There is now a ceiling on the supplier questionnaire
On 21 September 2026, two delegated regulations were published in the Official Journal of the EU. One of them replaces the ESRS. The other is the one to read if you supply a large European customer.
Commission Delegated Regulation (EU) 2026/1560 establishes the Voluntary Sustainability Reporting Standard. Its formal title says what it is for: sustainability reporting standards “for voluntary use by undertakings protected by the value chain cap.” It enters into force on 24 September 2026.
The value chain cap is a limit on what a company inside CSRD scope may require from a smaller company in its value chain. It is the first time that limit has had a published, referenceable boundary.
What most people get wrong
When the Omnibus directive cut CSRD scope to companies above 1,000 employees and above €450 million net turnover — both tests, not two of three — a great many Irish and UK organisations concluded they were done with it. Roughly 80% of previously captured entities dropped out of scope.
Then the questionnaires kept arriving.
Being out of scope was never the protection. Your customer is in scope, and their report needs value chain data. Scope cuts move the reporting obligation; they do not move the data request. The protection is the cap.
The second misreading is about timing. The standard is in force from 24 September 2026, but the cap bites on information gathered for financial years beginning on or after 1 January 2027. Between now and then, what you send a customer is a negotiation, not an entitlement.
The dates
- 26 February 2026 — Omnibus I, Directive (EU) 2026/470, published in the Official Journal; in force 18 March 2026.
- 21 September 2026 — Regulation (EU) 2026/1560 (voluntary standard) and Regulation (EU) 2026/1563 (revised ESRS) published.
- 24 September 2026 — the voluntary standard enters into force.
- 10 November 2026 — the revised ESRS enters into force.
- Financial years beginning on or after 1 January 2027 — revised ESRS mandatory for in-scope companies; the value chain cap applies. First reports land in 2028.
- 19 March 2027 — deadline for Member States to transpose Omnibus I. Ireland has not done so yet.
That last point deserves a note. Ireland gold-plated its original CSRD transposition in 2024. It would be unwise to assume the EU thresholds arrive in Irish law entirely unaltered.
How the cap actually works
The voluntary standard has two modules: a Basic Module covering a short set of environmental, social and governance disclosures, and a Comprehensive Module with more detail.
Within them, individual disclosures carry tags. Only the ones tagged necessary form the cap. A CSRD reporter may require those. It may not require anything tagged voluntary, necessary if applicable, or the sector-information items.
There is additional proportionality at the small end: for organisations of ten employees or fewer, some disclosures that are otherwise necessary drop back to voluntary.
A customer can still ask for more than the cap allows. But under the Commission’s own explanatory note, where it does, it must identify which parts of the request exceed the cap and tell you that you may decline.
That is the genuinely useful part. It turns an awkward commercial conversation into an administrative one — you are not refusing a customer, you are answering the part of the request that carries an obligation and declining the part that, by the customer’s own flagging, does not.
Two things the cap does not touch. It does not restrict requests made under other regimes — CBAM data your importer needs, deforestation regulation data, and so on. And on the Commission’s reading it does not restrict ordinary commercial information exchange. If you have signed a contract that commits you to supplying data, the cap does not unsign it.
What it means in practice
If you hold ISO 14001 or ISO 50001, the Basic Module is largely a mapping exercise rather than a new data programme. Scope 1 and 2 emissions, energy consumption by source, headcount basics — most of that is an energy review and an aspects register wearing different clothes.
The gap is usually not the data. It is the boundary. The numbers exist, on a spreadsheet, drawn around a set of sites that does not match the set your customer is asking about, over a period that does not match their financial year.
Which leads to the practical consequence. Build the pack once, on one stated boundary, for one stated period, and answer every questionnaire from it. The alternative — answering each request from scratch as it arrives — is how an organisation ends up giving three customers three slightly different Scope 2 figures in the same quarter, and then spending a fortnight explaining why.
For UK organisations, the cap restricts what the CSRD reporter may require. On that reading it should follow the requester rather than the supplier, and so apply to a UK supplier of an EU customer. We would read it that way, but it is not spelled out in the guidance, and it is worth raising with the customer rather than assuming.
What to do this quarter
- List who is actually asking. Take every customer who sent you a sustainability questionnaire in the last 18 months and work out which of them will be CSRD reporters for FY2027. That tells you who the cap will apply to and who it will not.
- Read the Basic Module against what your management system already produces. Mark each disclosure as have it, nearly have it, or do not have it. Most organisations with a certified system are further along than they expect.
- Fix the boundary before the numbers. Write down which entities, which sites, which twelve months, and which Scope 2 method. Disagreements in supplier questionnaires are far more often about what is inside the number than about the number.
- Build one data pack on FY2026, even though the cap does not apply to it. FY2026 is the rehearsal. FY2027 is the one that counts, and you will not want to be designing the process and running it in the same quarter.
- If you are the large customer, review your own questionnaire now. From FY2027, anything you ask beyond the cap has to be flagged as beyond the cap, with the supplier told they may decline. Better to find that out from your own review than from a supplier’s solicitor.
A short close
None of this obliges a smaller organisation to report anything. The voluntary standard is voluntary, and the name is accurate. What changed on 21 September is that there is now a defined ceiling on what a large customer can require, and a published standard describing what sits underneath it.
The organisations that will find FY2027 straightforward are the ones that build the pack in the next few months, while the requests are still negotiable. The ones that wait will be building it in the middle of being asked.
ISO Align helps organisations in Ireland and the UK build ISO 14001 and ISO 50001 management systems that produce this kind of evidence as a by-product of running well, rather than as a separate reporting exercise. If supplier data requests are starting to take up more of your week than they should, you can book a demo.
Sources: Commission Delegated Regulation (EU) 2026/1560 — voluntary standard for undertakings protected by the value chain cap · European Commission — Commission adopts revised sustainability reporting standards (3 July 2026) · European Commission — additional explanatory information regarding the value chain cap (6 May 2026) · EFRAG — delegated act on revised ESRS and voluntary sustainability reporting standard · Linklaters — revised ESRS and voluntary reporting standard published in the Official Journal · Arthur Cox — Ireland transposes Stop-the-Clock Directive and clarifies CSRD scope · William Fry — Omnibus 1 Directive: what this means for Irish companies
