my customer sends me a sustainability questionnaire and I've never completed this before, what now
The questionnaire is divided into three fixed sections
A sustainability questionnaire from a customer is almost always structured according to the same type of sections: identity and governance, environment (emissions, energy, waste), and social policy (personnel, chain responsibility). Most customers rely heavily on EFRAG's VSME baseline module, the voluntary standard specifically designed for non-listed SMEs as a simplified derivative of CSRD reporting (Directive (EU) 2022/2464). If you recognise that structure, you immediately know which part of your file belongs where: the identity section is already complete for most companies, what is the statutory name of the company and under what registration number is the company registered are fixed data from the Business Register that you never need to reformulate.
The most difficult section is usually scope 3: emissions in the chain, at suppliers and in the use of your product. VSME requests this as an estimate, not as a measured value — if you are filling this in for the first time, a reasoned estimate with a clear explanation of the methodology is the common starting point, not an exact measurement. If you do not yet have that estimate, then "no, not yet available" is a valid answer; making up a figure to fill in the box is not.
Where that connects: CSRD, VSME and the identity fields
EFRAG's VSME baseline module is set up as a proportionate set of indicators for companies that are not themselves CSRD-obliged but are asked for figures by a CSRD-obliged customer — that explains why your customer's questionnaire often looks like it, even if you are not yourself subject to the directive. Governance and identity questions in such a list usually reduce to the same basic data: besides name and number, customers often also ask for in which sector the undertaking operates and how many employees the undertaking has, data that, like the Chamber of Commerce registration, are already established under the Business Register Act 2007 and do not need to be reassessed per questionnaire.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.