Protected Undertaking Self-Declaration: What Suppliers and Requesters Should Document

Directive (EU) 2026/470 deliberately reduces burden by allowing reporting undertakings to rely on a self-declaration from value-chain undertakings. The requester is not required to verify the information. This is a strong proportionality signal: the mechanism should not be converted into a routine supplier audit.

At the same time, a declaration consisting only of “we have fewer than 1,000 employees” may be difficult to use. It may not identify the legal entity, period, relationship, employee calculation basis or the 10-employee band required for Annex II branching. A practical template should therefore add enough structured information to make reliance safe without demanding the source records that the Directive says need not be routinely verified.

Figure 1. A protected-status declaration should be prepared, approved, issued, relied on proportionately, monitored and renewed or corrected. London Reporting Academy learning visual.

For the value-chain-cap provisions, a protected undertaking is an undertaking that does not exceed, on its balance-sheet date, an average number of 1,000 employees during the preceding financial year and is in the value chain of a reporting undertaking. Both elements matter. A company with 200 employees is not relying on this status in the abstract; it is declaring status in relation to the relevant reporting-undertaking value-chain request.

The requester may rely on the declaration and is not required to take verification steps. The exception is where the requester knows, or can reasonably be expected to know, that the declaration is manifestly incorrect. The word “manifestly” supports a high-threshold, obvious-error approach rather than routine audit. National transposition and legal guidance should be checked before formalising the exception procedure.

1. Supplier identity

Identify the exact legal entity making the declaration. Include legal name, registration number, registered office or country, and a contact for corrections. Avoid a trading name without the underlying entity. Where a parent issues the declaration for subsidiaries, specify the authority and list the entities covered.

2. Requester and value-chain relationship

Identify the reporting undertaking or requester to which the declaration relates and briefly state the value-chain relationship, such as direct supplier, subcontractor or distributor. The declaration need not disclose commercially sensitive contract terms. It should, however, make clear why the protected-undertaking test is being applied.

3. Balance-sheet date and preceding financial year

State the balance-sheet date and the preceding financial year used for the average employee number. A declaration without a period becomes stale quickly and can be misapplied to later requests. Where the supplier has a non-calendar year, show the exact dates.

4. Average employee number and method

State the average employee number and describe the counting basis used under the applicable accounting or national rules. The cited EU provision does not provide a universal calculation method in the self-declaration clause. Do not invent one in the form. Instead, state whether the number is based on headcount or another legally applicable measure, how the average was determined, which entities were included and who reviewed the calculation.

5. Entity or group basis

The declaration should explicitly state whether the employee figure is for the individual legal entity or another group/consolidated basis and list the entities included. This is a transparency field, not a universal conclusion that group aggregation is always required. The correct legal basis must be reviewed under the transposed rules and the structure of the request.

6. Annex II employee band

The form should show one of three practical outcomes: 10 employees or fewer; more than 10 and no more than 1,000; or more than 1,000 / not protected. The first two protected bands matter because Annex II contains a narrower cap for undertakings with 10 employees or fewer.

7. Declaration statement and limitations

The supplier should state that, based on the information and basis identified, it meets the protected-undertaking criteria for the specified relationship and period. If the conclusion depends on a pending transaction, provisional average or unresolved group-basis question, disclose that limitation rather than giving an unconditional statement.

8. Approval, issue, expiry and correction

Name an authorised signatory and role, issue date, validity period, expiry or next-review date, and contact for corrections. The declaration should require prompt correction or withdrawal if the employee threshold, entity basis or value-chain relationship changes materially.

The supplier should be able to support the declaration internally without attaching unnecessary employee-level data. An evidence file protects the signatory and enables correction if challenged. It should also record the version of the applicable rule and any judgement about entity basis.

A protected-status declaration normally needs an aggregate employee number, not employee names, salaries, contracts or payroll files. The supplier should minimise personal data in both the declaration and any clarification. If evidence is requested after a credible concern, consider a redacted calculation summary, independent confirmation or secure review rather than unrestricted transfer.

Minimise: use aggregate numbers and roles rather than names where possible.

Limit purpose: state that information is used to determine protected status and the Annex II path.

Control access: restrict detailed evidence to authorised personnel.

Set retention: preserve what is needed for reliance, correction and audit, then apply retention policy.

Record onward sharing: understand whether the declaration will be shared with group companies, assurance providers or platforms.

Provide correction route: inaccurate status data should be amendable without circulating a new uncontrolled file.

The requester’s default should be reliance, not verification. A proportionate intake process checks that the declaration is complete, signed, current, related to the correct supplier entity and internally consistent. It may compare the declaration with reliable information already held, but it should not require payroll evidence as a standard condition of acceptance.

The Directive does not provide a checklist in the cited provision. The requester should therefore use a narrow, documented exception process. A possible indicator might be a declaration of eight employees where reliable current group information already held by the requester shows hundreds in the same legal entity, or a declaration that names an entity unrelated to the supplier contract. A minor difference, public estimate or old website figure is not automatically a manifest error.

1. Record the indicator. Identify the reliable information and why the contradiction appears obvious and material.

2. Check entity and period. Many apparent contradictions arise from group versus legal-entity or current versus preceding-year differences.

3. Ask for clarification. Give the supplier a specific question and reasonable opportunity to correct or explain.

4. Decide reliance. Accept, accept with clarification, request a limited supporting summary, or reject reliance with legal approval.

5. Preserve the record. Keep the declaration, concern, clarification, decision and date.

The form should not claim indefinite validity. A practical policy is to align the declaration with the preceding financial year used in the employee test and set a renewal point for the next supplier reporting cycle. Add event triggers for mergers, acquisitions, disposals, major workforce change, new entity coverage, change of requester relationship or discovered calculation error.

Where a declaration changes, the supplier should issue a corrected version with a reference to the superseded document and identify affected recipients. The requester should update questionnaire branching and preserve the prior reliance record rather than overwriting history.

Context. Cedar Services Group has a parent and three operating subsidiaries. One subsidiary with 62 employees supplies a reporting undertaking; the group has 310 employees. The customer asks for a protected-undertaking self-declaration.

Assessment. Cedar identifies that the contracting supplier is the subsidiary but recognises that the correct entity basis requires legal review under the applicable transposed rule. Rather than declaring only “62 employees”, it states the legal entity, the individual-entity figure, the group figure, entities covered and the basis used for the conclusion. It categorises the relevant Annex II band as more than 10 and no more than 1,000.

Requester response. The customer accepts the signed declaration because it is complete and no manifest contradiction exists. It does not request payroll evidence. It stores the basis and expiry and uses the >10 Annex II branch. When Cedar acquires another business, the supplier issues a corrected declaration after reviewing the entity and employee basis.

Learning point. Transparency about basis is safer than hiding judgement. The declaration is not stronger because it asserts certainty; it is stronger because it identifies what was measured, for which entity, for which period and under whose approval.

Requester design: How Large Companies Should Redesign Supplier ESG Questionnaires Around the Value Chain Cap.

Supplier response: How to Respond to an Above-Cap Sustainability Data Request Without Damaging the Customer Relationship.

Questionnaire operations: How to Answer Customer and Bank ESG Questionnaires Using the EU Voluntary Standard.

Publication channels: Must an EU Voluntary Sustainability Report Be Public?