In short
- No assurance. Recital 16 of the Recommendation says a self-declaration by the SME is sufficient.
- No certificate, no certifying body and no obligation to report at all.
- A report does not let you refuse everything. The ceiling covers reporting requests only.
Seven things get attributed to VSME that it does not ask for. It does not require assurance: the Commission Recommendation that carries it says in terms that a self-declaration by the SME is sufficient. It does not require a certificate, because there is no certification body. It does not require the comprehensive module. It does not require you to report at all. And a report does not entitle you to refuse every sustainability question you receive, which is the most commercially expensive of these misunderstandings.
Each of these is being sold to SMEs by somebody. Two of them are being sold with a price attached.
Which of these does it actually require?
The short version, before the detail.
| The claim | What is actually the case |
|---|---|
| It requires third-party assurance | No. Recital 16 of Commission Recommendation (EU) 2025/1710 says a self-declaration by the SME is sufficient |
| It requires certification | No. It is a reporting standard, not a certification scheme. There is no certificate to hold |
| It obliges you to report | No. A recommendation under Article 292 TFEU has no binding force |
| It requires the comprehensive module | No. The basic module is a prerequisite for the comprehensive one, not the reverse |
| It requires all fifteen scope 3 categories | No. That is not even the ESRS rule, which asks for each significant category |
| It is an EU regulation or a Commission standard | No. It is an EFRAG standard carried by a non-binding recommendation |
| A report lets you decline any sustainability question | No. The ceiling covers reporting requests only |
The rest of this page is why each of those answers is what it is.
Does VSME require assurance?
No, and the text is unusually direct about it.
Recital 16 of Commission Recommendation (EU) 2025/1710 confirms that there is no obligation to provide assurance on the information reported by non-listed SMEs and that a self-declaration by the SME is sufficient. That is the whole rule.
The contrast with the mandatory regime is instructive. CSRD reporting carries a limited assurance opinion under Article 34(1), second subparagraph, point (aa) of Directive 2013/34/EU. There is no equivalent anywhere in the voluntary track. So if a customer tells you your voluntary report must be independently verified, they are making a contractual demand, not relaying a rule. That is a legitimate thing for them to want and a negotiable thing for you to price. It is not compliance.
Worth noting what this does not license. Self-declared does not mean unevidenced. The number still has to be reproducible, because the next person to look at it will be a customer with an incentive to check.
Is there a VSME certificate?
No. There is no certifying body, no accreditation, no audit and nothing to hang on a wall.
This one matters because the Dutch market has a genuine certification scheme sitting next to it, and the two get blended. The CO2-Prestatieladder is audited by an accredited certifying body and produces a certificate that buyers award points for. A voluntary sustainability report produces a document you publish or hand over. Different transactions, different costs, different value.
If someone offers to certify you against VSME, they are offering you their own product under a borrowed name.
Does it oblige you to report at all?
No. Nothing obliges you.
The standard was developed by EFRAG at the Commission's request and delivered in December 2024. Its only status in EU law today is a recommendation, which binds nobody, and whose own recital 15 describes it as an intermediary solution until a voluntary standard is adopted by delegated act.
What changed in February 2026 is not that reporting became compulsory. It is that the voluntary standard became the measuring stick for a statutory ceiling. Directive (EU) 2026/470 gave undertakings under an average of 1,000 employees in a reporter's value chain the right to decline information exceeding the voluntary standard, and made contrary contract clauses non-binding. That makes the standard useful. It does not make it mandatory. The VSME standard sets out the mechanics.
Does it require the comprehensive module?
No, and the direction of the dependency is the opposite of what people assume.
The standard has a basic module and a comprehensive module, and reporting the basic module is a prerequisite for the comprehensive one. So the basic module is the floor and the comprehensive module is an option on top of it. Starting with the comprehensive module is not possible, and starting with the basic one is not a partial effort.
Who genuinely needs the extra depth is a commercial question rather than a compliance one, and for most suppliers the honest answer is nobody yet.
Does a report let you decline any sustainability question?
No, and this is the misreading that costs accounts.
The ceiling bites only on information gathering for the purpose of sustainability reporting under the Accounting Directive. Recital 12 of Directive (EU) 2026/470 sets out three limits on it. It does not stop voluntary sharing. It does not override an existing contractual or legal obligation to provide information within the standard. And it does not reach due diligence requests, risk management requests, or a customer's own procurement questions.
So a supplier due diligence questionnaire is untouched. A tender question carrying a score is untouched. An invitation to a rating platform is untouched: EcoVadis is a paid commercial rating, always solicited, and a company can always refuse it, but refusing is a commercial act with commercial consequences rather than the exercise of a right. Read on 28 August 2026 from the published methodology disclosure.
Invoking the ceiling against a request it does not cover is worse than not invoking it, because it tells a sophisticated counterparty that you have read a summary. We cover the wording that works in which ESG questions you can refuse.
What can nobody honestly tell you yet?
The final datapoint list, and anyone publishing one is describing an act that is not law.
Article 29ca of Directive 2013/34/EU requires the Commission to establish standards for voluntary use by delegated act, based on Commission Recommendation (EU) 2025/1710 in its original version. The Commission adopted C(2026) 5011 on 3 July 2026, and its Article 4 provides that Article 3 applies from financial years beginning on or after 1 January 2027. On 28 August 2026 it was still in Parliament and Council scrutiny, and an adopted act in scrutiny is not in force.
The same applies on the mandatory side. C(2026) 5010, the revised and simplified ESRS, was adopted on the same day and was in the same position. The standards in force were still Delegated Regulation (EU) 2023/2772 as amended by (EU) 2025/1416. If you read a figure for how many datapoints the revision removes, it comes from an explanatory memorandum to an act that is not yet law.
None of that is a reason to wait. The delegated act has to be based on the recommended version, so building to that version now is not a bet.
What does it actually take, then?
Less than the market implies, and the effort is concentrated in one place.
The emissions figure is the part that needs a calculation and the part every customer presses on. Everything else in a report of this kind is description of things you already do. So the sequence is: fix the boundary, gather the activity data, produce the number, write the rest around it, and hand the same document to everyone who asks.
VSME consulting is the shorter route for the non-emissions half. The emissions half you can start yourself on a free account with no sales call. The platform serves 5,000+ users, covers more than 20,000 spend-based and activity-based factors and lets you substitute supplier-specific data where you have it. If you are still choosing, our SME software comparison is the version without a sales pitch in it.
One limit worth knowing if your plan is to reuse one report across many customers. Hedgehog itself says it has few integrations with other software today, and a Mid-Market reviewer on G2 asked for more in June 2026. Where each customer wants its own portal filled in, expect that step to stay a manual copy for now.
Sources: Commission Recommendation (EU) 2025/1710 recitals 15 and 16 and Annex I, Directive (EU) 2026/470 including new Article 29ca and recital 12, Directive 2013/34/EU Article 34(1), Commission Delegated Regulations C(2026) 5010 and C(2026) 5011 as adopted and not in force, Delegated Regulation (EU) 2023/2772, EcoVadis Sustainability Rating methodology disclosure. Re-verified against the fact base 17 September 2026; underlying regulatory research dated 28 August 2026.
Facts on this page were last verified on 2026-09-17.
