do I as a supplier have to complete sustainability questions from my customer
No legal obligation, but contractual pressure
No, there is no law that requires a small business to complete an ESG questionnaire. The reporting obligation under Directive (EU) 2022/2464 (CSRD) applies to the large undertaking itself, not to its suppliers. What does happen: that large customer must report across its entire chain, and therefore sends the questionnaire to everyone who supplies to it. Completing it then becomes a matter of contract and relationship, not law.
In practice, that means: the customer asks, and not responding costs an order, not a fine. Most questionnaires currently in circulation are based on the EFRAG VSME, the voluntary basic module that was specifically designed so that a non-listed SME does not have to go through the full CSRD reporting but can still provide something structured. If you recognize that format, you immediately know what level of detail is expected: number of employees, CO2 indication, energy consumption, and often a question about the number of employees of the undertaking as the basis for the calculation. If you don't have a figure, then "not available" is a valid answer — better than an estimate that you have to correct later.
Where that difference between law and contract becomes apparent
Directive (EU) 2022/2464 amends the reporting obligation of the large, reporting undertaking; EFRAG's VSME standard is explicitly intended as a voluntary instrument for parties outside it. That a supplier nonetheless provides something follows therefore not from this regulation itself but from the supply agreement with the customer that falls under it. For the basic data that appear in almost every questionnaire — such as the sector in which the enterprise operates — it applies in any case that these are already established in the Trade Register under the Trade Register Act 2007, so you do not need to reconstruct them yourself.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.