ESRS Value Chain Cap Explained: Protected Undertakings, Supplier Requests and Reporting Relief

Technical status note. Directive (EU) 2026/470 entered into force at EU level and requires Member States to transpose Articles 1–3 by 19 March 2027. The practical enforceability and wording of the value-chain cap must therefore be checked in the relevant national law. The Commission adopted C(2026) 5011 final on 3 July 2026; its final Official Journal status remained an update trigger at 2 August 2026.

Use note. This article is educational, not legal advice. A supplier’s right to decline, a requester’s contractual restrictions and the treatment of mixed-purpose questionnaires depend on the applicable national law, contract, legal purpose and final regulatory texts.

Many supplier questionnaires combine several business purposes: ESRS reporting, human-rights or environmental due diligence, product regulation, customer onboarding, credit risk, sanctions screening, safety, procurement qualification and voluntary sustainability programmes. The value-chain cap does not classify an entire questionnaire simply by counting questions. It applies to information gathering for the purpose of sustainability reporting required by Directive 2013/34/EU.

The same datapoint can therefore have a different legal basis in different contexts. A customer may be unable to require an above-cap field for its ESRS report but may have a separate legal or contractual basis to request related information for product compliance or due diligence. Conversely, labelling every field “due diligence” does not automatically remove the reporting purpose. Requesters need a purpose register and field-level mapping; suppliers need enough information to understand what is being asked and why.

1. Who is a reporting undertaking?

For the cap provisions, a reporting undertaking is an undertaking required to report sustainability information under Article 19a or a parent undertaking required to report consolidated sustainability information under Article 29a of Directive 2013/34/EU. The cap is therefore linked to a statutory reporting obligation, not simply to an organisation that voluntarily says it follows ESRS.

2. Who is a protected undertaking?

The amended directive defines a protected undertaking through two conditions:

it does not exceed an average number of 1,000 employees during the preceding financial year; and

it is in the value chain of the reporting undertaking.

A reporting undertaking may rely on a supplier’s self-declaration and is not required to verify it, unless it knows or can reasonably be expected to know that the declaration is manifestly incorrect. A useful self-declaration should identify the legal entity, employee calculation period, population method, approver and date. It should not be a generic group statement where the request is addressed to a different legal entity without explanation.

3. What is the upper limit?

The upper limit is the information specified in the Commission’s standards for voluntary use. Revised ESRS 1 paragraph 66 links the cap to the datapoints in Annex II of C(2026) 5011. The practical control is a field-level crosswalk: each requested item should be classified as within the Annex II cap, above the cap, unclear, or required for another separately identified purpose.

The cap is an upper limit, not a default questionnaire. The directive emphasises necessity: a reporter should request less than the full voluntary-standard dataset where less information is needed for its material disclosures.

4. What protections apply to above-cap requests?

For the covered reporting purpose, protected undertakings have a right to decline information that exceeds the voluntary-standard limit. The amended directive also provides that:

contractual and other arrangements established for meeting the reporting requirements must not require protected undertakings to provide above-cap information;

a contractual provision contrary to that restriction is not binding, while the remainder of the contract can remain binding;

where the reporter requests above-cap information directly or indirectly, it must identify which information exceeds the standard and inform the protected undertaking of the statutory right to decline;

a reporter that reports the necessary value-chain information without obtaining above-cap information from protected undertakings is deemed to have complied with the value-chain obligation in that respect.

These rules should be reflected in procurement templates, supplier portals, consultant questionnaires and requests routed through intermediaries.

5. What is outside the cap?

The cap does not affect requests for other purposes, including Union due-diligence obligations or the reporter’s risk management. It also does not prevent voluntary sharing. However, an “other purpose” should be genuine, documented and proportionate. A requester should identify the legal, risk or commercial decision supported by the field rather than using a vague multi-purpose label.

The cap also does not create or imply a supplier obligation to provide sustainability information. Whether within-cap information must be provided depends on other law, contract and the facts. This is an important negative boundary: the cap protects against exceeding a limit, but it is not itself a general data-supply mandate.

6. How does the reporter complete ESRS reporting?

The reporter remains responsible for material value-chain information. Revised ESRS permits the use of directly collected data or estimates depending on practicability and reliability. Directive (EU) 2026/470 also provides a first-three-year transition: where not all necessary value-chain information is available, the undertaking explains its efforts, why the information could not be obtained and its plans to obtain it. After that transition, it meets the requirements using direct information or estimates as appropriate.

The cap therefore changes the collection strategy, not the reporting objective. A mature approach combines targeted requests, internal information, procurement and transaction data, external datasets, samples and documented estimates.

Figure 1. Requester decision tree. Purpose, protected status and Annex II mapping should be resolved before a questionnaire is issued.

Question 1. What precise purpose does the field serve?

Classify the request at field or coherent section level. Useful purpose codes include:

statutory ESRS/Accounting Directive sustainability reporting;

sustainability due diligence;

product or sector regulation;

risk management or underwriting;

financing or credit assessment;

procurement qualification or contract performance;

voluntary programme or supplier-development support.

A field may support more than one purpose, but each material purpose should be recorded. Where the reporting purpose is one of several, the cap analysis is still needed for that purpose.

Question 2. Is the recipient a protected undertaking?

Request a proportionate self-declaration. Do not demand group-wide HR files merely to verify the threshold. Escalate only where the declaration is manifestly inconsistent with information already known to the requester.

Question 3. Is each field within the voluntary-standard cap?

Map to Annex II, including definitions, units and scope. A superficially similar field can still be above cap if it asks for extra granularity, a wider population, audit evidence, forward-looking projections or proprietary methodology not required by the voluntary standard.

Question 4. Is less information sufficient?

Link each field to a material IRO, disclosure, metric or control. Remove fields that are merely “nice to have”, duplicated across sections or already available internally. The value-chain cap is complemented by the general principle that requests should be necessary.

Question 5. How will unavailable information be replaced?

Define the estimate hierarchy before launch: internal purchase or sales data, product or asset attributes, direct samples, supplier-category factors, sector averages, geographic risk data and other proxies. This prevents the supplier portal from becoming the only route to compliance.

Figure 2. Supplier decision tree. A controlled response separates protected status, purpose, field classification, response choice and retained evidence.

Step A. Ask the requester to identify purpose and legal context

A supplier should not have to infer the legal basis from a broad “ESG questionnaire” label. Ask which fields are for ESRS/Accounting Directive reporting, which are for other legal or commercial purposes, which legal entity is the reporter and which Member State law applies.

Step B. prepare the protected-undertaking self-declaration

Use the preceding financial year and the legal entity responding to the request. Document the employee population and averaging method. Where a group responds centrally for several entities, state which entities meet the test and how the calculation was made.

Step C. classify fields

Use four response codes:

within cap — mapped to the applicable voluntary-standard datapoint;

above cap — additional scope, granularity or evidence for the reporting purpose;

other purpose — separately identified legal, risk or commercial purpose;

unclear — requester has not provided enough information.

Step D. choose a controlled response

Provide within-cap information where the supplier decides or is otherwise required to do so. For above-cap fields within the covered reporting purpose, exercise the applicable right to decline or share voluntarily under controlled terms. Voluntary sharing should not be accidental: define confidentiality, permitted use, onward disclosure, reliance and update expectations.

Step E. retain the response file

Keep the questionnaire version, purpose statement, field mapping, self-declaration, correspondence, approvals, disclosed evidence and any refusal or voluntary-sharing rationale. This record is useful if the request changes, a platform republishes the data or an assurance provider asks how the response was governed.

The accompanying Excel workbook contains a REQUEST REGISTER and SUPPLIER RESPONSE sheet. A requester-side register should include:

Context. A large listed manufacturer asks a 430-employee component supplier to complete 160 questions. The cover email says the information is required “for ESG compliance, due diligence, risk management and customer expectations”.

Field group 1 — ESRS reporting. Questions request the supplier’s energy use, location-based GHG emissions, workforce headcount and certain policy information. The requester maps these to the voluntary-standard datapoints and identifies the reporting entities relying on them.

Field group 2 — above-cap reporting detail. The questionnaire asks for hourly plant-level energy data, five-year forecasts, underlying invoices and a bespoke transition-model file. These fields go beyond the voluntary-standard information for the reporting purpose. The requester identifies them as extra and informs the supplier of the applicable right to decline.

Field group 3 — product regulation. Questions ask for restricted-substance test certificates required for product compliance. They are outside the cap because their purpose is not Accounting Directive sustainability reporting. The requester cites the separate requirement and avoids presenting them as ESRS fields.

Field group 4 — due diligence. A targeted set of worker-rights questions supports a separately documented due-diligence process. The requester explains the purpose and legal basis. It does not simply relabel every sustainability question as due diligence.

Outcome. The supplier provides within-cap data, supplies product certificates, responds to the targeted due-diligence section and declines the bespoke reporting forecasts. The reporter uses purchase volumes, product data and sector factors to estimate a remaining emissions input. Both parties retain a field-level record.

Why it works. The wording identifies purpose, within-cap and above-cap fields, the decline right and a separate non-reporting purpose. It does not claim that the supplier must provide all within-cap information or that the cap applies identically before national transposition.

Evidence required. Legal mapping, current Annex II crosswalk, requester approval, national-law check, questionnaire version and supplier communication log.

Is the threshold exactly 1,000 employees or fewer?

The directive definition covers an undertaking that does not exceed an average of 1,000 employees during the preceding financial year. The calculation method and national implementation should be checked for the relevant jurisdiction.

Can a reporter ignore a self-declaration it distrusts?

It may rely on the self-declaration without verification but should not rely on it where it knows, or can reasonably be expected to know, that it is manifestly incorrect. The threshold is not a licence for routine audits of suppliers.

Does the cap apply to non-EU suppliers?

Revised ESRS 1 paragraph 66 states that the limitation also applies to non-EU undertakings in the reporter’s upstream and downstream value chain. Practical legal enforcement and contract design still require jurisdictional advice.

Is the 2025 VSME Recommendation automatically the final cap?

The 2026 voluntary standards are based on the earlier recommendation, but the operative cap should be mapped to the final delegated act and Annex II applicable at the reporting date. Version control is essential.

What happens when a supplier refuses an above-cap field?

The reporter should not treat the refusal as a reason to omit material value-chain information. It should use appropriate direct information, estimates and transparent limitations, and retain evidence of its request and alternative methodology.