Europe’s new sustainability standard, a legal cap not a commercial shield

Brussels has established a ceiling on the sustainability information CSRD-reporting companies may require from smaller businesses for their reporting. The ceiling applies for financial years beginning on or after January 1 2027. It does not stop banks, investors or commercial customers asking questions for other purposes. For senior management, the immediate task is to establish whether the business qualifies for protection, identify what counterparties genuinely need and prepare a proportionate, reliable information package.

Stratagem Partners Client briefing. Legal position at 20 October 2026

The EU’s new Voluntary Standard offers smaller businesses regulatory relief, but of a deliberately limited kind. Commission Delegated Regulation (EU) 2026/1560, adopted on July 3 and published on September 21, entered into force on September 24 2026. Companies outside mandatory Corporate Sustainability Reporting Directive reporting may use the standard voluntarily. Its value-chain protections apply for financial years beginning on or after January 1 2027.  Separately, Commission Delegated Regulation (EU) 2026/1563 revises the mandatory European Sustainability Reporting Standards. The revised ESRS apply from financial years beginning on or after January 1 2027, subject to transitional provisions.

For SMEs, however, the more important development sits behind these standards. Directive (EU) 2026/470 narrows mandatory CSRD reporting from the 2027 financial year to undertakings exceeding both €450mn in net turnover and an average of 1,000 employees. Equivalent thresholds apply to groups on a consolidated basis. Member states have until March 19 2027 to transpose the relevant provisions. That substantially reduces the number of companies facing mandatory reporting. It does not mean sustainability information will disappear from SME agendas.

SMEs and “protected undertakings” are not the same

The distinction matters. Under the EU’s general SME definition, an enterprise has fewer than 250 employees and annual turnover not exceeding €50mn and/or a balance-sheet total not exceeding €43mn. Ownership and group relationships can affect that calculation.

The new “protected undertaking” category is broader. It covers an undertaking in the value chain of a CSRD-reporting company that does not exceed an average of 1,000 employees during the preceding financial year. There is no separate turnover or balance-sheet test. A company can therefore be too large to qualify as an SME but still benefit from the value-chain protection. Equally, SME status does not provide blanket protection from sustainability information requests.

What the cap actually does

Directive (EU) 2026/470 establishes the right of protected undertakings to decline information requests exceeding the ceiling when those requests are made for CSRD sustainability reporting. It also requires reporting companies to identify the additional information sought and notify the protected undertaking of its right to refuse. Contractual provisions contrary to that right are not binding, although the remainder of the contract survives. These protections should be understood alongside the Directive’s implementation in national law and the cap’s application to financial years beginning on or after January 1 2027. Businesses should not assume that the Regulation’s entry into force makes every protection immediately exercisable.

There is another important limitation, the cap itself does not oblige the smaller company to provide the Annex II information. Any obligation to supply information would need another legal or contractual basis. For SMEs, this is where the regulatory relief ends.

The cap is tied specifically to information sought for CSRD sustainability reporting. The legislation leaves unaffected requests made for other purposes, including compliance with EU due-diligence requirements. The regulatory material also recognises information demands associated with financial institutions and business risk assessment. A bank assessing credit, or a customer examining supplier risk, may therefore seek sustainability information outside the statutory cap. The practical lesson is straightforward, the purpose of the request matters as much as the identity of the requester.

Voluntary reporting, commercial pressure

The 2026 legislation formally calls the framework the Voluntary Standard. “VSME” refers to the earlier SME-focused framework endorsed through Commission Recommendation (EU) 2025/1710. The new standard retains a Basic Module and a Comprehensive Module, with Basic required before Comprehensive. Adoption is voluntary, but a business claiming compliance must meet the requirements of its selected reporting option, subject to the standard’s applicability rules and permitted omissions. Completing Basic and providing selected additional Comprehensive disclosures should be distinguished from claiming compliance with the full Comprehensive Module.

Businesses with 10 employees or fewer receive additional proportionality because several datapoints are voluntary. Energy consumption, Scope 1 and Scope 2 emissions, water and specified circular-economy and waste disclosures are voluntary for these businesses and fall outside their smaller Annex II ceiling. The standard therefore does not impose the same reporting workload or information ceiling on every protected undertaking.

For most SMEs, Basic should be the starting point rather than an invitation to recreate a large-company sustainability function. It covers business information and sustainability practices, alongside environmental, workforce and business-conduct disclosures. These include energy and emissions, applicable pollution and biodiversity information, water and waste, workforce characteristics, health and safety, remuneration and training, and corruption convictions and fines. The applicable requirements depend on the business’s circumstances and the relief available to smaller undertakings.

Basic includes Scope 1 and location-based Scope 2 emissions for businesses with more than 10 employees. A full Scope 3 inventory is not a universal Basic requirement. However, reporting significant Scope 3 categories may be appropriate where the business’s activities and sector make that information relevant.

The commercial case is standardisation. A credible, reusable dataset could allow a business to answer recurring questions from customers and financial institutions without rebuilding the response each time. The same information can also support management decisions on resource use, operational risks and workforce issues. Those benefits depend on how the information is used; reporting alone does not guarantee savings or improved performance.

EU material supports the proposition that standardisation should reduce fragmented and overlapping requests. Financial institutions are encouraged to limit requests outside CSRD reporting, as far as possible, to the information in Annex I. This is a policy expectation rather than the binding Annex II cap. Adopting the standard does not guarantee finance, tender success or customer retention, and businesses should remain sceptical of claims that it will eliminate questionnaire fatigue. The real test will be market behaviour: whether customers and financial institutions accept the Voluntary Standard as a common information base or simply add it to existing questionnaires.

What SMEs should do now?

• Appoint an accountable executive, identify departmental data owners and agree a proportionate budget and approval process.

• Record who is asking, what information is requested, its intended purpose and the contractual or regulatory basis.

• Confirm protected-undertaking status and the relevant Annex II ceiling, including the distinction between businesses with 10 employees or fewer and those with more than 10.

• Start with the Basic Module and assess additional disclosures against actual customer, lender and investor needs. Distinguish supplementary information from full Comprehensive Module reporting.

• Strengthen existing finance, HR, operations and procurement data before investing in specialist reporting technology. Define the reporting boundary, retain supporting records and review information before sharing it.

• Align the reporting period with financial statements where these are prepared. Update annually where counterparties require an annual report and provide previous-year comparisons from the second reporting year, except for newly disclosed metrics.

• Assess genuinely CSRD-related requests against Annex II and the applicable legal position before invoking the right to refuse. Escalate disputed purposes, contractual obligations and sensitive disclosures for appropriate review.

• For businesses requesting supplier information, review questionnaires and collect only what is needed for CSRD reporting. Treat the cap as a ceiling, not a standard questionnaire to send to every supplier.

  
  

Brussels has reduced one source of regulatory spillover. It has not removed commercial leverage. For SMEs, the right response is neither wholesale compliance with every questionnaire nor automatic resistance. It is to know which demands are law, which are contract and which are negotiation.