relief for the smallest end of that range: micro-undertakings with ten or fewer employees get additional leeway, with several environmental disclosures treated as voluntary rather than something a customer can require of them at all.

What Data Can My Customer Actually Request?

The ceiling is defined by the VSME standard itself, and specifically by the disclosures it marks as “necessary.” That includes the disclosures marked necessary across both the Basic Module (B1–B11) and the Comprehensive Module (C1–C9) — but not the items the standard tags as “voluntary” or “necessary if applicable.” A customer can request the mandatory core; they can't require you to complete every optional or conditional field just because it exists in the standard.

For most protected undertakings, the practical starting point is the Basic Module, since it’s the part almost every counterparty ends up asking about — energy and emissions, workforce data, pay, health and safety, and a handful of governance and general-information items. We’ve mapped all 46 of those data points individually in our VSME Basic Module guide, which doubles as a working checklist for exactly what a customer is entitled to ask you for under the capped Basic Module disclosures.

What Falls Outside the Cap: the Gaps Worth Knowing About

The cap is not a blanket shield against every sustainability question a customer could ever send you. It's a limit on one specific channel — CSRD-driven value-chain requests — and several categories of information sit outside that channel entirely:

• Climate targets and climate risk — disclosures C3 (GHG reduction targets) and C4 (climate risks) in the Comprehensive Module are explicitly carved out of the cap, so a customer can still ask for detail beyond your basic Scope 1 and 2 figures.
• Scope 3 emissions — treated as sector-specific information sitting above the cap, meaning bespoke Scope 3 questionnaires from customers building their own value-chain inventory can continue.
• Obligations under other EU or national law — the cap only limits CSRD sustainability-reporting requests. Due diligence laws such as the EU’s CSDDD or national equivalents (like Germany’s Supply Chain Act), EU Taxonomy alignment data, and prudential banking requirements (for example EBA Pillar 3 disclosures) sit entirely outside the cap and can generate their own, separate requests.
• Information customarily exchanged within a sector — so-called sector practice data can also fall outside the cap’s protection, depending on the industry.
• Purely commercial or contractual requests — anything a customer asks for as part of ordinary procurement terms, rather than as CSRD sustainability reporting, isn’t governed by the cap at all.

So “capped” doesn't mean “nothing else can ever be asked of you.” It means the specific CSRD sustainability-reporting channel has a hard ceiling, while several adjacent channels — climate targets, Scope 3, due diligence law, banking regulation, sector custom — don't.

How to Respond to an ESG Questionnaire That Goes Beyond the Cap

When a questionnaire lands that looks bigger than the VSME standard, it helps to work through it in a fixed order rather than answering line by line as it arrives:

• 1. Confirm your customer is actually CSRD-obligated and that the request is framed as CSRD sustainability reporting — the cap only binds companies acting under that specific obligation, not every counterparty that happens to send a questionnaire.
• 2. Confirm you qualify as a protected undertaking — 1,000 or fewer employees on average, with extra relief if you're at ten or fewer.
• 3. Map each question against the VSME “necessary” items, starting with the Basic Module checklist — anything that matches is fair game, and the fastest response is simply to answer it in VSME format.
• 4. Flag anything that falls in the named carve-outs — climate targets and risk, Scope 3, Taxonomy, due diligence law, sector-customary data — and decide deliberately how much detail to provide, rather than assuming it's automatically out of bounds.
• 5. For anything left over — voluntary or conditional VSME items with no other legal basis behind the request — you can point to the cap and offer the VSME-aligned answer instead, or explain briefly why the item doesn't apply to you.

If you want the fuller playbook for triaging and prioritising a customer sustainability request beyond just the legal boundaries, our guide to responding when customers demand supplier sustainability data walks through that process end to end, and our earlier introduction to the VSME standard covers how VSME fits alongside CSRD if you need that context first.

Why Reporting VSME Proactively Is Still Your Best Move

Here's the practical upshot: because the ceiling on what a CSRD customer can require from you is defined by the VSME standard, having a VSME report ready in advance closes the large majority of any questionnaire before it even arrives. Rather than triaging forty tabs against a legal cap after the fact, most protected undertakings are better served by producing the VSME Basic Module report once and reusing it — see the full 46-data-point checklist for exactly what that report needs to contain, and treat anything a customer asks beyond it as one of the specific, named exceptions above rather than an open-ended request.

For background on why VSME is the standard being used as the cap’s reference point in the first place, our guide to VSME as the standard you can be asked for outside CSRD scope covers that history. Sustainly’s VSME workflow is built to produce exactly that report — guided, exportable, and ready the next time a questionnaire like this lands in your inbox.

Not sure if CSRD still applies to you at all? Post-Omnibus: Who Still Has to Report Under CSRD in 2027 (and Who Just Got a Customer Instead of a Regulator) walks through the new 2027 scope thresholds and what changes if you fall out of them.