If you supply companies in Europe, you have heard of CSRD, the Corporate Sustainability Reporting Directive. It changes what large European companies must report and, through them, what their suppliers worldwide are asked for.
For a small or mid-sized supplier outside the EU, three questions come first: does it apply to me, what will European customers expect, and how do I prepare? The practical answer runs through the VSME, the EU's simplified standard for SMEs.
| First question | Short answer |
|---|---|
| Does CSRD obligate my non-EU company? | Almost never directly. Non-EU companies come into scope only with significant EU operations, from FY2028. |
| Then why am I being asked? | Your EU customers are obligated and must report on their value chain. They need your data. |
| What will they ask me to use? | The VSME standard: eleven Basic Module disclosures, in a fixed structure. |
| When? | Requests from mid-to-large EU customers from 2026–2027; from smaller EU firms, 2028–2029. |
| Do I need a consultant? | Not for VSME-level data. Emissions, policies, workforce metrics, and evidence are the work. |
CSRD and its supply chain effect
CSRD requires large European companies to publish detailed sustainability reports under the European Sustainability Reporting Standards (ESRS): environmental, social, and governance topics in depth, from carbon emissions to worker rights to biodiversity.
Obligated companies report on their entire value chain, not only direct operations. They need sustainability data from suppliers, and they cascade data requests down their supply chains globally.
CSRD does not directly obligate most non-EU SMEs. Your European customers are obligated, and they will ask for data to meet their requirements. How efficiently you provide it affects the relationship.
VSME: the SME standard
Because full ESRS is disproportionate for small companies, EFRAG developed the Voluntary Sustainability Reporting Standard for SMEs. It covers the same broad topics with fewer datapoints and less complexity.
"Voluntary" means regulators do not fine non-use. When a European customer asks for VSME-aligned data, it is voluntary in the way responding to any customer questionnaire is voluntary: optional in law, necessary in practice.
VSME serves two purposes: a format for SMEs that report on their own account, and a standardized format for suppliers reporting to CSRD-obligated customers. Most non-EU suppliers are in the second group.
What VSME asks for
The Basic Module is a fixed set of eleven disclosures. It does not require a materiality assessment; every company reports the same items, stating "not applicable" where a topic does not arise.
Company basis (B1). Business model, products and services, markets, employees.
Practices and policies (B2). Which sustainability policies exist — environment, health and safety, ethics, anti-corruption, human rights, supplier management — who is responsible, and any planned initiatives. A small company documents who owns environmental and social responsibility and how leadership discusses it.
Environment (B3–B7). Energy consumption and Scope 1 and 2 emissions (Scope 3 encouraged); pollution; biodiversity; water; resource use, circularity, and waste. Less granular than ESRS, but the underlying data is similar to what CDP or EcoVadis request.
Workforce (B8–B10). Headcount and composition; health and safety metrics; remuneration, collective bargaining, and training.
Business conduct (B11). Convictions and fines for corruption and bribery.
The Comprehensive Module adds disclosures for larger SMEs, including further social and business-conduct items. Metrics are quantitative (emissions in metric tons CO2e, injury frequency rates) and qualitative (policy descriptions, planned actions). Reporting is annual, covering the most recent fiscal year.
The 11 VSME disclosures guide covers each in detail.
Materiality, briefly
A core CSRD concept is double materiality: a topic is reported if it affects the company financially or if the company affects it. For a small manufacturer, climate change is material both ways — energy costs and carbon regulation affect the business; its emissions affect the climate. Workplace safety likewise.
Your large customers run this assessment across their value chain, and it determines what they ask you for. VSME's Basic Module does not require one from you. If a customer specifically requests water data, they have decided water is material to their value chain; answer the request rather than reassessing it. The double materiality guide explains the concept.
Timeline
The 2026 Omnibus reform (Directive (EU) 2026/470) reshaped it. The first wave of large public-interest companies has reported since fiscal year 2024; from FY2027 they stay in scope only if they exceed 1,000 employees and €450 million turnover. Other large companies report from FY2027, with first reports in 2028. Listed SMEs were removed from mandatory scope and may report voluntarily under VSME. Non-EU companies with significant EU operations follow from FY2028.
For suppliers the effect lags. Customers establish their own reporting before fully cascading requirements. Well-organized companies request supplier data early to set baselines.
If you supply mid-to-large EU companies, expect formal data requests using VSME or similar from 2026–2027. If you supply smaller EU firms, systematic requests come later, around 2028–2029. Preparing now is cheaper than reacting later.
Preparing without consultants
VSME asks for data that a sustainability-conscious SME can track with reasonable effort. The free VSME readiness check shows which disclosures you already cover and which need work.
Start with emissions. Scope 1 and 2 are required by virtually every framework. Track electricity bills and fuel receipts; apply standard factors. The free carbon calculator does the calculation; the GHG Protocol and trade association tools are alternatives.
Document policies. Write down actual practice on environmental management, health and safety, business ethics, human rights, and data protection. Two to three pages each. Dated, approved by leadership, communicated to employees; keep evidence of communication (training records, signed acknowledgments). The ESG policy template guide has a downloadable environmental policy.
Gather metrics. Two to three years of injury rates, turnover, training hours, energy, and waste where available. Trends are worth more than a single year. Set up tracking from now.
Assess your own supply chain. You will be asked how you manage sustainability risk in your suppliers. Basic approaches count: a supplier questionnaire, contractual clauses requiring compliance with labor and environmental law, focus on tier-1 suppliers of critical materials. Document it and apply it consistently.
Consider targets. Customers reporting under CSRD have targets and ask suppliers about theirs. Set realistic ones for your most material impacts — an emissions reduction by a given year, zero lost-time injuries, a water reduction — and track them.
Organize evidence. Policies, certifications, audit reports, training records, calculation methods, performance data, in one place. ESG Passport organizes this documentation in formats aligned with VSME and other frameworks, so a customer request is answered from records.
VSME and other questionnaires
If you already respond to EcoVadis, CDP, or similar, the data overlaps substantially. The format differs: VSME is disclosure-based (report against defined datapoints), while platforms are assessment-based (answer questions, receive a score). VSME is less subjective and more prescriptive.
The consequence is favorable: VSME-ready data makes every other questionnaire faster, because the data collection and policy documentation are already done.
The strategic view
Sustainability reporting is converging globally. The ISSB standards are being adopted worldwide; California has mandatory climate disclosure; other major economies are implementing similar frameworks. CSRD and VSME are the leading edge, not an isolated EU requirement. A supplier that builds ESG data infrastructure now is positioned for whichever framework dominates.
ESG data capability is also a differentiator. As buyers factor ESG performance into sourcing, suppliers who can provide credible VSME-aligned data quickly are preferred.
Start with the European customers that are CSRD-obligated — after the Omnibus reform, typically those exceeding both 1,000 employees and €450 million turnover. Build the data infrastructure for those relationships first, then extend to other customers.
VSME is designed to be proportionate. Honest disclosure of actual performance, clear policies, and evidence of improvement is what it asks for. The same data — resource efficiency, workforce stability, operational resilience — is worth measuring regardless of regulation.