In short
- Identify the request by its purpose, not by the regulation it name-drops. Purpose is what decides your position.
- Only a request made for the customer's own sustainability reporting carries a statutory ceiling, and only if you average 1,000 employees or fewer.
- Due diligence, tenders and rating invitations are commercial. You can decline them, but nothing in law backs you up.
Read the request, not the regulation it cites. Four different things send a carbon questionnaire to a supplier, and only one of them comes with a statutory ceiling on what can be demanded. Work out which one you are holding by asking a single question: what is this data for? Your customer's own sustainability report, its due diligence file, a tender score, or a rating subscription it has bought. Everything you can and cannot do next follows from that answer.
Most supplier guidance skips this step and goes straight to the answering. That gets the order backwards, because two identical spreadsheets can carry completely different authority depending on which desk they came from.
How do you identify the origin in under a minute?
Look for the purpose, then for the sender, then for the deadline. In that order.
Purpose is usually stated somewhere in the covering email, and it is the only thing that matters legally. Phrases like "our sustainability statement", "our value chain disclosures" or a reference to the Accounting Directive point at your customer's own reporting duty. Phrases like screening, onboarding, risk or code of conduct compliance point at due diligence. A score, a weighting or a fictitious discount points at procurement.
Sender is the corroborating evidence. A sustainability or finance team is usually reporting. A procurement or supplier quality team is usually screening or scoring. A rating platform writing on the customer's behalf is a subscription the customer has bought.
Deadline tells you how much negotiating room exists. A reporting request is tied to a financial year close and moves slowly. A tender deadline does not move at all.
What are the four origins, and what does each one entitle them to?
Here they are side by side, which is the part nobody publishes.
| What the request looks like | Where it comes from | What it entitles them to | Your ceiling |
|---|---|---|---|
| Cites ESRS, the Accounting Directive, or "our sustainability statement" | The customer's own CSRD reporting duty | Value chain information for its own disclosures | The voluntary standard, if you average 1,000 employees or fewer |
| Cites screening, onboarding, code of conduct or supply chain risk | The customer's due diligence and risk processes | Whatever the contract and the underlying law of that process allow | None from the value chain cap |
| Arrives inside a tender with a score or a weighting attached | A buyer's award criteria | Nothing. You answer or you score lower | Commercial only |
| Arrives as an invitation to a rating platform | A rating subscription the customer has bought | Nothing. Participation is solicited and can be declined | Commercial only |
The first row is the only one where a rule, rather than a relationship, sets the limit.
Which one gives you a statutory ceiling?
Only the reporting request, and only since February 2026.
Directive (EU) 2026/470 inserted a right into Articles 19a(3) and 29a(3) of Directive 2013/34/EU. An undertaking that does not exceed, on its balance sheet date, an average of 1,000 employees during the preceding financial year, and that sits in the value chain of a reporting undertaking, is a protected undertaking. It has the right to decline to provide information exceeding the information specified in the voluntary standards, in response to a request made for the purpose of sustainability reporting as required by that Directive. A reporting undertaking may not require more, and any contractual provision to the contrary is not binding.
Three qualifications keep this honest. It bites only on reporting requests, so it does not touch due diligence, risk management or ordinary commercial questions. It does not stop you sharing more if you want to. And it does not override an existing contractual or legal obligation to provide information that sits within the voluntary standard.
There is one more thing worth knowing, because it catches people out. The protected undertaking definition is written on headcount alone. There is no turnover limb. A company with EUR 700 million of turnover and 300 employees is protected. A company with EUR 60 million of turnover and 1,400 employees is not, even though it is nowhere near CSRD's own scope test. We work through how to use the right in which ESG questions you can refuse.
What if your customer will not say which it is?
Ask them to, in writing, and treat the answer as part of their compliance rather than a favour to you.
Where a reporting undertaking does request information exceeding the voluntary standard, it must ensure that protected undertakings are informed of which information exceeds the standard and of the statutory right to decline. That duty sits with the party asking. So the useful sentence is not a refusal. It is: please confirm whether this is a reporting request under the Accounting Directive, and if so mark which items exceed the voluntary standard.
In practice one of three things happens. They confirm it is reporting and mark the excess, and you now have a clean line. They confirm it is due diligence or procurement, and you know the cap is irrelevant and you are negotiating commercially. Or nobody at the customer knows, which is common, and the request turns out to be a template inherited from a consultant. That last case resolves faster than the other two.
Which requests look regulatory but are not?
Several, and misreading them costs suppliers real money in unnecessary work.
A rating platform invitation. EcoVadis is a commercial supplier sustainability rating sold on an annual subscription to the company being rated. It states that the rating is always solicited and never performed without the knowledge, consent and involvement of the rated company, and that companies can always refuse to undergo an assessment. It is not a certification, not a standard and not a regulatory obligation, so the value chain cap does not restrain it. Read on 28 August 2026 from the published methodology disclosure.
A tender criterion. In the Dutch market the CO2-Prestatieladder is the clearest example. It is a private certification scheme owned by SKAO, voluntary in the sense that no organisation must certify and no authority must use it, and its force comes from the award advantage buyers attach to it. That is a bid price, not a legal duty. The same logic applies to public buyer frameworks elsewhere, for example the routes we cover for UK suppliers under PPN 006 and for NHS Evergreen.
A request tied to a specific imported good rather than to your company as a whole is a different mechanism entirely, and we handle it separately in CBAM.
What should you actually do this week?
Triage first, then answer once.
Sort the requests on your desk into the four rows above. For the reporting row, send the two-sentence clarification and hold. For the other three, decide commercially: what the account is worth, and what answering costs.
Then build the number once. Every one of the four origins wants an organisational greenhouse gas footprint with a stated boundary and activity data behind it, which means one calculation serves all of them. The standard to aim at, if you average 1,000 employees or fewer, is the voluntary one rather than full ESRS, and we set out what it covers in the VSME standard.
You can build that first inventory on a free account without a sales call. The platform serves 5,000+ users, covers more than 20,000 spend-based and activity-based factors and handles multiple entities and sites, and scope 3 consulting is where the value chain half usually needs help.
One limit to know before you build around it. A Mid-Market reviewer on G2 said in June 2026 that they would like to see more integrations with other software. If four customers each want their own portal populated, expect that last step to stay manual for now.
Sources: Directive (EU) 2026/470 Articles 19a(3) and 29a(3) and recital 12, Directive 2013/34/EU, EcoVadis Sustainability Rating methodology disclosure, SKAO CO2-Prestatieladder scheme documents. Verified 28 August 2026. CSRD is a directive, so the exact date the right takes effect where you are depends on national transposition, due by 19 March 2027.
Facts on this page were last verified on 2026-09-17.
