In short
- The cap is now a right you hold, and a contract clause that overrides it is not binding.
- It covers CSRD reporting requests only, not due diligence or ordinary procurement.
- Your customer has a duty to tell you which requests exceed the standard. Ask them to.
A customer collecting data for its own sustainability report may not require more from you than the voluntary standard specifies, provided you average no more than 1,000 employees and sit in its value chain. That stopped being a guideline in February 2026. Directive (EU) 2026/470 wrote it into Articles 19a(3) and 29a(3) of the Accounting Directive as a right you hold, backed by a rule that any contractual provision to the contrary is not binding. Most suppliers do not know they have it, and most questionnaires are written as though it does not exist.
What exactly changed in February 2026?
The direction of the rule reversed.
Under the original CSRD the cap constrained the standards. The European Sustainability Reporting Standards could not specify disclosures that would require a reporting company to obtain more from SMEs in its chain than the listed-SME standard contained. It was a drafting instruction to EFRAG and the Commission. You could not invoke it, because it was not addressed to you.
Directive (EU) 2026/470 turned it into a right held by the supplier and a prohibition on the customer. Protected undertakings now have the right to decline to provide information exceeding the information specified in the voluntary standards, in response to a request made for the purpose of sustainability reporting as required by the Directive. Reporting undertakings shall not require protected undertakings to provide such information. And any contractual provision contrary to that prohibition is not binding.
That last clause is the sharpest one. A supplier agreement signed in 2024 that commits you to "provide all sustainability data reasonably requested" does not survive contact with it, to the extent the request is a reporting request exceeding the standard.
Are you a protected undertaking?
Two conditions, and they are narrower than the CSRD scope test, so check both.
You must not exceed, on your balance sheet date, an average number of 1,000 employees during the preceding financial year. And you must be in the value chain of a reporting undertaking.
Note what is absent. There is no turnover limb. A company with EUR 600 million of turnover and 400 employees is a protected undertaking. A company with EUR 40 million of turnover and 1,200 employees is not, even though it is comfortably out of CSRD scope itself. If you are unsure which side of these lines you fall on, what VSME covers sets out the surrounding regime.
There is also a helpful piece of administrative plumbing. A reporting undertaking may rely on a self-declaration of size and does not have to verify it, unless it knows the declaration is manifestly incorrect. In practice that means the burden on you is a sentence, not a certificate. Put your headcount in writing early, once, and you have established the fact the whole mechanism runs on.
Which requests does the right actually cover?
This is where most commentary overreaches, so be precise. The cap applies only to information gathering for the purpose of sustainability reporting under the Accounting Directive. It does not restrict due diligence requests, risk management requests or ordinary commercial questions.
Triage every request against that single question first: what is this data for?
| The request | Purpose | Does the cap bite? |
|---|---|---|
| A questionnaire feeding your customer's ESRS value chain disclosures | Sustainability reporting under the Directive | Yes, above the voluntary standard |
| Emissions data your customer needs for its own scope 3 category | Sustainability reporting under the Directive | Yes, above the voluntary standard |
| Supply chain due diligence screening | Due diligence | No |
| A risk assessment before a supplier is onboarded | Risk management | No |
| A tender question scored as part of an award decision | Ordinary commercial | No |
| A customer asking because it wants to know | Ordinary commercial | No |
Two more limits worth stating so you do not overplay the hand. The cap does not stop voluntary sharing, so you can always give more if you want to. And it does not override an existing contractual or legal obligation to provide information that is within the voluntary standard. Only the excess above the standard is protected, and only where the purpose is reporting.
What does your customer have to tell you?
This is the least known part of the provision, and it is the one that makes the conversation easy.
Where a reporting undertaking does request information exceeding the voluntary standard, it must ensure that protected undertakings are informed of which information exceeds the standard and of the protected undertakings' statutory right to decline to provide it.
So the duty to draw the line sits with the party asking, not the party answering. You do not have to argue disclosure by disclosure about what the standard contains. You can ask them to tell you, which is a request for compliance with their own obligation rather than a refusal of yours.
That single move changes the tone of the exchange completely. It is not "we will not answer this". It is "please mark which items exceed the voluntary standard, as required".
How do you say no without losing the account?
Four sentences, in this order, cover almost every case.
Lead with what you are providing. "Here is our report, covering emissions, energy, workforce and governance." Starting from a substantive answer is a different conversation from starting with a refusal.
Name the purpose test. "Can you confirm whether this request is for your sustainability reporting under the Accounting Directive, or for due diligence or procurement?" This is not obstruction. It is the question that determines which rules apply, and a competent counterparty will know the answer.
Ask them to mark the excess. "If any items exceed the voluntary standard, please indicate which, as the Directive requires." Now the line is drawn by the person with the duty to draw it.
Offer a priced route for what genuinely matters. "If facility-level detail is essential to you, we can scope it as a project." Some customers will pay. Most will discover it was optional.
What to avoid: quoting the directive at a procurement officer as though it were a threat, and refusing anything before you have provided something. A supplier with a real report and a firm line is credible. A supplier with no numbers invoking a statutory right is just saying no in a longer way. The commercial craft of this is covered further in which ESG questions you can refuse.
When can you actually rely on it?
Honestly, later than the excitement suggests, and this is the qualification most coverage omits.
CSRD is a directive, so the right reaches you through national law, and Member States must transpose Articles 1, 2 and 3 of Directive (EU) 2026/470 by 19 March 2027. The delegated act that fixes what the voluntary standard contains, C(2026) 5011, was adopted on 3 July 2026 and was still in Parliament and Council scrutiny on 28 August 2026, with its Article 3 written to apply from financial years beginning on or after 1 January 2027.
So the architecture is settled and the ceiling's exact height is not yet fixed in law. Until it is, the practical position is the one it has always been: report to the standard, hand the same document to everyone, and negotiate the excess.
What do you need in place to use any of this?
A report with real numbers, and the emissions figure above all, because that is the disclosure every customer presses on.
The Hedgehog platform covers the GHG Protocol side of that with an AI guide for setup, human GHG experts reachable in-app, more than 20,000 spend-based and activity-based factors, and the ability to add your own supplier-specific data. It serves 5,000+ users, the free account needs no sales call, and Pro starts at EUR 1,200 per year.
One honest limit relevant to reusing a report across many customers: a Mid-Market reviewer on G2 said in June 2026 that they would like to see more integrations with other software. If your customers each want their own portal populated, expect that step to stay manual for now.
For the parts of a report that are not emissions, VSME consulting is the shorter route, and if a specific questionnaire is on your desk this week, book a call and we will read it with you.
Sources: Directive (EU) 2026/470 Articles 19a(3) and 29a(3) and recital 12, Directive 2013/34/EU, Commission Recommendation (EU) 2025/1710, Commission Delegated Regulation C(2026) 5011 as adopted and not in force. Verified against the Official Journal text on 28 August 2026. Hedgehog facts read on 27 August 2026. Page verified 17 September 2026.
Facts on this page were last verified on 2026-09-17.
