A Customer Asked for Your VS (VSME) Data. What Now?

When a customer asks for your sustainability data, they usually need it for their own CSRD report. You are not legally obliged to provide it, but if you have 1,000 or fewer employees, a report under the Voluntary Standard (VS, formerly VSME) is designed to be a sufficient answer.

Why are customers asking for your sustainability data?

Because the law requires them to report on their value chain. A company in CSRD scope must disclose information about its own operations and its value chain, and much of that information sits with suppliers. Your data is an input to their report.

This is the part most suppliers misread. The request is rarely a judgement about your company. It is a large organisation trying to fill a column in its own report before a deadline. Understanding that changes how you answer, because what your customer actually needs is usually narrower than the questionnaire they sent. Which companies are still in scope after the Omnibus is covered in who must report under CSRD now.

Do you have to answer?

Not legally. The Directive that introduced the value chain cap states plainly that it does not impose any obligation on any company in the value chain to provide sustainability information. In practice, declining to answer a large customer is rarely a real commercial option.

So the useful question is not whether to answer but how much. That is where the law helps you. If you are a protected undertaking, a complete report against the Voluntary Standard is designed to be enough. The detail of what that protects you from is in the value chain cap explained.

What can a customer require from you?

If you have 1,000 or fewer employees, a customer cannot require you to provide sustainability information beyond what the Voluntary Standard (formerly VSME) specifies, when the request is for CSRD reporting. Contract clauses demanding more are not binding, and you have a statutory right to decline the excess.

The protection has limits worth knowing before you rely on it. It covers requests made for sustainability reporting, not requests made for due diligence or risk management. It does not stop you sharing more if you choose to. And it becomes enforceable through national law, which Member States must adopt by 19 March 2027.

What will a customer most likely ask for?

Emissions first. Under the GHG Protocol, your Scope 1 and 2 emissions become part of your customer's Scope 3, so a CSRD reporter needs them to complete its own inventory. Energy use, workforce figures and basic governance information usually follow.

I spent years building and selling the enterprise ESG platforms large companies use for exactly this reporting. The breakdown by type of requester, and why banks ask different questions from customers, is in which VS (VSME) data customers actually ask for.

How do you answer without starting a new project for every customer?

Build one report against the Voluntary Standard and answer every request from it. Most questions in a customer questionnaire map onto a VS disclosure. Answering from a single, consistent dataset is faster, and it avoids giving two customers two different numbers for the same thing.

That is the reason the standard exists. Before the standard existed, a supplier with three large customers often answered three questionnaires in three formats. The Directive explicitly sets the standard's purpose as meeting the data needs of companies requesting sustainability information from their suppliers. How to do the mapping in practice is covered in answering ESG questionnaires with one VS (VSME) report. If you have not built a report yet, start with the complete guide to VS (VSME) reporting.

What should you do in the first week after a request arrives?

Read the request for its purpose and deadline, check what you already have, and answer the emissions questions first. If you have 1,000 or fewer employees, say so: a reporting company may rely on your self-declaration of size without verifying it.

A practical order that works:

1. Identify the purpose. Is the request for the customer's CSRD report, or for due diligence or procurement? The cap applies only to the first.
2. Declare your size. If you are a protected undertaking, tell them. They do not need to verify it.
3. Collect energy and fuel data. Your Scope 1 and 2 emissions are built from it, and they are the most likely to be asked for.
4. Map the rest to VS. Anything that fits a VS disclosure goes in your report.
5. Flag what exceeds VS. Answer it if you want to and can. You are not required to.

What if the request goes beyond the Voluntary Standard?

You may decline the part that goes beyond it. A reporting company that asks for more than VS covers is required to tell you which information exceeds the standard, and that you have a statutory right to refuse it.

That obligation is the most underused protection in the whole package. If a request arrives without that notice and asks for more than VS covers, the requester is not following the rules. Most of the time the right response is not a refusal but a conversation: offer your VS report, and ask what they actually need beyond it.

Start your VS report free with Zero →

Frequently asked questions

Is a VS (VSME) report enough to answer a customer's data request?
For companies with 1,000 or fewer employees, the law is designed so that it is. Customers cannot require more than the Voluntary Standard covers when the request is for their CSRD report.

Can my customer verify my company size?
They do not have to. A reporting company may rely on your self-declaration, unless it knows or should reasonably know the declaration is clearly wrong.

What if the request is for due diligence rather than reporting?
The value chain cap does not apply to due diligence requests. Those are governed by separate rules.

When can I rely on the value chain cap?
Member States must bring it into national law by 19 March 2027. Check the status in your own country.