Updated on 22 October 2026

A company subject to the CSRD sends a 200-question questionnaire to a supplier with 80 employees. That supplier has neither the sustainability team nor the time to answer it. This is exactly the situation the new voluntary standard now addresses.

On 3 July 2026, the European Commission adopted Delegated Regulation (EU) 2026/1560, published in the Official Journal on 21 September and in force since 24 September 2026. It establishes a voluntary reporting standard, distinct from the VSME recommendation, and sets a legal cap on what a large company can demand from suppliers and customers that are not themselves subject to the CSRD. This article details what changes in practice, for groups sending supplier questionnaires and for the SMEs receiving them. The full picture of the revised ESRS is in our in-depth guide Simplified ESRS: What Changes in 2027.

Table of contents

  • What is the voluntary standard (formerly VSME)?
  • Who is protected by the value chain cap?
  • What the standard requires in practice
  • The value chain cap in practice
  • Points to watch
  • How Kabaun helps collect Scope 3 data under this framework
  • FAQ

What is the voluntary standard (formerly VSME)?

Since 2025, the VSME (Voluntary Sustainability reporting standard for SMEs) had been a European Commission recommendation (Recommendation (EU) 2025/1710): a simplified reporting framework SMEs could adopt without any obligation to do so. A recommendation carries no binding legal force.

Delegated Regulation (EU) 2026/1560, adopted on 3 July 2026 under Article 29ca of Directive 2013/34/EU as amended by the Omnibus I Directive (EU) 2026/470 of 24 February 2026, is a separate legal text. It establishes a voluntary sustainability reporting standard (Voluntary Standard, VS, in EFRAG's wording). Its Annex I contains the standard, in Basic (B1 to B11) and Comprehensive (C1 to C9) modules; its Annex II lists the data points covered by the value chain cap.

In practice, this regulation does two things at once: it gives companies not subject to the CSRD a simple framework to report voluntarily on sustainability, and it sets a legal limit on what a CSRD-obligated company can demand from its protected business partners. It is this second role, the "value chain cap", that carries the most operational impact.

The revised ESRS (Delegated Regulation (EU) 2026/1563) and the voluntary standard were published together in the Official Journal of the European Union on 21 September 2026 (references L_202601563 and L_202601560), with minor corrections compared to the July acts, according to EFRAG (22 September 2026). Regulation 2026/1560 entered into force on 24 September 2026.

"VSME" refers to Recommendation (EU) 2025/1710, not to the adopted standard: according to recital 25 of Regulation 2026/1560, that recommendation ceases to have legal effect once the regulation enters into force. The term remains the term most used in commercial exchanges, which is why this article mentions it, but the reference text is now Regulation 2026/1560.

Who is protected by the value chain cap?

The cap protects "protected undertakings": those with an average of 1,000 employees or fewer during the preceding financial year, and that sit within the value chain of a company subject to mandatory sustainability reporting.

On the other side, for financial years starting on or after 1 January 2027, companies subject to the CSRD are those that exceed, cumulatively, at their balance sheet date, a net turnover of EUR 450 million and an average of 1,000 employees over the financial year. These post-Omnibus thresholds determine who has the right to request data, and how far that request can go.

In practice, a company subject to the CSRD that questions a protected supplier or customer cannot demand information beyond the data points listed in Annex II of Regulation 2026/1560. This mechanism is provided for by Directive 2026/470 (Article 19a(3) of Directive 2013/34/EU). It gives the protected undertaking three guarantees:

  • A legal cap on the content of data requests, limited to the data points of Annex II of Regulation 2026/1560.
  • A right to refuse: the protected undertaking may lawfully decline to provide any information exceeding that cap, and a contrary contract clause is not binding.
  • A duty to inform: if the obligated company still wants to ask for more, it must specify which information goes beyond the cap and explicitly remind its counterpart of its right to refuse.

The cap only applies to the gathering of information for sustainability reporting purposes under the Accounting Directive. It does not prevent the voluntary sharing of information commonly exchanged within a given sector, and it does not affect any pre-existing contractual or legal obligation that stays within the limits of the standard.

What the standard requires in practice

The standard (Annex I of Regulation 2026/1560) comprises a Basic module and a Comprehensive module, which the reporting company chooses to apply depending on its maturity level or the request it receives. The value chain cap, however, is not measured against these modules but against Annex II.

Basic Module (B1 to B11):

  • B1, basis for preparation
  • B2, practices, policies and future initiatives for transitioning towards a more sustainable economy
  • B3, energy and greenhouse gas emissions
  • B4, pollution of air, water and soil
  • B5, biodiversity
  • B6, water
  • B7, resource use, circular economy and waste management
  • B8, workforce, general characteristics
  • B9, workforce, health and safety
  • B10, workforce, remuneration, collective bargaining and training
  • B11, convictions and fines for corruption and bribery

Comprehensive Module (C1 to C9), for companies that want or need to go further:

  • C1, strategy: business model and sustainability-related initiatives
  • C2, description of practices, policies and future initiatives for transitioning towards a more sustainable economy
  • C3, GHG reduction targets and climate transition
  • C4, climate risks
  • C5, additional (general) workforce characteristics
  • C6, additional own workforce information: human rights policies and processes
  • C7, human rights incidents
  • C8, revenues from certain activities
  • C9, gender diversity ratio in the governance body

Block B3, energy and GHG emissions, is the closest to the data needs of a carbon footprint. To know whether a request stays under the cap, however, one must refer to Annex II, not only to the B and C module breakdown: what is not listed there can be refused.

The value chain cap in practice

For a sustainability team on the buying side, this cap changes how a supplier questionnaire gets built. Before sending a data request to a protected supplier, three checks are required:

  • Check the supplier's headcount. A supplier exceeding 1,000 employees on average during the preceding financial year is not covered by the protection, even if it is itself outside the CSRD.
  • Limit the questionnaire to the Annex II data points, rather than an internal grid built independently of the standard. A questionnaire that stays within this scope is easier to defend legally and easier for the supplier to complete.
  • Document any request that exceeds the cap. If a data point falls outside the Annex II scope, such as a sector-specific requirement, it must be flagged explicitly to the supplier along with a reminder of its right to refuse.

For an SME receiving these requests, the reverse habit applies: compare every questionnaire received against the Annex II list of data points, and refuse whatever exceeds it without hesitation, the text explicitly allows it.

The value chain cap applies to financial years starting on or after 1 January 2027 (Article 4 of Regulation 2026/1560). As Directive 2026/470 must be transposed by 19 March 2027, French transposition had not been verified at the time of writing: it should be confirmed on Légifrance.

Points to watch

Three confusions come up regularly between buyers and suppliers:

  • VSME and the voluntary standard are not the same text. VSME is Recommendation (EU) 2025/1710. The adopted standard, and its value chain cap, come from Delegated Regulation (EU) 2026/1560.
  • The cap does not remove the need to collect Scope 3 data. It limits what can be demanded from a protected supplier, it does not exempt the obligated company from its duty to report on its value chain. It is deemed to have met that duty if it sticks to the information covered by the cap for protected undertakings.
  • The Comprehensive module adds to the Basic module, it does not replace it. Applying the Basic module is a prerequisite for applying the Comprehensive module, which contains additional data points. A supplier answering the Basic module makes no implicit commitment on the GHG targets or climate risks covered by the Comprehensive module.

How Kabaun helps collect Scope 3 data under this framework

Carbon footprint calculation in Kabaun covers all three GHG Protocol scopes, with Scope 3 structured into 15 standardized categories (feature CBC-002). This structure makes it easier to match data collected from suppliers with the Scope 3 categories expected in a CSRD report.

For collection itself, Kabaun automates sending data requests to suppliers, with response tracking and scheduled follow-ups (feature AUT-005). A sustainability team can build its questionnaire campaign around the Annex II data points rather than a proprietary grid, which limits the risk of unintentionally exceeding the cap and makes it easier for suppliers to respond.

On the reporting side, collected data feeds into the CSRD and ESRS E1 reports generated within Kabaun (feature REG-002), which covers the structuring of sustainability information required under the amended Accounting Directive. For a company subject to the CSRD that needs to justify its value chain data, having a traceable history of requests sent and responses received reduces exposure in the event of a review.

FAQ

Is the VSME mandatory for SMEs?

No. The standard remains voluntary, including for companies outside the CSRD. An SME chooses to apply it if it wants to publish sustainability information in a standardized way, or wants to answer its obligated customers' requests efficiently.

What is the value chain cap?

It is the limit set by Delegated Regulation (EU) 2026/1560 on the information a company subject to the CSRD can demand from a protected supplier or customer (1,000 employees or fewer). Beyond Annex II, the protected undertaking has an explicit right to refuse. The cap does not apply to requests made for purposes other than sustainability reporting, including those linked to due diligence.

Can an obligated company still ask for more than the cap?

Yes, but it must clearly specify which information exceeds the cap and inform its counterpart of its right to refuse that part of the request. Voluntary sharing of information commonly used in a sector remains possible outside this mechanism.

What is the difference between the Basic module and the Comprehensive module?

The Basic module (B1 to B11) covers first-level general, environmental, social and governance information, including energy and GHG emissions (B3). The Comprehensive module (C1 to C9) adds more detailed points, such as GHG reduction targets (C3) and climate risks (C4), reserved for companies going further in their voluntary reporting.

Since when does the value chain cap apply?

The cap applies to the reporting of obligated companies starting with financial years opening on or after 1 January 2027. Regulation 2026/1560 itself has been in force since 24 September 2026.

What is the difference between the VSME and the voluntary standard of Regulation 2026/1560?

The VSME is the Commission's Recommendation (EU) 2025/1710, with no binding force. The voluntary standard is established by a separate delegated regulation, 2026/1560, in force since 24 September 2026, to which the value chain cap is attached. The two texts should not be confused.

Official resources

Conclusion

The voluntary standard sets, for the first time, a legal limit on what a buyer can demand from its protected suppliers, and gives those suppliers an explicit right to refuse. For a sustainability team, the immediate priority is to compare current supplier questionnaires against Annex II of Regulation 2026/1560, and correct those that exceed the cap without flagging it.

Kabaun supports your Scope 3 data collection and CSRD reporting → [kabaun.com/contact](https://www.kabaun.com/en/contact)