CSRD 2027: What Your European Customer Will Ask You For

A Japanese components maker with 4,000 employees supplies three European customers. In the first quarter of 2027, one customer asks for embedded emissions for an aluminium extrusion at installation level. The supplier’s ESG report only contains a group total. A second customer asks for the method behind the figures, which the report also omits.

The sustainability team answers the first two from last year’s ESG report. The third request is from trade compliance at the customer, and the report cannot answer it.

The supplier needs the installation record during 2027, while the customer is collecting data for that reporting year.

Why 2027

The Omnibus revision settled the scope of CSRD in early 2026. Directive (EU) 2026/470 of 24 February 2026 narrows mandatory sustainability reporting to undertakings exceeding a net turnover of €450 million and an average of 1,000 employees during the financial year. The narrowed scope applies to financial years starting on or after 1 January 2027, with the first reports published in 2028.

In early 2027, the European customer asks for records from the year now under way. Waiting until its 2028 report is due leaves the Japanese supplier trying to reconstruct site data from year-end totals. An assurance provider cannot test records that were never kept.

There is also a case where the request never arrives, because the obligation is yours. The directive covers subsidiaries and branches of third-country undertakings, where the parent generates net turnover above €450 million in the Union and an individual subsidiary or branch exceeds €200 million (Directive (EU) 2026/470). A Japanese group with a substantial European business can be a reporting undertaking in its own right.

The cap protects your smaller competitors

On 3 July 2026 the Commission adopted the delegated regulation establishing sustainability reporting standards for voluntary use by undertakings protected by the value chain cap. A protected undertaking is one that does not exceed an average of 1,000 employees in the preceding financial year. Companies in mandatory scope are prohibited from requiring information beyond that voluntary standard from a protected undertaking, and the protected undertaking has a statutory right to refuse. We covered the mechanics of that in detail here.

The threshold is headcount only. It does not look at turnover, and it does not look at where the company sits. A 900-person supplier in Osaka is protected. A 4,000-person supplier in Nagoya is not, and no ceiling applies to what may be asked of it.

A large Japanese manufacturer cannot use the cap to decline. It can name a data owner and set the reporting boundary before the first customer request arrives.

What the questions are actually about

Your emissions enter the European customer’s Scope 3 inventory. The GHG Protocol’s Corporate Value Chain (Scope 3) Standard, published in 2011, splits that inventory into 15 categories across upstream and downstream activities. A component usually appears under purchased goods and services. Transport may be reported under another category, and the customer’s finished product creates a downstream entry.

That structure explains why the requests use different units. To use a supplier’s emissions figure, the customer also needs its reporting boundary and calculation method. The file should identify the emission factor and source year, and say whether the underlying data is measured or estimated. An ESG report PDF often omits this record, so the customer sends a follow-up request.

CBAM asks a different question, with teeth

The Carbon Border Adjustment Mechanism has been in its definitive regime since 1 January 2026, covering cement, iron and steel, aluminium, fertilisers, electricity and hydrogen (European Commission). Chemicals as a sector are not covered wholesale, though fertilisers and hydrogen are, and a chemicals producer can be exposed through the covered inputs it buys rather than the products it sells.

The 2026 simplification introduced a mass-based de-minimis threshold of 50 tonnes, moved the annual declaration deadline to 30 September, first applying in 2027 for the 2026 year, and set certificate sales to begin on 1 February 2027 (Regulation (EU) 2025/2083). Embedded emissions are determined on actual emissions, with default values available where actual emissions cannot be adequately determined (Regulation (EU) 2023/956).

A steel or aluminium supplier may receive both requests from the same customer. Sustainability needs a corporate or site figure for CSRD. Trade compliance needs the embedded emissions of a specific good from a specific installation for CBAM, where using a default value increases the importer’s cost. We wrote about the overlap across four EU filings and about what the definitive CBAM regime changed.

Answering once

The sustainability controller maintains a supplier-data pack with trade compliance. It records which sites and legal entities are inside the reporting boundary and explains how the group treats joint ventures and contract manufacturers.

For a CBAM good, the owner keeps emissions at installation level. When a CSRD questionnaire asks for a site or corporate total, the owner aggregates those records. The same file holds the emission factor, its source year, the activity data and the name of the person who changed it. If a customer uses a different boundary, the owner can prepare a reconciliation from that file.

Mark estimates as estimates. A customer building an assured inventory needs to know which of your figures are primary and which are modelled. An honest estimate with a stated method is usable. An unmarked one that turns out to be modelled is a restatement in their report.

The controller refreshes this pack once a year. Customer forms can then be completed from the same source record instead of being recalculated each time.

The emissions records also support SSBJ disclosure in the Japanese annual securities report. A group can map the same source file to both standards through one dual-reporting process.

Whether this is a heavy year or an ordinary one comes down to a question you can answer today. Pick your largest European customer and ask which of your plants supply them, and whether you could produce site-level emissions for those plants, for calendar year 2026, with the method written down.

Time the test. A result within a week means the records are already usable. A quarter-long search means the group needs a data-collection project before customer questionnaires arrive.

---

Check where you stand. The free CSRD readiness check takes about three minutes and scores the dimensions an assurance provider will actually test: socious.io/csrd-check.

Socious Report takes one dataset into AI-drafted CSRD, SSBJ and ISSB reports, then adds an independent Socious Verify credential.