Can my SME refuse ESG data requests from large clients?

The value-chain cap in short

• Applies to you if you have fewer than 1,000 employees and sit in the value chain of a CSRD-reporting company
• A client subject to the CSRD cannot require more than the VSME covers
• The VSME (Voluntary SME Standard) sets that ceiling
• You keep the right to report more voluntarily if you choose to
• Endorsed by Commission Recommendation (EU) 2025/4984 (July 2025)

The VSME is proportionate: two modules (Basic and Comprehensive), no mandatory double materiality assessment, no required external assurance — and it is fully compatible with the ESRS if you later grow into scope.

What it changes for you

• A 400-question ESG questionnaire from a large customer must stop at the VSME. That is your shield against excessive requests.
• It is also a floor: if a client asks for VSME-level data and you cannot answer, the problem lands back on you. Being able to produce the VSME is becoming a commercial requirement.
• Banks and investors are converging on the same template — reporting VSME can improve your access to finance.

The timeline

• 30 July 2025 — Commission Recommendation (EU) 2025/4984 endorses the VSME.
• 18 March 2026 — Omnibus I (Directive (EU) 2026/470) enshrines the value-chain cap.
• Mid-2026 — The Commission adopts a delegated-act voluntary standard based on the VSME.
• 2026–2027 — Large clients begin basing supplier requests on the VSME; it becomes the de facto standard.

What to do now

1. Ask your three largest customers what ESG data they will request — get ahead of the questionnaire.
2. Structure the data you already hold: energy use, fleet fuel, waste, headcount, training.
3. Prepare a Basic-module VSME response; move to Comprehensive only if clients or lenders need it.
4. If a request exceeds the VSME, you can decline in writing, citing the value-chain cap.