CSRD for SMEs in 2026: what your large customer is asking about your value chain

Your large customer has sent an ESG questionnaire referencing CSRD or ESRS standards. You are not subject to CSRD yourself, but you still need to provide an answer. This article explains why CSRD affects you through the value chain, what a customer can request under the value chain cap rule, and how to respond correctly.

CSRD in brief: what it is and who it applies to in 2026

CSRD, the Corporate Sustainability Reporting Directive, is an EU directive that requires large companies to report on sustainability matters in a standardised format. Reporting follows ESRS standards (European Sustainability Reporting Standards) and is included in the company’s official annual report.

The directive’s original threshold was low and would have applied to approximately 800–1,000 companies in Finland. The Omnibus I reform (Directive (EU) 2026/470, in force 18 March 2026) changed this significantly. The current CSRD threshold is 1,000 employees and a turnover exceeding €450 million. In Finland, this limits the obligation to only the largest domestic groups and Finnish subsidiaries of large international companies.

SMEs are in practice never subject to CSRD in 2026. However, this does not mean the directive has no impact on you.

Practical scale: before Omnibus I, CSRD would have applied to approximately 800–1,000 companies in Finland. At the current threshold, the number is considerably smaller, in practice only the largest Finnish groups and Finnish subsidiaries of international corporations. This means the direct CSRD obligation for SMEs has been removed entirely, but the indirect impact through the value chain has simultaneously increased.

Why CSRD affects you even if you are not subject to it

The most significant indirect impact of CSRD on the SME sector comes through the value chain.

The directive requires CSRD-obligated companies to report not only their own emissions but also material emissions and other sustainability impacts across their value chain. In practice, this means reporting Scope 3 emissions, including emissions from purchased goods and services (Scope 3 Category 1). Large customers therefore need data from their suppliers as well.

This creates a domino effect. When, for example, Stora Enso, KONE, or a large retail chain is subject to CSRD, it begins sending ESG questionnaires to its own suppliers. SME suppliers receive questions that originate from CSRD, even though their own company is not obligated by it.

The same logic applies to financing. CSRD-obligated banks and financiers need data on companies they lend to or invest in. This feeds into lending terms and the questionnaires used in financing processes.

In Finland, concrete examples of large CSRD-obligated companies that may send supplier questionnaires include Stora Enso, KONE, Wärtsilä, Neste, Fortum, the largest retail chains, and many Finnish units of international groups. An SME with one or more such customers benefits from building VSME baseline readiness in advance.

Value chain cap: what limits what a customer can request from you

This is the most important statutory protection for SMEs, and it is worth keeping in mind.

The Omnibus I directive introduces the value chain cap principle and is set to anchor VSME as its substantive basis; VSME’s official status will be finalised as a delegated act. The rule is straightforward: a CSRD-obligated customer may not request more sustainability data from a supplier with fewer than 1,000 employees than what the VSME-based approved standard defines. VSME thus functions in practice as an upper ceiling.

In practice, this means three things. First, if you are a company with fewer than 1,000 employees and you receive a 250-point questionnaire, you are entitled to respond using only the VSME fields. Second, you may invoke the Omnibus I value chain cap rule in the customer relationship if a request exceeds the standard’s limits. Third, the same VSME report responds to multiple different customer requests within the same reporting period, provided all customers respect the cap.

The purpose of the cap is to protect SMEs from an unreasonable reporting burden. The rule does not prevent a customer from requesting additional information on a voluntary basis, but it gives the supplier the right to limit their response to the VSME level.

Typical questions in a customer’s ESG questionnaire

Although customer questionnaires vary, the same core topics recur throughout them. Most can be found in the VSME Basic module.

Emissions: Scope 1 (own fuel use, vehicles, processes), Scope 2 (purchased electricity and heat, both location-based and market-based), key Scope 3 categories (purchased goods and services, business travel, waste).

Energy: total consumption, breakdown by electricity/heat/fuel, share of renewables, use of guarantees of origin.

Personnel: total headcount, employment relationships, gender distribution, occupational health and safety.

Governance: business principles, anti-corruption practices, board composition.

Certifications and other credentials: ISO 14001, ISO 14064, EcoVadis assessment if completed, SBTi commitments.

If the customer questionnaire also mentions climate risks, a transition plan, human rights, or diversity, this constitutes a Comprehensive-level requirement. This distinction is explained in the article VSME Basic vs Comprehensive.

How to respond correctly: the VSME report as a standardised answer

The strategy is straightforward: produce one VSME report and use it to respond to multiple customer requests.

The practical process proceeds as follows. First, identify which of your customers is subject to CSRD and which is requesting data voluntarily or as part of their own banking or investor obligations. This affects whether you can invoke the value chain cap rule.

Second, produce a VSME report covering all mandatory sections. In most cases, Basic is sufficient. Comprehensive is only necessary if your largest customer needs more detailed information for their own ESRS reporting.

Third, deliver the report to the customer in PDF format. Most customers accept the VSME report as-is and complete their own questionnaire based on it. If a customer requests data via their own form, you can transfer the figures from the VSME report onto the form.

Our brand promise: it is commonly assumed that the data is already available. We know it often is not.

What happens if you do not respond: sales risk and falling out of the value chain

Failing to respond is a real risk in 2026, and it is not diminishing. A large customer that is itself subject to CSRD cannot report its material emissions without data from its suppliers. In practice, this leads to three situations.

Tightening procurement terms. A growing number of large Finnish companies are incorporating sustainability data requirements into their procurement terms. A supplier that does not provide VSME-level data may face additional charges, shorter contract periods, or be replaced by an alternative supplier.

Scoring in competitive tenders. Particularly in public procurement and large-company tendering processes, sustainability data is increasingly used as a scoring criterion. Without the data, you will lose out to competitors who have done the work.

Financing conditions tighten. Banks and other financiers are acquiring their own sustainability targets, which feed into corporate financing terms. Without VSME baseline readiness, the cost of financing may rise or conditions may become more stringent.

Responding does not require a large-scale project. Based on NGS experience, a typical SME VSME project is completed in 4–8 weeks and costs €8,000–€25,000.

What is the difference between CSRD, ESRS, and VSME: a brief summary

The terms are easily confused, so it is worth keeping this summary to hand.

CSRD is the directive that determines who must report on sustainability matters. Those directly obligated are companies with more than 1,000 employees and a turnover exceeding €450 million.

ESRS is the technical set of standards that determines how reporting is done. CSRD-obligated companies use ESRS standards in their annual report. EFRAG is responsible for developing the standards. A simplified version, “ESRS 2.0”, is due for completion in summer 2026.

VSME is EFRAG’s voluntary standard for SMEs, submitted to the Commission in December 2024. The Commission issued an official recommendation on the matter in July 2025, and the standard’s final content will be formalised as a delegated act as part of the Omnibus I package. It defines how an SME can respond to sustainability data requests and serves as the basis for the value chain cap ceiling, above which a large customer may not request additional data from a supplier with fewer than 1,000 employees.

Practical rule: if you are an SME, CSRD and ESRS do not obligate you. VSME is the standard you use to respond to value chain data requests.

Frequently asked questions

Is an SME subject to CSRD in 2026?

In practice, no. Following the Omnibus I reform, CSRD applies to companies with more than 1,000 employees and a turnover exceeding €450 million. SMEs fall outside the scope of application.

What does the value chain cap mean in practice?

The value chain cap means that a CSRD-obligated customer may not request more sustainability data from a supplier with fewer than 1,000 employees than what is defined in the VSME standard. The rule is set out in the Omnibus I reform.

What is the difference between CSRD and ESRS?

CSRD is an EU directive that determines who must report. ESRS is a technical set of standards that determines how reporting is done. Without ESRS, CSRD is merely a law without a form.

What does double materiality mean in CSRD?

Double materiality means that a company assesses both the impacts of its operations on the environment and society (impact materiality) and the impacts of sustainability matters on the company’s finances (financial materiality). Further information in the article Double Materiality Assessment for SMEs.

Can an SME become subject to CSRD voluntarily?

Yes. A company may report in CSRD/ESRS format voluntarily, and this is sensible if there are plans for a listing, growth beyond the threshold, or a significant international investor base. For most SMEs, VSME is clearly the lighter option.

Is a CSRD report the same as the sustainability section of an annual report?

CSRD reporting is part of the official annual report and follows the ESRS structure. Previous voluntary sustainability reports (e.g., GRI-based) do not meet CSRD requirements, even though they often resemble them.

Did you receive an ESG questionnaire from a customer?

Send it to us and we will tell you which sections require a VSME report and which can be answered briefly.

Book a 30-minute scoping call · Explore our VSME service