The cap applies from 2027: what data your customer can ask you for

One customer sends an extensive ESG questionnaire, the next wants the same data in its own supplier portal, the third asks for metrics that nobody has collected so far. For many mid-sized companies, this has become silent extra work – triggered by the reporting obligations of their large customers.

The EU has responded. Since September 24, 2026, there has been a legally anchored “value-chain cap” on such requests: from fiscal year 2027, companies subject to reporting may only request a strictly defined data set from smaller partners in their value chain for their sustainability report.

This article shows who is protected, what data your customer can still request – and why the cap prevents fewer requests than many hope.

Who still has to report at all

With the Omnibus I package, the EU significantly scaled back the CSRD in February 2026. Amending Directive (EU) 2026/470 was published in the Official Journal on February 26, 2026. Reporting is now only required for companies with an average of more than 1,000 employees and more than 450 million euros in net turnover.

Many mid-sized companies are therefore no longer directly obligated. Their large customers, however, still are: anyone who reports must also report on their value chain. And to do that, they ask their suppliers.

Incidentally, the CSRD has not yet been transposed into national law in Germany. At the end of August 2026, the federal government gave no date for the implementing act, and at the end of September it had still not been passed. The EU deadline for transposing the Omnibus amendments runs until March 19, 2027.

The cap: who is protected and from when

The legal basis is Delegated Regulation (EU) 2026/1560. The European Commission adopted it on July 3, 2026. It was published in the Official Journal on September 21, 2026, and has been in force since September 24, 2026. It introduces the “Voluntary Standard” (VS), the successor to the well-known VSME.

The standard has two jobs. For companies not subject to reporting, it is a voluntary, uniform reporting framework. And at the same time, it is the upper limit: a company subject to the CSRD may not request more than the disclosures listed in Annex II of the regulation from smaller partners for its sustainability report.

The key points at a glance:

• Protected is any company that had an average of no more than 1,000 employees in the previous fiscal year.
• From when: The upper limit applies to fiscal years beginning on or after January 1, 2027.
• Your right: You may refuse to provide disclosures that go beyond the cap.
• Your customer’s obligation: If they ask for more anyway, they must tell you which disclosures these are and that you may decline them.
• Less is welcome: Customers should only request what they really need – so asking for less than the standard provides for is encouraged too.

One detail for Germany: as an EU regulation, the standard itself applies directly. Your right to refuse and your customer’s duty to inform you, by contrast, come from the amended CSRD directive, and according to the regulation, the cap only applies to requests for reporting under national CSRD law. Exactly how the German legislator implements this will become clear with the implementing act.

What data your customer can ask for

Exactly which disclosures fall under the cap is set out in Annex II of the regulation. It distinguishes between companies with more than 10 employees and micro-enterprises with up to 10 employees. For the smallest companies, no environmental disclosures at all fall under the cap.

What’s included on climate – and what isn’t

For CO₂ data, the list is surprisingly lean. From 11 employees, your customer can ask for two climate metrics: your energy consumption in MWh and your Scope 1 and Scope 2 emissions in tonnes of CO₂e. What’s required are estimated gross emissions according to the principles of the GHG Protocol Corporate Standard, with Scope 2 location-based.

Not covered by the cap:

• Scope 3 emissions. The standard mentions them only as a voluntary additional disclosure. However, it points out that they are often relevant in sectors such as manufacturing, agriculture and food, construction and packaging.
• Market-based Scope 2, i.e. the calculation using your actual electricity contract.
• Reduction targets and climate risks (C3 and C4) from the additional module.
• Product carbon footprints (PCF). They don’t appear in the standard at all.

In plain English: for its CSRD report, your customer can ask you about Scope 1 and 2. No obligation to provide Scope 3 or a PCF can be derived from this.

Where the cap doesn’t apply

As helpful as the cap is, it protects you from exactly one request channel. The regulation states explicitly that it only applies to data collected for sustainability reporting under the CSRD. But many requests serve a different purpose.

• Banks and investors are not bound. The regulation merely encourages them to use the content of the standard as a guide.
• Other laws remain unaffected. If your customer needs information for obligations under other EU or national law, for example its supply chain due diligence obligations, the cap does not apply.
• Voluntary programs of your customer are not a CSRD purpose. If they ask for CDP, for their SBTi supplier targets or for an EcoVadis rating, the cap does not protect you according to the wording of the regulation.
• Customers not subject to the CSRD are not covered at all. The cap only binds companies subject to reporting.
• Information customary in your industry can still be shared voluntarily. This is expressly permitted.

And then there’s commercial reality. Legally, you may decline excess questions. Your customer still decides for itself who it works with in the future. The cap is a protection against sprawl, not an argument against transparency.

What you can do now

There’s still some time until fiscal year 2027. It’s worth putting to good use.

1. Clarify your status. The cap only applies if your company had an average of no more than 1,000 employees in the previous year and the requesting customer is itself subject to the CSRD.
2. Get Scope 1 and 2 in order. That’s the climate core every CSRD customer can ask for. Determine your emissions according to the GHG Protocol and your energy consumption in MWh, ideally using activity data instead of estimates based on euro amounts.
3. Answer with one data set instead of ten questionnaires. If you prepare your disclosures once according to the basic module of the Voluntary Standard, you can send them to every customer in the same format. That’s exactly what the standard is for.
4. Ask about the purpose. If a request goes beyond the cap, clarify what the data is needed for. Then decide deliberately what you provide.
5. Keep Scope 3 in mind anyway. Customers with their own climate targets need supplier data, cap or no cap. If you can deliver Scope 3 or product data, you stand out. Voluntary, but often a real selling point.

If you’d like support along the way: at today.green, we build your carbon footprint according to the GHG Protocol together with you, with software and personal guidance from our experts. That way, you have the numbers ready before the next request comes in.

This article provides an overview and does not replace legal advice.