Is the EU Voluntary Sustainability Reporting Standard Mandatory?

A supplier may receive an email saying that sustainability data is “required”. A bank may say that a completed questionnaire is necessary for credit approval. A large customer may be legally required to report value-chain information. Each statement can be true while the Voluntary Standard itself remains voluntary for the supplier.

The practical task is therefore classification, not semantics. The team must distinguish a legal reporting duty of the undertaking, a legal information need of another organisation, a contractual or commercial condition, and a voluntary management or communication choice. Only after that classification can it determine whether the value-chain cap applies, whether the undertaking can decline information, and what evidence should be provided.

Annex I paragraph 2 states that the Standard is voluntary, and paragraph 4 explains that it does not impose legal reporting obligations unlike ESRS. Article 2 of the delegated regulation provides that undertakings outside mandatory reporting under Articles 19a and 29a may disclose sustainability information on a voluntary basis in accordance with Annex I.

Voluntary use can still be disciplined. Once an undertaking selects Option A or Option B and makes a statement of compliance with the selected option, it should complete that module in its entirety, subject to the stated “if applicable” principle, micro reliefs and permitted omissions. Voluntary entry does not mean that the report can make an inaccurate module claim.

Figure 1. Legal obligation, commercial expectation and voluntary reporting are three different decision layers.

Mandatory reporters under Articles 19a and 29a need information about their own operations and value chain. Directive (EU) 2026/470 responds to evidence of disproportionate supplier requests by defining a protected undertaking and limiting what reporting undertakings may require for the purpose of sustainability reporting under the Directive.

Figure 2. Request triage by purpose: Accounting Directive reporting, another legal purpose or commercial use.

The Directive expressly preserves requests made for purposes other than sustainability reporting required by the Accounting Directive, including requests needed to comply with Union due-diligence requirements. A bank's credit analysis, a customer's human-rights due-diligence process, a tender qualification and an insurer's risk assessment may therefore sit outside the statutory cap, even when they request similar datapoints.

Outside the cap does not mean unlimited. The requester should still consider applicable data-protection, competition, confidentiality, contract and sector rules, as well as proportionality and relationship risk. The supplier should ask for the purpose, decision use, required period, legal basis, confidentiality terms and whether estimates or a Standard-based report are acceptable.

A protected undertaking should not treat every request above Annex II as automatically invalid. It should first confirm that the request is directly or indirectly for the requester's Accounting Directive sustainability reporting. Where that purpose is established, the undertaking can identify above-cap items, cite its protected status and decide whether to decline or provide additional information voluntarily. The right is a protection, not a prohibition on informed voluntary sharing.

The contract review should also distinguish existing legal duties and permitted below-cap obligations. The delegated act explains that the cap does not affect contractual or legal obligations to provide information that does not exceed the Standard, and the Directive preserves other legal purposes. A blanket refusal can therefore be as inaccurate as a blanket demand.

Evidence needed: request and stated purpose, size declaration, Annex II mapping, legal review where needed, contract clause, authorised response, data-sharing approval, confidentiality terms and final record of information supplied.

The Standard expressly aims to help satisfy the data needs of banks and investors and improve access to finance. That does not mean every lender request is legally capped or that every lender must accept a Basic report. Credit institutions may need information for prudential risk, collateral, transition exposure, anti-greenwashing controls or product disclosures. Recital 5 nevertheless encourages financial institutions and market participants to limit, as far as possible, requests from undertakings with 1,000 employees or fewer to Annex I information even for purposes beyond Accounting Directive reporting.

Using the Voluntary Standard does not itself require an undertaking to obtain assurance over the information it reports. The adopted delegated regulation says undertakings applying it are not obliged to seek assurance; another law, contract or financing arrangement could still impose a separate requirement.