Under recent EU legislative updates, including the Omnibus I Directive adopted in February 2026, the direct reporting burden for the Corporate Sustainability Reporting Directive (CSRD) was recalibrated, and thousands of mid-sized manufacturers, distributors and service providers fell outside the mandatory direct reporting scope.
While this news may spark joy for the leaders of these mid-sized companies, they should proceed with caution. Escaping direct regulatory scope does not mean escaping sustainability reporting altogether. It does mean a new limit applies. For mid-sized manufacturers, the CSRD value chain cap sets a legal ceiling on how much sustainability data your EU customers can require from you.
If you supply goods or services to large EU corporations or global multinationals with significant European footprints, you are a part of their emissions inventory that they have to disclose. To fulfill their mandatory European Sustainability Reporting Standards (ESRS) disclosures, your corporate buyers need data from you.
That request usually arrives as a supplier sustainability questionnaire. At a mid-sized manufacturer it rarely lands on a sustainability team, because there isn’t one. It lands on a finance lead, a plant controller or an operations director with a deadline and no obvious place to start.
To reduce reporting burdens for small and mid-sized companies, the EU built limits into the same legislation, a legal framework that establishes what your customers can legally demand for their CSRD compliance needs, what sits outside those boundaries and where your statutory rights begin. This so-called “CSRD value chain cap” is anchored by a new voluntary reporting standard, and it applies to financial years beginning on or after Jan. 1, 2027.
Understanding these dynamics is essential for managing CSRD supplier data requests, protecting your time and operational resources and maintaining solid supplier relationships.
What is the CSRD value chain cap?
When the original ESRS guidelines were published in July 2023, large corporate enterprises faced more than 1,000 potential datapoints. To complete their disclosures, many simply passed complex custom questionnaires down their supply chains, burdening out-of-scope suppliers who lacked dedicated sustainability teams.
The CSRD value chain cap is designed to stop this trickle-down effect. Directive (EU) 2026/470 inserted a new Article 29ca into the EU Accounting Directive: a company reporting under the CSRD cannot compel a non-reporting supplier in its value chain to provide sustainability data beyond the datapoints designated in the new Voluntary Standard. For suppliers meeting the definition of a “protected undertaking,” the designated datapoints in this voluntary standard serve as the legal ceiling for mandatory CSRD requests.
A large CSRD-in-scope enterprise is “deemed to have complied” with its value chain disclosure requirements if it respects the value chain cap.
So if a supplier declines to provide data exceeding the cap, or provides only standard-level data, the customer is legally permitted to use industry averages, sector proxies and secondary estimations to fill the remaining gaps in its Scope 3 reporting.
To operationalize the value chain cap, the Commission adopted a delegated regulation on July 3, 2026 establishing the Voluntary Standard, built on the Voluntary Sustainability Reporting Standard for Non-Listed SMEs (VSME) that EFRAG (the European Financial Reporting Advisory Group) developed for non-listed SMEs. The two names are used interchangeably in practice.
What CSRD data can your customer require?
The Voluntary Standard is structured in two modules, and the Basic Module is a prerequisite for the second.
- Basic Module (B1 through B11). Fundamental quantitative indicators most operating businesses can already measure: energy consumption, Scope 1 direct emissions, Scope 2 emissions, pollution, water, waste and resource use, workforce headcount, health and safety, remuneration and training, and convictions and fines for corruption and bribery.
- Comprehensive Module (C1 through C9). Additional disclosures aimed at investors, banks and corporate customers: business model and strategy, sustainability policies and initiatives, GHG reduction targets and climate transition, climate risks, additional workforce and human rights disclosures, revenues from certain activities, and gender diversity on the governance body.
One nuance matters here, and it cuts both ways. The cap is not the whole standard, and it is not the Basic Module alone. It covers the datapoints the delegated regulation designates as essential, and those are drawn from both modules. So a request that reaches into the Comprehensive Module is not automatically over the line, and a request that stays inside the Basic Module is not automatically the most a customer can ask for. Check the request against the designated datapoint list, not against the module label.
The Supplier’s Right to Decline: How It Works in Practice
But what happens when a corporate customer sends an exhaustive sustainability audit that clearly exceeds the cap?
Under the value chain rules, your customer is technically allowed to ask for data beyond the cap. However, to do so legally, they must adhere to strict procedural rules:
- The customer must explicitly identify and flag every datapoint in their questionnaire that exceeds the datapoints covered by the cap.
- The customer must inform the supplier that it holds a statutory right to decline any flagged item.
- The customer must limit its request to information it genuinely needs, and for the smallest partners, to information it cannot reasonably obtain by other means.
How to Respond to an Overreach Request
The cap applies to financial years beginning on or after Jan. 1, 2027, and the right to decline takes effect through each member state’s transposing legislation. Confirm both, and have counsel adapt the wording.
Once the cap is live, if a customer submits an unflagged, overreaching data request, you can respond with language along these lines:
“As a protected undertaking under the EU value chain cap, our reporting aligns with the Voluntary Standard. The additional datapoints requested in [list the specific sections] fall outside the datapoints covered by the cap. Under Article 29ca of the Accounting Directive, as introduced by Directive (EU) 2026/470 and transposed in [member state], we respectfully decline these specific extended disclosures. Our complete Voluntary Standard dataset is attached.”
Because your customer enjoys “deemed compliance” protections, they can accept your Voluntary Standard dataset, apply a sector proxy for the rest and complete their audit without regulatory conflict.
The gap: Manufacturers over 1,000 employees with moderate revenue
While the value chain cap was designed as a protective mechanism, a critical statutory mismatch exists between direct CSRD scope definitions and the definition of a “protected undertaking” under value chain cap rules.
Under Omnibus regulatory reforms, direct mandatory CSRD scope for large undertakings requires meeting dual cumulative thresholds:
- More than 1,000 employees, and
- Net turnover exceeding €450 million.
Protection under the value chain cap is evaluated on a single criterion:
- An average of 1,000 employees or fewer over the preceding financial year, regardless of sales.
What about a mid-sized industrial manufacturer with 1,200 employees and €200 million in annual sales?
This scenario creates an unintended structural gap:
- Because the manufacturer’s sales (€200 million) is well below the €450 million cumulative threshold, the company is out of direct CSRD reporting scope. It does not file a direct ESRS sustainability report.
- Because its headcount (1,200) exceeds the 1,000-employee ceiling, the company is not legally classified as a protected undertaking under the value chain cap.
If a corporate customer requests exhaustive, granular ESRS datapoints from a 1,200-employee, €200 million-sales manufacturer, the supplier cannot invoke the statutory right to decline. The customer is not legally restricted by the Voluntary Standard ceiling for this supplier. Mid-sized enterprises with labor-intensive models that exceed 1,000 employees while retaining moderate revenue therefore fall into a regulatory middle ground: exempt from direct filing, yet unprotected from extensive enterprise customer data demands.
Turn Compliance into a Market Advantage
The introduction of the CSRD value chain cap establishes clearer boundary lines for corporate sustainability disclosures. By replacing unregulated, custom supply chain questionnaires with the standardized Voluntary Standard framework, EU regulators have provided out-of-scope businesses with a manageable, predictable roadmap.
Being out of CSRD scope does not mean sitting idle. Corporate buyers are under pressure to clean up their Scope 3 emissions footprints. A supplier that provides clear, accurate, pre-verified Voluntary Standard data on day one eliminates friction for their customers’ reporting teams.
See it from the other side: La-Z-Boy Incorporated tracks Scope 1, 2 and 3 emissions across almost 200 manufacturing, distribution and retail sites in North America, and collects Scope 3 data from its own suppliers to do it. Read the La-Z-Boy case study.
Know what the cap does not do. It limits what a customer can require for its CSRD disclosures. It does not rewrite a supply agreement you have already signed, and it does not reach requests driven by other regimes or by ordinary commercial leverage. You can be entirely within your rights to decline and still lose the account. The cap gives you a defensible floor to negotiate from. It does not give you cover to go quiet.
By mastering the rules of the value chain cap — knowing what your customers can legally require, exercising your legal right to decline unnecessary burdens and preparing core metrics early — you protect your operational margins without risking your standing as a preferred supply chain partner.