The Value Chain Cap Explained: What Customers Can Require From You

The value chain cap limits what a company in CSRD scope can require from suppliers with 1,000 or fewer employees. For CSRD reporting purposes, it cannot require information beyond what the Voluntary Standard (VS, formerly VSME) specifies, and the supplier has a statutory right to decline the excess.

What is the value chain cap?

It is a legal ceiling on what large companies can demand from smaller suppliers for their sustainability reports. A company in CSRD scope may not require a protected supplier to provide information beyond the Voluntary Standard, and the supplier may refuse anything that goes further.

The cap exists because the Directive's authors found that suppliers, including small companies, were receiving disproportionate data requests despite earlier limits. It works in two directions: it restricts what the reporting company may demand, and it gives the supplier a right it can actively use.

Who does the value chain cap protect?

Any company in a reporting company's value chain with an average of 1,000 or fewer employees during the preceding financial year. The law calls these "protected undertakings". There is no turnover test and no requirement to be based in a particular country.

Two details matter in practice. First, size is measured on the preceding financial year, not the current one. Second, the reporting company may rely on your self-declaration of size and does not have to verify it, unless it knows, or should reasonably know, that the declaration is clearly wrong. You do not need to prove anything. You need to say it.

What exactly can a customer not require?

When collecting information for its CSRD report, a reporting company may not require a protected supplier to provide sustainability information beyond what the Voluntary Standard specifies. That applies to direct requests, to indirect requests through intermediaries, and to contracts.

The contract point is the strongest part of the rule. Any contractual provision that requires a protected supplier to provide more than VS for CSRD reporting is not binding. The rest of the contract stays in force, so you cannot use the cap to escape an agreement, only the clause that overreaches.

What does a customer have to tell you?

If a reporting company requests information from a protected supplier and some of it goes beyond the Voluntary Standard, it must inform the supplier which information exceeds the standard and that the supplier has a statutory right to decline to provide it.

This is the most underused protection in the package. It moves the burden onto the requester: you should not have to work out yourself which questions exceed VS. If a long questionnaire arrives with no such notice, that is worth raising, politely, before you spend a week answering it.

Does the cap apply to every request?

No. It applies only to information gathered for sustainability reporting under CSRD. It does not cover requests for due diligence, risk management or other purposes, it does not stop you sharing more voluntarily, and it does not override existing obligations to provide information within VS.

The boundaries, laid out:

Due diligence deserves a note. The same Directive raised the CSDDD thresholds sharply, to 5,000 employees and €1.5 billion turnover, and asks those companies to request information from business partners with fewer than 5,000 employees only where it cannot reasonably be obtained elsewhere. It is a different rule with a different logic, and the cap does not cover it.

When does the value chain cap take effect?

The Directive entered into force on 18 March 2026. Member States must bring the provisions containing the value chain cap into national law by 19 March 2027. Until your country has done so, check national status before relying on the right to decline.

The timing lines up with when requests will peak. The new CSRD scope applies to financial years beginning on or after 1 January 2027, so the companies that remain in scope will be gathering 2027 value chain data at the same time the cap becomes enforceable across the EU.

Can a customer estimate instead of asking you?

Yes. A reporting company can meet its value chain reporting requirement using information obtained directly from suppliers or using estimates, as appropriate. And a company that stays within the Voluntary Standard when collecting from protected suppliers is deemed to have met its value chain reporting obligation.

That second point is the part your customer's sustainability team may not have noticed. Staying inside the cap is not a compromise for them. The law treats it as compliance. That makes "here is our VS report" a stronger answer than it sounds.

Is there a three-year transition period before the cap applies?

No. This claim circulates widely and comes from a misreading. The Directive does contain a three-year transition, but it concerns the reporting company: during its first three years in scope, if value chain information is unavailable, it must explain its efforts and its plans to obtain it.

It is not a grace period during which the cap is suspended. The cap's timing is governed by national transposition, due by 19 March 2027. If someone tells you the protection does not apply until 2029 or 2030, ask them which provision they are reading.

The broader context of the Omnibus is in what the Omnibus changed for CSRD, and what to do when a request actually lands on your desk is in a customer asked for your VS (VSME) data: what now?

Start your VS report free with Zero →

Frequently asked questions

Does the value chain cap mean I can ignore data requests?
No. It limits what can be required, it does not remove demand. Nothing obliges you to provide sustainability information, but customers will still ask, and a VS report is designed to be a sufficient answer.

Do I have to prove I have 1,000 or fewer employees?
No. A reporting company may rely on your self-declaration of size without verifying it.

Does the value chain cap apply outside the EU?
The protection attaches to the request: it covers companies in the value chain of a company reporting under CSRD. The Directive does not limit protected undertakings to EU-based companies. National enforcement may vary.

Can my customer still ask for more than VS (VSME) covers?
Yes, but it must tell you which information goes beyond the Voluntary Standard and that you have a statutory right to decline it.