A company subject to the CSRD sends a 200-question questionnaire to a supplier with 80 employees. That supplier has neither the sustainability team nor the time to answer it. This is exactly the situation the new voluntary standard addresses, since July 2026.

On 3 July 2026, the European Commission adopted delegated act C(2026) 5011 final, which turns the VSME recommendation into an enforceable standard: a legal cap on what a large company can demand from suppliers and customers that are not themselves subject to the CSRD. This article details what changes in practice, for groups sending supplier questionnaires and for the SMEs receiving them.

Table of contents

  • What is the voluntary standard (formerly VSME)?
  • Who is protected by the value chain cap?
  • What the standard requires in practice
  • The value chain cap in practice
  • Points to watch
  • How Kabaun helps collect Scope 3 data under this framework
  • FAQ

What is the voluntary standard (formerly VSME)?

Since 2025, the VSME (Voluntary Sustainability reporting standard for SMEs) had been a European Commission recommendation (Recommendation (EU) 2025/1710): a simplified reporting framework SMEs could adopt without any obligation to do so. A recommendation carries no binding legal force.

Delegated act C(2026) 5011 final, adopted on 3 July 2026 under Article 29ca of Directive 2013/34/EU as amended by the Omnibus I Directive (EU) 2026/470 of 24 February 2026, changes that legal nature. The official text now refers to a "sustainability reporting standard for voluntary use" (Voluntary Sustainability Reporting Standard, VS). It keeps the modular structure of the original VSME recommendation, with limited adjustments to stay aligned with the revised ESRS.

In practice, this new standard does two things at once: it gives companies not subject to the CSRD a simple framework to report voluntarily on sustainability, and it sets a legal limit on what a CSRD-obligated company can demand from its protected business partners. It is this second role, the "value chain cap", that carries the most operational impact.

EFRAG confirmed on 22 September 2026 that the Commission had adopted, the day before, the revised ESRS and this voluntary standard, both now published in the Official Journal of the European Union (reference L_202601563 for the revised ESRS, L_202601560 for the voluntary standard), with minor corrections compared to the July text. Official translations into all EU languages and the digital reporting template are announced for November 2026.

This text supersedes the original VSME recommendation, which ceases to have effect once the delegated regulation enters into force. "VSME" remains the most searched and most commonly used term in commercial exchanges: it continues to refer, throughout this article, to the same framework, now turned into an enforceable standard.

Who is protected by the value chain cap?

The cap protects "protected undertakings": those with an average of 1,000 employees or fewer during the preceding financial year, and that sit within the value chain of a company subject to mandatory sustainability reporting.

On the other side, companies subject to the CSRD are now those that exceed, cumulatively, at their balance sheet date, a net turnover of EUR 450 million and an average of 1,000 employees over the financial year. These post-Omnibus thresholds determine who has the right to request data, and how far that request can go.

In practice, a company subject to the CSRD that questions a protected supplier or customer cannot demand information beyond what Annex II of the delegated act specifies, which precisely lists the data points covered by the cap. The text provides three guarantees for the protected undertaking:

  • A legal cap on the content of data requests, aligned with the standard's modules.
  • A right to refuse: the protected undertaking may lawfully decline to provide any information exceeding that cap.
  • A duty to inform: if the obligated company still wants to ask for more, it must specify which information goes beyond the cap and explicitly remind its counterpart of its right to refuse.

The cap only applies to the gathering of information for sustainability reporting purposes under the Accounting Directive. It does not prevent the voluntary sharing of information commonly exchanged within a given sector, and it does not affect any pre-existing contractual or legal obligation that stays within the limits of the standard.

What the standard requires in practice

The standard keeps the modular architecture of the VSME recommendation: a Basic module and a Comprehensive module, which the reporting company chooses to apply depending on its maturity level or the request it receives.

Basic Module (B1 to B11):

  • B1, basis for preparation
  • B2, practices, policies and future initiatives for transitioning towards a more sustainable economy
  • B3, energy and greenhouse gas emissions
  • B4, pollution of air, water and soil
  • B5, biodiversity
  • B6, water
  • B7, resource use, circular economy and waste management
  • B8, workforce, general characteristics
  • B9, workforce, health and safety
  • B10, workforce, remuneration, collective bargaining and training
  • B11, convictions and fines for corruption and bribery

Comprehensive Module (C1 to C9), for companies that want or need to go further:

  • C1, strategy, business model and sustainability-related initiatives
  • C2, detailed description of transition practices and policies
  • C3, GHG reduction targets and climate transition
  • C4, climate risks
  • C5, additional workforce characteristics
  • C6, human rights policies and processes
  • C7, human rights incidents
  • C8, revenues from certain activities
  • C9, gender diversity ratio in the governance body

Block B3, energy and GHG emissions, is the mandatory entry point for any company answering a Scope 3 request: it is the data groups come looking for first from their suppliers. The Comprehensive Module, with C3 (GHG targets) and C4 (climate risks), matches the level of information a CSRD-obligated company can only obtain if the supplier chooses to provide it, never as an obligation.

One specific simplification applies to very small structures: protected undertakings with 10 employees or fewer benefit from separate treatment. Certain more demanding environmental disclosures remain optional for them even when they apply the standard, and therefore sit above the cap applicable to their case.

The value chain cap in practice

For a sustainability team on the buying side, this cap changes how a supplier questionnaire gets built. Before sending a data request to a protected supplier, three checks are required:

  • Check the supplier's headcount. A supplier exceeding 1,000 employees on average during the preceding financial year is not covered by the protection.
  • Align the questionnaire with the B and C modules, rather than an internal grid built independently of the standard. A questionnaire that follows the VSME architecture is easier to defend legally and easier for the supplier to complete.
  • Document any request that exceeds the cap. If a data point falls outside the B/C scope, such as a sector-specific requirement, it must be flagged explicitly to the supplier along with a reminder of its right to refuse.

For an SME receiving these requests, the reverse habit applies: compare every questionnaire received against the Annex II list of data points, and refuse whatever exceeds it without hesitation, the text explicitly allows it.

The delegated act sets out two distinct timelines. The value chain cap applies to financial years starting on or after 1 January 2027, as part of the reporting obligations of companies subject to the CSRD. Protected undertakings that want to use the standard voluntarily to publish their own information can do so as soon as the regulation enters into force, without waiting for 2027.

Points to watch

Three confusions come up regularly between buyers and suppliers:

  • VSME no longer means "recommendation". The term is still used in everyday language, but the reference text is now an enforceable delegated regulation, not an optional framework anyone can adapt freely.
  • The cap does not remove the need to collect Scope 3 data. It limits what can be demanded from a protected supplier, it does not exempt the obligated company from its own value chain reporting duties, including the use of estimated data when a supplier exercises its right to refuse.
  • The Basic module is not an optional subset of the Comprehensive module. These are two distinct levels of ambition, with different data points. A supplier answering the Basic module makes no implicit commitment on the GHG targets or climate risks covered by the Comprehensive module.

How Kabaun helps collect Scope 3 data under this framework

Carbon footprint calculation in Kabaun covers all three GHG Protocol scopes, with Scope 3 structured into 15 standardized categories (feature CBC-002). This structure makes it easier to match data collected from suppliers with the Scope 3 categories expected in a CSRD report.

For collection itself, Kabaun automates sending data requests to suppliers, with response tracking and scheduled follow-ups (feature AUT-005). A sustainability team can build its questionnaire campaign around the B and C modules rather than a proprietary grid, which limits the risk of unintentionally exceeding the cap and makes it easier for suppliers to respond.

On the reporting side, collected data feeds into the CSRD and ESRS E1 reports generated within Kabaun (feature REG-002), which covers the structuring of sustainability information required under the amended Accounting Directive. For a company subject to the CSRD that needs to justify its value chain data, having a traceable history of requests sent and responses received reduces exposure in the event of a review.

FAQ

Is the VSME mandatory for SMEs?

No. The standard remains voluntary for companies that are not subject to the CSRD. An SME chooses to apply it if it wants to publish sustainability information in a standardized way, or wants to answer its obligated customers' requests efficiently.

What is the value chain cap?

It is the legal limit set by delegated act C(2026) 5011 final on the information a company subject to the CSRD can demand from a protected supplier or customer (1,000 employees or fewer). Beyond that cap, the protected undertaking has an explicit right to refuse.

Can an obligated company still ask for more than the cap?

Yes, but it must clearly specify which information exceeds the cap and inform its counterpart of its right to refuse that part of the request. Voluntary sharing of information commonly used in a sector remains possible outside this mechanism.

What is the difference between the Basic module and the Comprehensive module?

The Basic module (B1 to B11) covers first-level general, environmental, social and governance information, including energy and GHG emissions (B3). The Comprehensive module (C1 to C9) adds more detailed points, such as GHG reduction targets (C3) and climate risks (C4), reserved for companies going further in their voluntary reporting.

Since when does the value chain cap apply?

The cap applies to the reporting of obligated companies starting with financial years opening on or after 1 January 2027. Protected undertakings that want to use the standard for their own voluntary reporting can do so as soon as the delegated regulation enters into force, without waiting for that date.

Does the VSME fully replace the original 2025 recommendation?

Yes. Recommendation (EU) 2025/1710, which served as an intermediary solution pending the adoption of a binding text, ceases to have effect once the delegated act enters into force. Changes to the technical content remain limited, to ensure continuity for companies already applying the earlier version.

Official resources

Conclusion

The voluntary standard sets, for the first time, a legal limit on what a buyer can demand from its protected suppliers, and gives those suppliers an explicit right to refuse. For a sustainability team, the immediate priority is to compare current supplier questionnaires against the B and C modules of Annex I, and correct those that exceed the cap without flagging it.

Kabaun supports your Scope 3 data collection and CSRD reporting → kabaun.com/contact

Last updated 23 September 2026.