Not by law if your company has 1,000 employees or fewer: from financial year 2027 the CSRD only applies to companies above both €450 million turnover and 1,000 employees. Customers, banks and tenders still ask, so the practical answer is one voluntary report you can send to all of them.
The short answer
For almost every company with 1,000 employees or fewer, EU law does not require a sustainability report. The Omnibus I Directive, Directive (EU) 2026/470, was adopted on 24 February 2026 and entered into force on 18 March 2026. It limits mandatory reporting under the CSRD to undertakings that exceed both a net turnover of €450 million and an average of 1,000 employees in the financial year.
Both thresholds, not either. A company with 1,200 employees and €300 million turnover is out of scope, and so is a company with 400 employees and €600 million. Listed SMEs are out of scope as well. The new scope applies to financial years starting on or after 1 January 2027. Member states have until 19 March 2027 to bring the change into national law, so check your own country’s rules for the 2025 and 2026 financial years.
Why you are still being asked
The legal duty sits with large companies, but the questions reach everyone. A customer inside the CSRD has to report on its value chain. A customer outside it may still ask because its procurement policy says so. Banks assess climate and environmental risk under their own supervisory rules, and insurers and public tenders set their own requirements. None of these depend on the CSRD thresholds.
So the honest answer to “do we have to report?” is usually: not by law, but in practice someone will ask. The useful question is how to answer once instead of filling in a different questionnaire for every customer, bank and tender.
The value chain cap limits what a reporting customer may ask
On 3 July 2026 the Commission adopted a delegated act on the voluntary standard that also gives effect to the value chain cap. It protects companies in a reporting company’s value chain with no more than 1,000 employees. A reporting company may not require more information from them than the voluntary standard covers, and a protected company may refuse requests that go beyond it. A customer that asks for more must say which extra information it is asking for and that you may decline.
The cap is narrower than it sounds. It covers information collected for sustainability reporting under the Accounting Directive. It does not override a contract you signed, other national or EU law, or a bank’s own risk assessment. For value chain reporting it applies from financial year 2027, and the act enters into force only after publication in the Official Journal. Check the final text before relying on a right to refuse.
What to do instead: one voluntary report
The voluntary standard, known until now as VSME, was written for exactly this situation. Companies with up to 1,000 employees may use it. Its Basic module has eleven disclosures, from energy and emissions to workforce and business conduct, and the optional Comprehensive module adds nine more. For a company with ten employees or fewer, some of the harder environmental disclosures are voluntary.
Prepare it once, keep the evidence beside each figure and send the same report to every customer, bank or tender that asks. In Greener Ahead the VSME report is €995 per year with unlimited users, and you can try it free for 14 days without a card. Check the pricing page for current details.
Which rules apply to which request
Before answering, write down who is asking and why. The same question means something different coming from a customer that reports under the CSRD, a customer that does not, a bank or a tender. The table summarises the general position under EU law; national rules, contracts and sector rules can add to it.
| Who asks | Does the value chain cap apply? | What to send |
|---|---|---|
| A customer that reports under the CSRD | Yes, from financial year 2027 | Your voluntary report; questions beyond it may be declined |
| A customer outside the CSRD | No, there is no reporting duty to pass on | Your voluntary report usually covers most of it |
| A bank or lender | No, banks follow their own rules | Your voluntary report plus any loan-specific figures |
| A public or private tender | No, the tender documents decide | What the tender asks, often a footprint or report |
| Your own company, above both thresholds | Not applicable | A full report under the ESRS |
Questions to settle before you answer
A short check prevents most of the back-and-forth. Ask the requester for anything you cannot answer from the request itself, and keep their reply with the register.
- Who is asking, and is the information for its CSRD reporting or another purpose?
- Which entity, sites and financial year does the request cover?
- Is there a contract clause that already obliges you to provide sustainability information?
- Does a voluntary report cover the request, and which questions go beyond it?
- What format and deadline does the requester need?
Dates worth writing down
Adoption, entry into force and application are different moments. Keep them apart when you read a request or explain your answer.
| Date | What happened |
|---|---|
| 24 February 2026 | Omnibus I Directive (EU) 2026/470 adopted |
| 18 March 2026 | Omnibus I enters into force |
| 3 July 2026 | Commission adopts the delegated acts on the voluntary standard, the value chain cap and the simplified ESRS |
| 1 January 2027 | New CSRD scope and the value chain cap apply to financial years starting on or after this date |
| 19 March 2027 | Deadline for member states to bring Omnibus I into national law |
Sources and scope
- Directive (EU) 2026/470 (Omnibus I), EUR-Lex
- Commission: July 2026 voluntary-standard delegated act
- European Commission: 2025 VSME recommendation and standard
These resources explain a preparation workflow. Check your selected standard and recipient requirements before sharing your report.
Joost ThissenFounder
