why do I have to answer sustainability questions as a supplier
Your customer is preparing his own CSRD reporting
Your customer is asking you this because he is himself subject to reporting obligations under Directive (EU) 2022/2464, better known as the CSRD. That directive requires large and listed companies to report on their entire value chain, including suppliers. Your customer can only complete this if he collects from his suppliers what he does not know himself: energy consumption, emissions, working conditions. That is called scope 3 when it comes to emissions, but the questionnaires you receive often go broader, extending to governance structure and policy.
The format varies greatly by customer, and that is precisely why the same answer comes up dozens of times. Some customers use their own list, others align with the EFRAG VSME, the voluntary standard that was specifically created for SME suppliers that are not themselves subject to the CSRD but are being asked by customers that are. That standard is a good indication of what you can structurally expect: basic company data, environmental indicators, and a few questions about governance. Evidence is usually an energy bill, a policy document or a CO2 calculation; if you do not have those, then "no" or "not applicable" is a valid answer, not an obstacle.
Traceable to the value chain requirement of the CSRD
That suppliers receive this type of questions does not follow from a direct obligation for the SME sector itself, but from the value chain mechanism of Directive (EU) 2022/2464: reporting entities must include material information about their value chain, and that information comes from suppliers. The EFRAG VSME module is the direct response of the standardisation world to that pressure: one fixed format, so that not every customer keeps inventing his own list. Basic data such as the sector in which the enterprise operates and the number of employees appear in almost every format, because they form the context in which the rest of the answers are read.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.