Short answer
The answer, before the reasoning
The value-chain cap limits the sustainability information that an ESRS reporting undertaking may require from a protected undertaking for the purpose of reporting under the Accounting Directive. A protected undertaking is in the reporter’s value chain and does not exceed an average of 1,000 employees in the preceding financial year.
For that reporting purpose, requests should be mapped to the datapoints listed in Annex II to Delegated Regulation (EU) 2026/1560, which is narrower than the full voluntary standard and shorter still for undertakings with 10 or fewer employees; above-cap fields cannot be made contractually mandatory and the protected undertaking must be told which fields exceed the cap and that it may decline them. The cap does not remove the reporter’s own reporting obligation, apply to every other request purpose or create a general supplier duty to provide information.
Technical status note. Directive (EU) 2026/470 entered into force at EU level and requires Member States to transpose Articles 1–3 by 19 March 2027. The practical enforceability and wording of the value-chain cap must therefore be checked in the relevant national law. The Commission adopted the standard for voluntary use on 3 July 2026; it was published in the Official Journal on 21 September 2026 as Commission Delegated Regulation (EU) 2026/1560 and entered into force on 24 September 2026. Article 3 of that Regulation, which establishes the value-chain cap by reference to the datapoints in its Annex II, applies from financial years beginning on or after 1 January 2027. From 24 September 2026, Recommendation (EU) 2025/1710 no longer produces legal effects.
Use note. This article is educational, not legal advice. A supplier’s right to decline, a requester’s contractual restrictions and the treatment of mixed-purpose questionnaires depend on the applicable national law, contract, legal purpose and final regulatory texts.
Why the cap is a purpose-control, not a questionnaire-size rule
Many supplier questionnaires combine several business purposes: ESRS reporting, human-rights or environmental due diligence, product regulation, customer onboarding, credit risk, sanctions screening, safety, procurement qualification and voluntary sustainability programmes. The value-chain cap does not classify an entire questionnaire simply by counting questions. It applies to information gathering for the purpose of sustainability reporting required by Directive 2013/34/EU.
The same datapoint can therefore have a different legal basis in different contexts. A customer may be unable to require an above-cap field for its ESRS report but may have a separate legal or contractual basis to request related information for product compliance or due diligence. Conversely, labelling every field “due diligence” does not automatically remove the reporting purpose. Requesters need a purpose register and field-level mapping; suppliers need enough information to understand what is being asked and why.
In practice
Quick orientation
| Field | Practical orientation |
|---|---|
| Protected undertaking | An undertaking in the value chain of a reporting undertaking that does not exceed an average of 1,000 employees in the preceding financial year, subject to the applicable transposed law |
| Reporting purpose covered | Sustainability reporting required by Articles 19a or 29a of the Accounting Directive |
| Cap reference | Only the datapoints listed in Annex II to Delegated Regulation (EU) 2026/1560: 23 datapoints for undertakings with more than 10 employees and a shorter list of nine for undertakings with 10 employees or fewer; applies from financial years beginning on or after 1 January 2027 |
| Main supplier protection | Statutory right to decline above-cap information requested for the covered reporting purpose; contractual provisions requiring it are not binding under the amended directive framework |
| What the cap does not do | It does not prevent voluntary sharing, affect other request purposes, or imply a duty for suppliers to provide sustainability information |
| Reporter’s continuing duty | Report material value-chain information using direct information or estimates as appropriate, with transition disclosures and limitations |
The legal architecture in six parts
1. Who is a reporting undertaking?
For the cap provisions, a reporting undertaking is an undertaking required to report sustainability information under Article 19a or a parent undertaking required to report consolidated sustainability information under Article 29a of Directive 2013/34/EU. The cap is therefore linked to a statutory reporting obligation, not simply to an organisation that voluntarily says it follows ESRS.
2. Who is a protected undertaking?
The amended directive defines a protected undertaking through two conditions:
it does not exceed an average number of 1,000 employees during the preceding financial year; and
it is in the value chain of the reporting undertaking.
A reporting undertaking may rely on a supplier’s self-declaration and is not required to verify it, unless it knows or can reasonably be expected to know that the declaration is manifestly incorrect. A useful self-declaration should identify the legal entity, employee calculation period, population method, approver and date. It should not be a generic group statement where the request is addressed to a different legal entity without explanation.
3. What is the upper limit?
The amended directive refers to the information specified in the Commission’s standard for voluntary use. Delegated Regulation (EU) 2026/1560 narrows this: under Article 3(2) the cap only comprises the datapoints listed in its Annex II, and revised ESRS 1 paragraph 66 refers reporters to the same list. Annex II sets two caps. For undertakings with more than 10 employees it covers 23 datapoints: general undertaking information (B1 paragraph 27), total energy consumption and estimated gross GHG emissions (B3 paragraphs 32–33), water withdrawal (B6), circular economy and waste (B7), employees by contract type and gender (B8), recordable work-related accidents (B9), minimum wage, collective bargaining coverage and training hours (B10), and, from the comprehensive module, products, markets and main business relationships (C1), employee turnover (C5), a code of conduct or human rights policy and a complaints-handling mechanism for the own workforce (C6 paragraph 61(a) and (c)) and confirmed incidents (C7). For undertakings with 10 employees or fewer, the cap only comprises the B1, B8, B9 and B10 datapoints; the B3, B6, B7, C1, C5, C6 and C7 items fall outside their cap.
Other voluntary-standard datapoints, such as B2 practices and policies, B4 pollution or B5 biodiversity, are above the cap even though they appear in the voluntary standard. A match to a VSME field therefore does not by itself place a request within the cap. The practical control is a field-level crosswalk: each requested item should be classified as within the Annex II cap, above the cap, unclear, or required for another separately identified purpose.
The cap is an upper limit, not a default questionnaire. The directive emphasises necessity: a reporter should request less than the full Annex II list where less information is needed for its material disclosures.
4. What protections apply to above-cap requests?
For the covered reporting purpose, protected undertakings have a right to decline information that exceeds the cap. The amended directive also provides that:
contractual and other arrangements established for meeting the reporting requirements must not require protected undertakings to provide above-cap information;
a contractual provision contrary to that restriction is not binding, while the remainder of the contract can remain binding;
where the reporter requests above-cap information directly or indirectly, it must identify which information exceeds the cap and inform the protected undertaking of the statutory right to decline;
a reporter that reports the necessary value-chain information without obtaining above-cap information from protected undertakings is deemed to have complied with the value-chain obligation in that respect.
These rules should be reflected in procurement templates, supplier portals, consultant questionnaires and requests routed through intermediaries.
5. What is outside the cap?
The cap does not affect requests for other purposes, including Union due-diligence obligations or the reporter’s risk management. It also does not prevent voluntary sharing. Recital 5 of Delegated Regulation (EU) 2026/1560 nevertheless encourages financial institutions, financial market participants, insurance undertakings and credit institutions to limit, as far as possible, their requests to undertakings with 1,000 employees or fewer for purposes beyond Accounting Directive reporting to the information in the voluntary standard (Annex I); this is an encouragement, not a legal limit. However, an “other purpose” should be genuine, documented and proportionate. A requester should identify the legal, risk or commercial decision supported by the field rather than using a vague multi-purpose label.
The cap also does not create or imply a supplier obligation to provide sustainability information. Whether within-cap information must be provided depends on other law, contract and the facts. This is an important negative boundary: the cap protects against exceeding a limit, but it is not itself a general data-supply mandate.
6. How does the reporter complete ESRS reporting?
The reporter remains responsible for material value-chain information. Revised ESRS permits the use of directly collected data or estimates depending on practicability and reliability. Directive (EU) 2026/470 also provides a first-three-year transition: where not all necessary value-chain information is available, the undertaking explains its efforts, why the information could not be obtained and its plans to obtain it. After that transition, it meets the requirements using direct information or estimates as appropriate.
The cap therefore changes the collection strategy, not the reporting objective. A mature approach combines targeted requests, internal information, procurement and transaction data, external datasets, samples and documented estimates.
Figure 1. Requester decision tree. Purpose, protected status and Annex II mapping should be resolved before a questionnaire is issued.
Requester decision tree: five controlled questions
Question 1. What precise purpose does the field serve?
Classify the request at field or coherent section level. Useful purpose codes include:
statutory ESRS/Accounting Directive sustainability reporting;
sustainability due diligence;
product or sector regulation;
risk management or underwriting;
financing or credit assessment;
procurement qualification or contract performance;
voluntary programme or supplier-development support.
A field may support more than one purpose, but each material purpose should be recorded. Where the reporting purpose is one of several, the cap analysis is still needed for that purpose.
Question 2. Is the recipient a protected undertaking?
Request a proportionate self-declaration. Do not demand group-wide HR files merely to verify the threshold. Escalate only where the declaration is manifestly inconsistent with information already known to the requester. Also record whether the recipient has more than 10 employees or 10 or fewer, because Annex II applies a shorter cap to the smaller group.
Question 3. Is each field within the Annex II cap?
Map to the Annex II list for the recipient’s size band, including definitions, units and scope. A field that matches a voluntary-standard datapoint not listed in Annex II is above the cap. A superficially similar field can still be above cap if it asks for extra granularity, a wider population, audit evidence, forward-looking projections or proprietary methodology not required by the Annex II datapoint.
Question 4. Is less information sufficient?
Link each field to a material IRO, disclosure, metric or control. Remove fields that are merely “nice to have”, duplicated across sections or already available internally. The value-chain cap is complemented by the general principle that requests should be necessary.
Question 5. How will unavailable information be replaced?
Define the estimate hierarchy before launch: internal purchase or sales data, product or asset attributes, direct samples, supplier-category factors, sector averages, geographic risk data and other proxies. This prevents the supplier portal from becoming the only route to compliance.
Supplier decision tree
Figure 2. Supplier decision tree. A controlled response separates protected status, purpose, field classification, response choice and retained evidence.
Step A. Ask the requester to identify purpose and legal context
A supplier should not have to infer the legal basis from a broad “ESG questionnaire” label. Ask which fields are for ESRS/Accounting Directive reporting, which are for other legal or commercial purposes, which legal entity is the reporter and which Member State law applies.
Step B. prepare the protected-undertaking self-declaration
Use the preceding financial year and the legal entity responding to the request. Document the employee population and averaging method. Where a group responds centrally for several entities, state which entities meet the test and how the calculation was made. Also state whether the responding entity has more than 10 employees or 10 or fewer, since the Annex II cap for the smaller group excludes the energy, GHG, water, waste and comprehensive-module datapoints.
Step C. classify fields
Use four response codes:
within cap — mapped to a datapoint listed in Annex II to Delegated Regulation (EU) 2026/1560 for the supplier’s size band (matching a VSME field that is not in Annex II is not enough);
above cap — additional scope, granularity or evidence for the reporting purpose;
other purpose — separately identified legal, risk or commercial purpose;
unclear — requester has not provided enough information.
Step D. choose a controlled response
Provide within-cap information where the supplier decides or is otherwise required to do so. For above-cap fields within the covered reporting purpose, exercise the applicable right to decline or share voluntarily under controlled terms. Voluntary sharing should not be accidental: define confidentiality, permitted use, onward disclosure, reliance and update expectations.
Step E. retain the response file
Keep the questionnaire version, purpose statement, field mapping, self-declaration, correspondence, approvals, disclosed evidence and any refusal or voluntary-sharing rationale. This record is useful if the request changes, a platform republishes the data or an assurance provider asks how the response was governed.
Request register template
The accompanying Excel workbook contains a REQUEST REGISTER and SUPPLIER RESPONSE sheet. A requester-side register should include:
In practice
| Field | Control purpose |
|---|---|
| Request ID and version | Prevent uncontrolled changes after legal review |
| Reporting undertaking and requesting entity | Identify who relies on the information |
| Recipient legal entity | Apply the employee test to the correct undertaking and record the Annex II size band (more than 10, or 10 or fewer employees) |
| Request purpose | Determine whether the cap applies |
| Material IRO / disclosure link | Demonstrate necessity |
| Annex II datapoint | Show within-cap mapping to Annex II of Delegated Regulation (EU) 2026/1560 |
| Above-cap element | Identify extra granularity, evidence or projection |
| Protected status and declaration date | Record reliance on self-declaration |
| Notice provided | Evidence that extra fields and decline right were communicated |
| Alternative data source | Preserve the reporter’s ability to report if the field is declined |
| Data owner and retention | Support traceability and privacy controls |
| Legal / reporting approval | Confirm current national law and final standard version |
Mixed-purpose questionnaire example
Context. A large listed manufacturer asks a 430-employee component supplier to complete 160 questions. The cover email says the information is required “for ESG compliance, due diligence, risk management and customer expectations”.
Field group 1 — ESRS reporting. Questions request the supplier’s total energy consumption, estimated Scope 1 and location-based Scope 2 GHG emissions, employee numbers by contract type and gender, and whether it has a code of conduct or human rights policy for its own workforce. The requester maps these to the Annex II datapoints for undertakings with more than 10 employees (B3 paragraphs 32–33, B8 paragraph 40(a) and (b) and C6 paragraph 61(a)) and identifies the reporting entities relying on them. Questions on the content of its environmental and social policies are moved to field group 2, because B2 is not listed in Annex II.
Field group 2 — above-cap reporting detail. The questionnaire asks for hourly plant-level energy data, five-year forecasts, underlying invoices and a bespoke transition-model file. These fields go beyond the Annex II datapoints for the reporting purpose. The requester identifies them as extra and informs the supplier of the applicable right to decline.
Field group 3 — product regulation. Questions ask for restricted-substance test certificates required for product compliance. They are outside the cap because their purpose is not Accounting Directive sustainability reporting. The requester cites the separate requirement and avoids presenting them as ESRS fields.
Field group 4 — due diligence. A targeted set of worker-rights questions supports a separately documented due-diligence process. The requester explains the purpose and legal basis. It does not simply relabel every sustainability question as due diligence.
Outcome. The supplier provides within-cap data, supplies product certificates, responds to the targeted due-diligence section and declines the bespoke reporting forecasts. The reporter uses purchase volumes, product data and sector factors to estimate a remaining emissions input. Both parties retain a field-level record.
Illustrative requester notice
Why it works. The wording identifies purpose, within-cap and above-cap fields, the decline right and a separate non-reporting purpose. It does not claim that the supplier must provide all within-cap information or that the cap applies identically before national transposition.
Evidence required. Legal mapping, current Annex II crosswalk, requester approval, national-law check, questionnaire version and supplier communication log.
Hypothetical scenario
Illustrative wording — legal review and national-law adaptation required
“Sections A and B are requested for the purpose of sustainability reporting under the Accounting Directive. Fields A1–A18 and B1–B9 have been mapped to the datapoints listed in Annex II to Commission Delegated Regulation (EU) 2026/1560 (the value-chain cap), which applies from financial years beginning on or after 1 January 2027. Fields B10–B14 request information beyond those datapoints. Where your undertaking meets the protected-undertaking conditions under the applicable national law, you have a statutory right to decline B10–B14. These fields are not a condition of the contractual arrangement established for our statutory sustainability reporting. Section C is requested separately for product-compliance purposes and is not classified as an ESRS reporting request. Please contact [owner] if the purpose or mapping is unclear.”
Illustrative only. It shows how the decision is made, not wording that can be copied or relied on.
In practice
Weak versus stronger request design
| Weak approach | Stronger controlled approach |
|---|---|
| One “ESG compliance” purpose for every field | Field-level or section-level purpose codes linked to actual decisions and requirements |
| “All suppliers must complete every question” | Protected-status check, necessity review and targeted request scope |
| Old VSME spreadsheet used as the cap without version control | Mapping to Annex II of Delegated Regulation (EU) 2026/1560 for the recipient’s size band, not to the full voluntary standard or the 2025 Recommendation |
| Above-cap fields embedded without notice | Extra fields identified and statutory decline notice provided where applicable |
| Contract says all future ESG data are mandatory | Contract language reviewed against cap restrictions and other legitimate purposes separated |
| Reporter stops analysis when supplier declines | Alternative-data hierarchy, estimates and transparent limitations |
| Supplier sends data informally by email | Controlled response file, confidentiality terms, approval and retention |
In practice
Common mistakes and corrections
| Mistake | Why it is wrong | Correction |
|---|---|---|
| Treating every undertaking below 1,000 employees as protected | It must also be in the reporting undertaking’s value chain and the legal context must apply | Record both threshold and relationship |
| Using current-year headcount instead of the preceding financial year | The directive definition refers to the preceding financial year | Document period and averaging method |
| Assuming the requester must audit the self-declaration | The reporter may rely on it unless manifestly incorrect | Use proportionate exception escalation |
| Treating the cap as a prohibition on voluntary data sharing | Voluntary sharing is preserved | Use controlled consent and confidentiality terms |
| Applying the cap to due diligence, product law or risk management automatically | The cap is limited to the specified reporting purpose | Separate purposes and legal bases |
| Assuming within-cap data are automatically mandatory for the supplier | The cap does not create or imply a supplier reporting duty | Check other law and contract |
| Removing material value-chain disclosure when data are declined | Reporter obligation remains | Use direct data, estimates and limitation disclosure |
| Applying the directive wording as directly identical in every Member State before transposition | Directives require national implementation | Check applicable national law and dates |
Myth
“The value-chain cap means a protected supplier never has to answer sustainability questions.”
Reality
The cap addresses information beyond the Annex II datapoints when requested for statutory sustainability reporting under the Accounting Directive. It does not prevent voluntary sharing, govern every other request purpose or remove obligations arising under other law or contract. It also does not itself impose a general duty to provide within-cap information. The response depends on purpose, protected status, field mapping, national implementation and the separate legal or contractual basis.
Readiness
Requester checklist
- The reporting undertaking and legal purpose are identified.
- Each field is linked to a material IRO, disclosure or other documented purpose.
- Protected status can be established through a proportionate self-declaration.
- The request is mapped to the Annex II datapoints of Delegated Regulation (EU) 2026/1560 for the recipient’s size band (more than 10, or 10 or fewer employees).
- Above-cap granularity, evidence and projections are separately identified.
- The statutory notice and decline right are included where applicable.
- Contract templates do not make above-cap reporting information mandatory.
- Other purposes are genuine, specific and not used as blanket relabelling.
- Alternative sources and estimate methods are defined.
- Data protection, confidentiality, onward use and retention are controlled.
- National transposition of Directive (EU) 2026/470 and the effective date are checked, including application of the cap from financial years beginning on or after 1 January 2027.
- Assurance instructions respect protected-undertaking rights.
Readiness
Supplier checklist
- The responding legal entity, its preceding-year employee average and its Annex II size band (more than 10, or 10 or fewer employees) are documented.
- The requester has identified the reporting undertaking and purpose.
- Fields are classified as within cap, above cap, other purpose or unclear.
- The applicable national-law right to decline has been checked.
- Voluntary sharing is approved and subject to use restrictions where needed.
- Product, due-diligence and risk requests are assessed separately.
- Evidence does not disclose personal data, trade secrets or security-sensitive information unnecessarily.
- The full response file and correspondence are retained.
Frequently asked questions
Is the threshold exactly 1,000 employees or fewer?
The directive definition covers an undertaking that does not exceed an average of 1,000 employees during the preceding financial year. The calculation method and national implementation should be checked for the relevant jurisdiction.
Can a reporter ignore a self-declaration it distrusts?
It may rely on the self-declaration without verification but should not rely on it where it knows, or can reasonably be expected to know, that it is manifestly incorrect. The threshold is not a licence for routine audits of suppliers.
Does the cap apply to non-EU suppliers?
Revised ESRS 1 paragraph 66 states that the limitation also applies to non-EU undertakings in the reporter’s upstream and downstream value chain. Practical legal enforcement and contract design still require jurisdictional advice.
Is the 2025 VSME Recommendation automatically the final cap?
No. Recommendation (EU) 2025/1710 no longer produces legal effects from 24 September 2026. The voluntary standard in Annex I to Delegated Regulation (EU) 2026/1560 is based on it, but the cap only comprises the datapoints listed in Annex II to that Regulation and applies from financial years beginning on or after 1 January 2027. Map requests to that list and keep version control.
What happens when a supplier refuses an above-cap field?
The reporter should not treat the refusal as a reason to omit material value-chain information. It should use appropriate direct information, estimates and transparent limitations, and retain evidence of its request and alternative methodology.
Questions
Questions people ask
Who is protected?
The value-chain cap limits the sustainability information that an ESRS reporting undertaking may require from a protected undertaking for the purpose of reporting under the Accounting Directive. A protected undertaking is in the reporter’s value chain and does not exceed an average of 1,000 employees in the preceding financial year.
Does the cap cover due diligence?
The cap does not affect requests for other purposes, including Union due-diligence obligations or the reporter’s risk management. It also does not prevent voluntary sharing.
Is VSME the cap?
No. Recommendation (EU) 2025/1710 no longer produces legal effects from 24 September 2026. The voluntary standard in Annex I to Delegated Regulation (EU) 2026/1560 is based on it, but the cap only comprises the datapoints listed in Annex II to that Regulation and applies from financial years beginning on or after 1 January 2027. Map requests to that list and keep version control.
What must reporters do after refusal?
The reporter should not treat the refusal as a reason to omit material value-chain information. It should use appropriate direct information, estimates and transparent limitations, and retain evidence of its request and alternative methodology.
Take it with you
The checklists as a working spreadsheet
Every checklist and table on this page, with empty status, owner and evidence columns for your team to fill in and keep.
✓ Knowledge Hub AI Assistant · Human-in-the-loop
Ask about this guide
It answers from this page, and reaches into the linked disclosure cards when your question is about the standard itself.
Go deeper · ESRS
Certified ESRS (CSRD) Applied Sustainability Reporting
This page settles one Disclosure Requirement. The ESRS / CSRD course walks the whole European cycle — double materiality, datapoints, evidence and assurance — with drafting exercises on your own data.
