Your customer sent you an ESG questionnaire. Here is what you must answer, and what you can decline.
If your customer is reporting under the EU Corporate Sustainability Reporting Directive and you have 1,000 employees or fewer, the amount of sustainability information it may require from you is fixed, finite and published — it is the list in Annex II of the Commission's voluntary reporting standard, and it runs to twenty-three items.
It may still ask for more, and plenty of what arrives in a questionnaire has nothing to do with the CSRD at all — so the useful skill is not answering faster, it is knowing which line each question falls on before you answer any of them.
Sort a real questionnaire into what you must, may and need not answer 24 questions · three verdicts · nothing leaves your browserA CSRD-reporting customer may require twenty-three sustainability datapoints from you, and no more
That is not an estimate or a rule of thumb.
It is the count of rows in Annex II of the delegated act the European Commission adopted on 3 July 2026, which sets the ceiling on what any company reporting under the CSRD may compel from a supplier with 1,000 employees or fewer.
The twenty-three are ordinary business facts, not a sustainability programme.
Your legal form and NACE code, your turnover and headcount, where your sites are, your energy in megawatt-hours, your Scope 1 and location-based Scope 2 emissions, your water withdrawal, your waste, your employees by contract type and gender, your accident rate, whether you pay at least minimum wage, your collective bargaining coverage, your training hours, and — if the comprehensive module is in play — your products, markets, main business relationships, turnover rate, a code of conduct, a complaints mechanism and any confirmed human rights incidents.
Most UK suppliers already hold twenty of those twenty-three somewhere in the business.
Above this line is everything a customer may ask you. Below it is the much smaller set it may require.
Almost every UK supplier questionnaire comes from one of four senders
They arrive in four different formats, on four different schedules, through four different portals — and underneath they want a largely overlapping set of facts.
The Commission has described this pattern in its own words, in the delegated act itself: requests are “sometimes disproportionate and submitted by means of differing, uncoordinated and overlapping questionnaires” [3].
That sentence is the reason the cap exists, and it is also the reason the answer to a questionnaire is an evidence pack rather than a document.
The value chain cap sits in Article 19a(3) of the Accounting Directive
Omnibus I — Directive (EU) 2026/470 [1] — inserted a block of new subparagraphs into Article 19a(3) of Directive 2013/34/EU, and a mirror block into Article 29a(3) for consolidated reporting.
Two further articles complete the machinery.
Article 29b(4) stops the ESRS themselves from specifying disclosures that would make a reporter go over the cap, so the constraint is designed into the standards rather than left to negotiation [1].
Article 29ca is the article Omnibus I inserted to create the voluntary standard itself — the document that supplies the ceiling's content, required to be based on Commission Recommendation (EU) 2025/1710 of 30 July 2025 and to be adopted by 19 July 2026 [1].
If you want the cap from the reporting company's side — what it means for scoping an assessment rather than for answering a request — that belongs to double materiality assessment, where the same provision is treated as a limit on assessment scope.
Sort a real questionnaire into capped, uncapped and UK‑statutory
Below is a twenty-four-question supplier pack of the kind a mid-sized UK manufacturer receives, with every row classified against Annex II, against UK legislation, and against nothing at all.
Set your headcount and who is asking, and the classification recomputes — because both of those change the answer, and neither of them is a matter of opinion.
The rule the instrument applies has three steps, and it is worth being able to run it by hand.
First, is the question in Annex II at your size band? If it is, and the request is for CSRD reporting, you can be required to answer it.
Second, is it outside Annex II? Then for CSRD purposes it is a request, not a requirement, and your customer is supposed to have told you so.
Third — and this is the step most guides skip — is it something UK law requires of you anyway? SECR, the Modern Slavery Act and ESOS do not care what the cap says, and a question that maps onto one of them is a question you were going to have to answer regardless.
With ten employees or fewer, the ceiling drops to nine datapoints
The Commission marked several disclosures that are “necessary” for undertakings with 11 to 1,000 employees as merely voluntary for undertakings with ten or fewer — which removes them from the cap for the smallest suppliers entirely [2].
The Commission's stated reason is proportionality, and it says so plainly: companies with ten employees or fewer are “given extra protection from the trickle-down effect” [2].
The practical consequence for a ten-person consultancy is large.
Every environmental number in the pack — energy, emissions, water, waste — sits above your cap, which means a CSRD customer may ask for it and may not insist on it.
What the cap does not cover is the more useful list
Annex II is a closed list, so everything the voluntary standard contains but Annex II omits is, for CSRD purposes, optional.
None of this makes those questions improper.
It makes them requests — and a request is a commercial conversation with a scope you can negotiate, which is a different thing from a requirement you have to satisfy.
Scope 3 is the biggest of these by a distance, and the UK side of it has its own page: UK SRS Scope 3 reporting covers what the UK standards ask for, the one-year relief, and the SECR slice that is genuinely mandatory.
Three things the cap never touches
Recital 12 of Omnibus I sets out the boundaries of the cap itself, and each one matters more to a UK supplier than the cap does [1].
That third carve-out is where most real disputes will land.
A large customer can restate an over-cap question as a risk-management or due-diligence question and be entirely within its rights — and the honest position is that this makes the cap a strong argument in a narrow lane rather than a shield across the whole questionnaire.
The Commission's own guidance closes the same point from the other end: even inside the lane, reporters “should only seek to obtain the information that they really need”, and Recital 12 asks them to request less than the standard where they need less [2].
Does the cap protect you today? Not yet, and here is why
Two clocks are still running, and neither has stopped.
So the accurate sentence today is not “I have a statutory right to decline”.
It is closer to: the EU has legislated a ceiling on what you can be required to provide, your customer's member state must have it in force by 19 March 2027, and any contract term that conflicts with it will not be binding once it is.
That is a weaker claim than the internet is currently making, and it is a considerably more useful one in a negotiation, because it is true and it is checkable.
It also has a practical edge: a supply agreement being signed now, that runs past March 2027, and that obliges you to provide whatever sustainability data the customer requests for its CSRD report, is being drafted into a clause that is about to become unenforceable in part.
The clause that will not be binding
Of everything in Omnibus I, the provision least discussed and most useful to a supplier is the one about contracts.
Article 19a(3) tells reporting undertakings that, “when establishing contractual and other arrangements for the purpose of meeting the sustainability reporting requirements of this Directive”, they “shall not require protected undertakings to provide information exceeding the information specified in the voluntary standards” [1].
And then: “any contractual provision contrary to point (a) shall not be binding, without however affecting the binding nature of the remaining provisions of the contract” [1].
Two limits keep this honest.
It applies to arrangements made for the purpose of CSRD reporting, so a data clause drafted for quality assurance, due diligence or risk management is outside it.
And it is a directive provision, so it reaches your contract through your customer's national implementing law rather than directly — which brings you back to 19 March 2027.
Your headcount is established by your own declaration
The mechanism is deliberately light, and it is set out in Recital 12 and in the operative text [1].
Reporting undertakings “may rely on a self-declaration” from value-chain undertakings to determine whether they are protected undertakings.
They “shall not be required to take steps to verify the information contained in such a self-declaration”.
The one qualification: they may not rely on it where they know, or can reasonably be expected to know, that it is manifestly incorrect.
So the practical step for a UK supplier is a single line in the covering email, stating the average number of employees during the preceding financial year and the balance sheet date it is measured at.
Get the basis right: the test is the average number of employees over the preceding financial year, assessed at the balance sheet date — not headcount today, and not full-time equivalents unless that is how you count everywhere else.
Three UK regimes make you answer regardless of any cap
This is the separation the incumbent guides blur, and it is the one that changes what a UK supplier actually does on a Monday morning.
The point of putting these three beside the cap is not that they are similar.
It is that they are the opposite: the cap tells you what you may decline, and these tell you what you cannot — and a questionnaire row that maps onto one of them is not a negotiation at all.
Depth on each lives with the page that owns it: SECR requirements for the reporting duty, a SECR figure template if you need to build the number, ESOS deadlines for the Phase 4 dates, and ESG frameworks in the UK for how the whole set fits together.
UK SRS S1 and S2 are voluntary, and the FCA's proposal is still a proposal
A questionnaire that asks whether you report against UK SRS is asking about something no UK company is currently obliged to do.
The Department for Business and Trade published UK SRS S1 and S2 on 25 February 2026 for voluntary use.
The FCA consulted on making UK SRS S2 mandatory for certain listed companies in CP26/5, which opened on 30 January 2026 and closed on 20 March 2026 — and no Policy Statement had been published as at 8 August 2026 [11].
So a supplier asked “do you comply with UK SRS?” is being asked about a voluntary framework, and the correct answer for most UK SMEs is a plain no with a sentence explaining that it is not yet mandatory for anyone.
The detail sits on its own pages: UK SRS S1, UK SRS S2, UK SRS thresholds and who is in scope for who would be caught if the proposal is made, and the FCA's own authority for how CP26/5 would make it binding on listed companies.
Four senders. Seven artefacts. Build them once.
Every questionnaire in the world resolves to a small set of underlying evidence, and the whole economics of this problem is in how much of that evidence is shared.
An artefact earns an edge below only where that sender's published question set genuinely asks for it — so the sparse rows are as informative as the dense ones.
The number that matters is the reuse ratio, and it is the argument for doing this work as a project rather than as a response.
Seven artefacts, built once, answer the great majority of every one of these senders' question sets — and the marginal cost of the next questionnaire is then the cost of reformatting, not the cost of finding out.
EcoVadis: a percentile, not a score threshold
EcoVadis rates more than 150,000 companies, across 185+ countries and 250+ spend categories, and more than 1,400 enterprise customers use it to review trading partners [12].
The questionnaire is tailored to your industry, size and country, which is why two suppliers compare notes and find they were asked different things.
Three facts about medals are worth having before you set an internal target.
The percentile is calculated at scorecard publication and compares you with all companies assessed over the previous 12 months across all industries worldwide — not within your sector [13].
Medals and badges are valid for 12 months, in line with the scorecard they sit on [13].
And they apply only to the assessed entity, “not to any affiliated entity such as a parent or sister company, site, or subsidiary” [13] — so a group medal does not travel to the subsidiary your customer is actually buying from.
EcoVadis does not publish score thresholds for its medals. The specific point-score figures circulating on consultancy blogs are third-party estimates from private client portfolios, not published criteria, and this page does not repeat them.
CDP Supply Chain: 45,000 suppliers, asked by 270 buyers
CDP is a disclosure system rather than a rating, and a supply-chain request comes from a named customer that has paid to ask you.
Two things follow from that shape.
Being asked is common and scoring well is not, so a mid-band CDP score is an ordinary outcome rather than a failure.
And a CDP request is a customer's request routed through CDP, which means the value chain cap can apply to it exactly as it would to a spreadsheet — the format does not change the legal character of the ask.
The CSRD-reporting EU customer
This is the only sender whose request the cap governs, and it is worth establishing whether your customer really is one.
After Omnibus I, CSRD applies from financial years beginning on or after 1 January 2027 only where an undertaking exceeds both 1,000 employees and €450 million net turnover [9].
That is a much smaller population than the pre-Omnibus scope, and any guide still quoting “50,000 companies in scope” is describing a regime that no longer exists.
If the customer asking you is a €200m European manufacturer, it is probably not a CSRD reporter at all — in which case the cap never applied to its request, and what governs is your contract.
The full UK-versus-EU comparison, including who is caught by what, is on CSRD vs UK SRS.
UK procurement teams and tender question sets
No cap applies to a UK plc's supplier pack, and pretending otherwise is the fastest way to lose a tender.
What governs here is the contract, the prequalification rules of the buying organisation, and whatever the tender documents say about scoring.
The useful move with a UK buyer is not to decline but to scope: offer the Annex II set as a complete, coherent, evidenced pack, and treat anything beyond it as a question about proportionality that you are happy to discuss.
That reads as competence rather than resistance, and it is the same pack you would send an EU customer — which is the whole point of building it once.
Where a public body is buying, the sustainability questions usually sit inside a standard selection questionnaire, and the scoring weight attached to them is normally published in the tender documents.
The seven evidence artefacts that answer almost everything
Build these once, keep them current, and the next questionnaire becomes a formatting exercise.
Nothing in that list is a sustainability programme.
Six of the seven are records a competent business already keeps, and the seventh — the emissions calculation — is arithmetic over the first.
If you want a structure to hold them in, the ESG reporting template sets out the sections and where each number belongs.
The one number every sender wants, and how it is defined
Annex II's emissions row is precise about what it wants, and the precision is a gift.
B3 paragraph 33 asks for “estimated absolute gross greenhouse gas (GHG) emissions generated during the reporting period in metric tonnes of CO2 equivalent”, considering the content of the GHG Protocol Corporate Accounting and Reporting Standard (2004), comprising Scope 1 from owned or controlled sources and location-based Scope 2 [4].
Three words in that do real work.
Estimated means a well-documented estimate is contemplated by the standard itself, not a concession you are asking for.
Location-based means the grid-average method, so a renewable tariff does not reduce the capped figure — a market-based number is a separate, uncapped disclosure you may choose to offer alongside.
Gross means before any offsets or removals.
For a UK supplier the practical build is short: twelve months of consumption from bills, the current UK Government greenhouse gas conversion factors, and a one-page method note saying which factor set and which reporting period you used.
Software choices for holding this are compared on carbon reporting software, and the data plumbing on ESG data management.
Classify the whole questionnaire before you answer any of it
The single change that most reduces the work is doing the sort first, in one sitting, on the whole document.
Answer a triage question about your own position and the instrument returns the order of work for your case, with the reasoning for each bucket.
Sorting first also changes who does the work.
The capped rows are finance and HR questions with known owners, the UK-statutory rows belong to whoever already files them, and only the uncapped remainder needs a judgement call about how much to volunteer.
A blank reads as a failure. “Not yet, and here is when” reads as competence.
Most scoring systems treat a missing answer and a low answer very differently, and neither of them the way suppliers expect.
An empty field is unscoreable, so it collects the minimum available.
A stated position with a date attached is scoreable, and it also gives the assessor something to record as improvement next cycle.
The same principle governs evidence.
One independently verifiable anchor — a certificate with an issuer and an expiry, a filed statement, a metered figure — is worth more than ten assertions, because it is the only kind of answer an assessor can confirm without asking you again.
And nothing on a questionnaire should say something the business could not defend to a customer, an auditor or a journalist reading it in two years' time.
The reply you can send when a request goes above the cap
This is the sentence the rest of the page exists to make it safe for you to write.
Note what the reply does not do.
It does not refuse, it does not cite the cap as a reason to stop talking, and it does not claim a right that is not yet in the customer's national law.
It states a completed position, names the boundary, and reopens the conversation about everything above it — which is what the Commission itself expects, since the reporter is supposed to be asking for less than the standard where it needs less [2].
What to do with the questionnaire that is currently open on your desk
In order, and none of these steps needs a consultant.
Done in that order, the first questionnaire is expensive and every subsequent one is cheap.
Done in the order the questionnaire arrives in, every one of them is expensive, for ever.
Twenty-three chapters, and the list at the centre of all of them still has twenty-three rows.
An ESG questionnaire is a commercial document with a small legal core, and the work that pays is sorting the two apart before you answer a single question.
The questionnaire in front of you is one of many, and the only work that survives all of them is the evidence pack underneath.
Build the pack — the ESG reporting template Or see how CSRD and UK SRS differ, and which one your customer reports underAnnex II in full — every datapoint covered by the value chain cap
Reproduced from Annex II to the Commission Delegated Regulation adopted on 3 July 2026 [3]. A tick means a customer reporting under the CSRD may require it from an undertaking in that size band.
Twenty-three rows for undertakings with 11 to 1,000 employees; the nine marked “both bands” for undertakings with ten employees or fewer.
What this page covers, and what it hands off
This page owns one question: a customer has sent you a sustainability questionnaire, and you need to know what to do with it.
It is not a guide to reporting under any framework, and where a subject has a page of its own the depth lives there.
The overlap that most needs naming is the value chain cap itself, which appears on two pages for two different readers: here as the supplier's right to decline, and on double materiality assessment as a limit on assessment scope.
The regime-level picture — which UK rules exist and how they interlock — belongs to ESG reporting in the UK and ESG frameworks in the UK.
A UK-listed company fields a related but distinct kind of request — from its own investors rather than from a customer — and that is FCA sustainability disclosure requirements, a different regime with a different sender.
The terms that appear in a questionnaire and are rarely explained
Common questions answered
Direct answers on what you can be required to provide, what you can decline, and what UK law makes you answer regardless.
An ESG questionnaire is a set of sustainability questions sent to a supplier by a customer, a procurement team, a ratings provider such as EcoVadis, or a disclosure platform such as CDP. It typically asks for energy and emissions figures, workforce data, policies, certifications and information about your own suppliers. The European Commission has described the pattern in its own words: requests are often "disproportionate and submitted by means of differing, uncoordinated and overlapping questionnaires". A questionnaire is usually a commercial document, but part of it may be governed by law on both sides.
If your customer is reporting under the EU Corporate Sustainability Reporting Directive and you have 1,000 employees or fewer, it may require only the datapoints listed in Annex II of the Commission's voluntary reporting standard, adopted on 3 July 2026. That is 23 datapoints for undertakings with 11 to 1,000 employees, and 9 for undertakings with 10 employees or fewer. This is the value chain cap in Article 19a(3) of Directive 2013/34/EU, as amended by Directive (EU) 2026/470. It applies only to information gathering for CSRD reporting, and not to requests made for due diligence, risk management or ordinary commercial purposes.
You can decline questions that exceed the value chain cap where the request is made for CSRD reporting purposes, because Article 19a(3) gives protected undertakings a statutory right to decline. Two qualifications matter. First, the cap is a directive provision and member states are required to bring it into national law by 19 March 2027, so in most member states it is not yet directly enforceable between two private companies. Second, the cap does not reach a request made for any other purpose. In practice a scoped, complete answer plus an offer to discuss the rest is more effective than a refusal.
No. Annex II includes one emissions datapoint, at B3 paragraph 33, and it covers estimated absolute gross Scope 1 emissions and location-based Scope 2 emissions only, on the basis of the GHG Protocol Corporate Accounting and Reporting Standard (2004). Scope 3 does not appear anywhere in Annex II. Nor do GHG reduction targets, climate transition plans or climate risk disclosures, which sit in the comprehensive module at C3 and C4 but are outside the cap.
The test is an average of 1,000 employees or fewer during the preceding financial year, measured at your balance sheet date. There is no turnover leg and no sector test. Your customer may rely on your own self-declaration of size and is not required to verify it, unless it knows or could reasonably be expected to know that the declaration is manifestly incorrect. If you have more than 1,000 employees you are not a protected undertaking and the cap does not apply to you at all.
Article 19a(3) of the Accounting Directive as amended says that a reporting undertaking must not require a protected undertaking to provide information exceeding the voluntary standard in contractual arrangements made for the purpose of CSRD reporting, and that any contractual provision contrary to that "shall not be binding, without however affecting the binding nature of the remaining provisions of the contract". The over-cap part is severed and the rest of the contract survives. This reaches your agreement through your customer's national implementing law, for which the deadline is 19 March 2027.
Three. Section 54 of the Modern Slavery Act 2015 requires a slavery and human trafficking statement from commercial organisations with total turnover of £36 million or more, where total turnover includes the turnover of subsidiary undertakings. SECR requires large UK companies and LLPs meeting two of three thresholds — £36m turnover, £18m balance sheet, 250 employees — to report energy and carbon in the annual report. ESOS requires organisations with 250 or more employees, or turnover over £44m and a balance sheet over £38m, to complete energy assessments, with Phase 4 qualification on 31 December 2026 and compliance by 5 December 2027. None of these is affected by the EU value chain cap.
EcoVadis publishes percentiles, not score thresholds. Platinum is awarded to the top 1% of companies assessed in the 12 months prior to the medal issue date, Gold to the top 5%, Silver to the top 15% and Bronze to the top 35%. The percentile is calculated at scorecard publication and compares a company with all companies assessed over the previous 12 months across all industries worldwide, not within a specific industry. Medals are valid for 12 months and apply only to the assessed entity, not to a parent, sister company, site or subsidiary. Point-score figures circulating on consultancy sites are third-party estimates, not published criteria.
Approximately 45,000 suppliers were requested to disclose through CDP's Supply Chain programme in 2025, by more than 270 corporate buyers who are members of that programme. Over 22,100 companies disclosed environmental data through CDP in 2025 in total, of which around 20,000 were scored. 899 companies made the 2025 Corporate A List, which is 5% of those scored, and 27 scored a Triple A.
No. The Commission is explicit that the value chain cap "does not impose or imply any obligation on any companies in the value chain to provide sustainability information". Using the voluntary standard is a choice. If you do apply it, you will have reported everything a CSRD-reporting customer could require of you for CSRD purposes — but that customer may still request additional information, either unrelated to CSRD or above the cap, and in the latter case it must tell you which items exceed the cap and that you may decline them.
No. A blank is unscoreable and generally collects the minimum available score, whereas a stated position with a date attached is scoreable and gives an assessor something to record. The better answer names the gap, the date by which you will have closed it, and the method you will use — for example that a figure will be available for the year ending 31 March 2027, calculated on UK Government greenhouse gas conversion factors. One independently verifiable anchor, such as a certificate with an issuer and an expiry date, is worth more than several unverifiable claims.
The rest of the subject
Every claim on this page, traced
Legislation and the regulator's own documents first. Where a figure comes from a commercial organisation about its own operations, that organisation is named and linked.
Reviewed 9 August 2026. The value chain cap is a directive provision and is not yet in national law in any member state; the delegated act defining its content was adopted on 3 July 2026 and remains in scrutiny. Both positions are stated on the page as at that date, and both will change.