The Value Chain Cap: What You Can Ask a Supplier For, and What They Can Refuse

A supplier with 300 employees gets sustainability questionnaires from five large customers. Each one is a different spreadsheet. Each asks for emissions on a different boundary, energy in different units, workforce data cut a different way. Four of the five ask for something the company has never measured. None of them accepts another’s format.

That is the trickle-down effect, and until this summer the only defence against it was commercial: say no to the questionnaire and risk the account.

On 3 July 2026 the European Commission adopted a delegated regulation that changes the shape of that conversation. Its title says what it does: establishing sustainability reporting standards for voluntary use by undertakings protected by the value chain cap (C(2026) 5011 final). It was adopted alongside the revised ESRS on the same day (Linklaters).

This is a guide to what the cap is, who it protects, and what it obliges the asking company to do.

Where the power comes from

The Omnibus I Directive — Directive (EU) 2026/470 of 24 February 2026 inserted Article 29ca into the Accounting Directive, requiring the Commission to adopt a sustainability reporting standard for voluntary use by undertakings that do not have more than 1,000 employees.

The standard has two jobs, and the second one is the one most people have missed. The first is to give companies outside mandatory scope a simple, standardized way to report if they want to. The second is to act as a ceiling.

In the Commission’s own words, reporting undertakings “are prohibited from requiring from protected undertakings information exceeding the information to be disclosed pursuant to the voluntary standard. At the same time, protected undertakings have a statutory right to refuse to provide information exceeding those limits.”

The standard itself is built on the VSME, which EFRAG submitted to the Commission in December 2024 after a four-month public consultation and field-testing program, and which the Commission endorsed in Commission Recommendation (EU) 2025/1710 of 30 July 2025. That Recommendation was the interim answer while the delegated act was drafted. It is now superseded by it.

Who is protected

A “protected undertaking” is one that does not exceed an average of 1,000 employees during the preceding financial year.

Read that against the mandatory threshold — more than €450 million net turnover and more than 1,000 employees on average — and the architecture becomes clear. There is no gap between the two. Every company below mandatory scope on the headcount test is protected, and the protection does not depend on turnover at all.

It is worth saying plainly that this reaches well past what anyone means by “SME”. A 900-person manufacturer with €600 million of revenue is a protected undertaking. The standard began life as the VSME — the voluntary standard for SMEs and the constituency it now shields is considerably wider than its origin story suggests.

The Commission was explicit about why it resisted enlarging the standard during drafting: “Any significant addition to the VSME standard would increase the reference level for the value chain cap, lowering the protection for undertakings in value chains.” Every data point added to the standard is a data point your suppliers lose the right to refuse. The Commission treated the standard’s brevity as the protection itself.

What is actually in the standard

Annex I is the Voluntary Standard, and it keeps the VSME’s modular structure.

Basic Module — general information (B1 basis for preparation, B2 practices, policies and future initiatives for the transition to a more sustainable economy), then metrics: B3 energy and greenhouse gas emissions, B4 pollution of air, water and soil, B5 biodiversity, B6 water, B7 resource use, circular economy and waste management, B8 workforce general characteristics, B9 workforce health and safety, B10 workforce remuneration, collective bargaining and training, and B11 convictions and fines for corruption and bribery.

Comprehensive Module — C1 strategy: business model and sustainability-related initiatives, C2 description of practices, policies and future initiatives for the transition, C3 GHG reduction targets and climate transition, C4 climate risks, C5 additional workforce characteristics, C6 human rights policies and processes, C7 human rights incidents, C8 revenues from certain activities, and C9 gender diversity ratio in the governance body.

Three appendices follow: defined terms, a list of possible sustainability issues, and background information reconciling the standard with other EU regulations for financial market participants who will use the output.

That is the whole surface area. Twenty disclosures, most of them metrics a company either already has or can count.

The cap is narrower than the standard

Here is the part that will decide most real arguments, and it is easy to read past.

The standard contains four kinds of data point: essential ones that a company reports whenever it applies the standard, conditional ones needed only in specified circumstances, voluntary ones, and sector-specific ones. Only the essential data points are covered by the value chain cap. The Commission set the cap this way deliberately, to balance protection against creating fresh burden on the companies doing the asking.

The disclosures that constitute the cap are listed in Annex II — a dedicated list, precisely so that neither side has to argue about it. Annex II distinguishes two tiers: what constitutes the cap for undertakings with more than 10 employees, and what constitutes it for undertakings with 10 or fewer. Certain disclosures, particularly the more demanding environmental ones, are voluntary for companies of 10 employees or fewer, which puts them above the cap for those companies.

So “the cap” is not “the standard”. It is Annex II, read against your supplier’s headcount.

Three duties on the company doing the asking

If you are inside mandatory scope, the regulation creates obligations that live in procurement, not in the sustainability team.

1. You may not require information beyond the cap. Not “should avoid” — may not.
2. If you choose to ask beyond it anyway, you must tell them. Specifically, you must ensure the protected undertaking is informed of which extra information is being requested, and of its statutory right to decline. A questionnaire that mixes capped and above-cap fields without marking which is which does not meet this.
3. You should ask for less than the standard where you need less. The regulation is explicit that companies should only request information insofar as they need it, and should request less than the standard specifies if they do not need all of it. The cap is a ceiling, not a template to send out in full.

Four things the cap does not do

The scope conditions matter as much as the rule, and they are where over-reading it will get expensive.

• It does not stop voluntary sharing. Information commonly shared among companies in a given sector can still be exchanged on a voluntary basis.
• It does not override contracts. Any contractual obligation to provide information stands, as does any obligation under Union or national law, so long as it does not exceed what the standard specifies.
• It applies only to information gathering for the purpose of sustainability reporting under the Accounting Directive. Data you collect for quality, safety, customs, or product compliance is untouched.
• It is not an assurance regime. Nothing in the standard requires a protected undertaking to have its answers audited.

Dates

The delegated act applies from financial year 2027 for the value chain reporting of undertakings subject to mandatory sustainability reporting. For companies of 1,000 employees or fewer that simply want to report voluntarily, it applies from the date of entry into force.

Entry into force is not automatic yet. Parliament and Council have a two-month scrutiny period, extendable by a further two months, and may reject the act in full but not amend it (Linklaters). Confirm final article and paragraph numbering against the Official Journal text when it publishes.

The consultation history suggests the substance is settled: the Commission ran a four-week “Have Your Say” consultation from 6 May to 3 June 2026 that drew 203 responses, and reported the feedback as broadly balanced, with a shared request to make the cap mechanism as clear as possible.

What to do with this

If you are in scope, your supplier questionnaire is now a legal artefact. Two things follow. You need to know which of your value-chain counterparties sit at 1,000 employees or fewer, because that determines which requests are capped. And your questionnaire needs to be able to show, field by field, what is inside Annex II and what is above it, because for anything above it, you owe the supplier a notification and they owe you nothing.

If you are a protected undertaking, the work is to answer the standard once, properly, and then send the same answer to everyone. The right to refuse is only useful if you have something to offer instead. A company that can hand over a complete Voluntary Standard report is in a much stronger position to decline the sixth spreadsheet than one that is simply saying no.

Either way, the underlying problem is the same one it has always been: the data exists in different systems, on different boundaries, for different audiences, and someone has to reconcile it. The frameworks are converging on the same underlying facts, an emissions figure is an emissions figure whether it lands in ESRS E1, the Voluntary Standard’s B3, or a Japanese SSBJ filing. What changes is the presentation.

If you want to know where your own reporting sits before the FY2027 dates arrive, our free CSRD readiness check scores you across seven dimensions in about three minutes.