why do I as a small business have to complete a sustainability questionnaire
No legal obligation, but customer's scope 3
The question does not come from a law that applies to your business, but from your customer's reporting obligation. Directive (EU) 2022/2464, the CSRD, requires large and listed undertakings to report on their entire value chain, including scope 3: the emissions and risks at suppliers. Your customer therefore needs to know what is happening at your company, even if you yourself are not subject to the directive. This explains why small suppliers suddenly receive questionnaires that seem tailored to large businesses.
To make this manageable for SMEs, EFRAG has established the VSME: a voluntary, simplified standard specifically for unlisted small and medium-sized enterprises. The basic module requests a limited set of data — energy consumption, waste streams, personnel data — without the full reporting burden of the CSRD itself. Many customer portals are built directly on this basic module or use their own selection from it. If you therefore recognise questions that feel reasonably small compared to what you expected from "CSRD", that is usually because your customer has already chosen the VSME route. Questions about the company's annual turnover and the number of employees often come up because they help estimate the scale of chain emissions.
Where this comes from: regulation and standard side by side
The customer's obligation is set out in Directive (EU) 2022/2464; the translation into a workable SME format is set out in EFRAG's VSME basic module. Both sources exist side by side: the directive places the reporting obligation on the large undertaking, the standard determines which data are practically useful to fulfil that obligation at suppliers. Basic data such as the establishment address of the company are also often part of such a questionnaire, simply because the VSME requests them as contextual information alongside the rest of the submission.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.