ESRS S2 After the July 2026 Revision: You May Ask Suppliers Less, and You Still Owe the Same Answer

Two things happened to value-chain reporting in the same reform package, and they pull in opposite directions.

The revised European Sustainability Reporting Standards cut the number of things you must disclose about workers in your value chain. The Omnibus amendments cut the amount of information you are allowed to demand from the companies that employ those workers.

Each is a relief on its own. Together they leave you owing a materiality-grounded account of labour risk in your supply chain, without the instrument most companies were using to gather the evidence for it.

This is a guide to ESRS S2 — Workers in the Value Chain — as it stands after the 3 July 2026 adoption, and to what changes in how you build the file behind it.

Where the standard stands

On 3 July 2026 the European Commission adopted the delegated acts containing the revised ESRS and the voluntary standard (Linklaters; Cooley). The European Parliament and the Council have a two-month scrutiny period, extendable by two further months, and can reject the acts in full but not amend them. The revised standards apply to financial years beginning on or after 1 January 2027, with first reports in 2028; earlier application is permitted for financial years starting 1 January 2026 (Linklaters).

Mandatory datapoints are down 61% against the 2023 standards and total datapoints down more than 70%. We covered the mechanics of that reduction, and why “fewer datapoints” means a remapping project rather than a lighter year, in the revised ESRS datapoint analysis.

The architecture survived intact: ESRS 1 and 2 for general requirements, five environmental standards, four social standards, one governance standard. S2 remains the second of the four social standards, sitting between S1 on your own workforce and S3 on affected communities.

What S2 actually covers

S2 is about people who do work for your business without being employed by it. In practice that means four populations that most companies track in four different systems, if at all:

• outsourced workers operating on your own sites, such as catering, cleaning and security staff
• workers employed by suppliers, producing goods using the supplier’s methods and premises
• maintenance and service workers sent in under contract by equipment providers
• workers deeper in the chain, including those extracting the raw materials that end up in your product

Across those populations the standard asks you to consider six areas of labour risk: working conditions including wages, working time, job security and social protection; freedom of association and collective bargaining; health and safety; training and skills development; diversity and equal treatment; and other labour-related human rights, including child labour and forced labour (Coolset).

S2 is conditional. You report against it only where workers in the value chain come through your double materiality assessment as a material topic. That conditionality is doing more work than it used to, for reasons set out below.

The amended standard as drafted by EFRAG in November 2025, which is the basis of the adopted act, narrows S2 toward what is materially relevant rather than a checklist. It merges and simplifies the previous disclosure requirements on engagement, grievance channels and remedy, and deletes several datapoints. It also adds: a datapoint on substantiated human rights incidents involving value-chain workers, including judicial proceedings and internally registered cases, and four explicit policy datapoints under S2-1 covering trafficking in human beings, forced or compulsory labour, child labour, and the supplier code of conduct (Coolset; EFRAG amended S2 draft). Confirm the final numbering against the Official Journal text when it publishes.

The cap that changes how you gather evidence

Under the Omnibus amendments, a company subject to CSRD may not require companies in its value chain with 1,000 employees or fewer to provide more sustainability information than the voluntary standard asks for. That applies from financial year 2027 (Linklaters). Gross Scope 1, 2 and 3 greenhouse gas metrics are carved out of the cap. Companies may rely on proxies and estimates for value-chain data, and the previous obligation to make reasonable efforts to obtain information from suppliers has been removed.

Severe labour risk does not concentrate in your largest, best-resourced suppliers. It concentrates in small subcontractors, labour agencies, seasonal operations and deeper tiers. That is overwhelmingly the population the cap now protects from your questionnaire.

The relief is real for the supplier. For the reporting company it means the long-tail questionnaire is no longer the answer, and building your S2 disclosure on questionnaire coverage rates was never a strong position anyway. Response rates were low, self-reported answers from a small supplier under commercial pressure carry obvious limits, and an assurance provider was always going to ask what you did with a non-response.

Note also what the cap does not touch: GHG metrics, which stay askable. If your value-chain data programme was mostly an emissions programme with a labour module bolted on, the emissions half is intact. See our guide to Scope 3 emissions reporting under CSRD.

What got harder

Three changes in the revised standards raise the bar on whatever you do disclose.

Fair presentation. Disclosed information must be comparable, verifiable and understandable, and you must be able to justify your conclusions to assurance providers more rigorously than before. Fewer numbers, held to a higher evidentiary standard. For S2 that means a statement like “no material risks identified in our supply chain” now needs a defensible file behind it, not an absence of findings.

No padding. Companies generally may not report non-material information unless it is required by other legislation, comes from a recognised framework, or meets a specific user demand. The familiar hedge — disclose everything and let the reader sort it out — is largely closed. That puts real weight on the materiality call itself, because a borderline S2 topic can no longer be handled by disclosing anyway.

Annual materiality. Companies must evaluate each year whether significant changes warrant revisiting their materiality conclusions. A value chain that shifts sourcing country, adds a labour agency, or acquires a tier-one supplier is a value chain whose S2 materiality answer may have changed since last year.

The treatment of impacts also got more precise, and it cuts against a common drafting habit. For actual impacts, remediation carried out during the period cannot reduce the assessed severity. For potential impacts, prevention measures count where they are reasonably effective. Positive impacts cannot be netted against negative ones, and cannot consist merely of complying with the law.

Building the S2 file without the questionnaire

Start with a risk-based screen, not a supplier list. Sector and geography carry most of the signal on labour risk. A screen that ranks your spend by known sector and country risk gets you to the material populations far faster than a questionnaire sent to everyone, and it is defensible in front of an assurance provider because the methodology is documented and repeatable.

Use the artefacts you already hold. Procurement spend by supplier and country. Contract terms and the supplier code of conduct itself. Audit reports, including third-party social audits you commissioned or received. Grievance and hotline logs. Incident registers. Certification records. None of this requires asking a small supplier for anything, and the new substantiated-incidents datapoint is answered from records of this kind rather than from a survey.

Spend your remaining ask where it still counts. The cap is a ceiling on what you may require, not a ban on cooperation. Larger suppliers stay fully in scope, GHG metrics stay askable everywhere, and a supplier who wants to share more can. Direct the questions you can still ask at the populations your screen flagged.

Write down the reasoning, not just the conclusion. Under fair presentation, the materiality assessment is part of the evidence base. Which populations you considered, what data you used, what you concluded and why — recorded at the time, with the source of each input traceable — is what turns a conclusion into a disclosure that survives assurance. Our guide to CSRD assurance requirements covers what the assurance provider will be looking for.

Keep S2 and due-diligence work in one place. The evidence supporting S2 overlaps heavily with corporate sustainability due diligence obligations. Running them as two projects produces two versions of the same supplier picture, and one of them will be wrong. See CSDDD and supply chain due diligence.

What to do with the runway

Financial year 2027 begins in five months for calendar-year reporters. The useful work between now and then is not learning the standard. It is deciding which value-chain populations are material, assembling the evidence for that decision from records you already control, and making sure each figure can be traced back to where it came from. The revised standards test that traceability harder than they test the datapoint count.

That traceability problem is the one Socious Report is built around: one dataset, mapped to CSRD, SSBJ and ISSB, with every disclosed figure carrying its source and transformation history, and an independent Socious Verify credential on the output.

If you want a picture of where you actually stand before the reporting year decides for you, the free CSRD readiness check walks through it axis by axis — data, systems, ownership, review, traceability. It takes honest answers and returns a readiness picture, not a sales call.