Book a demo
Medium impactBy Orbecta Intelligence29.10.202610 min · 15 sources

New CSRD Limits on Supplier Data: What Procurement Can Still Require from 2027

From financial year 2027, the sustainability information that CSRD-reporting companies can require from suppliers with up to 1,000 employees will be limited.

Key points
  1. 01Before the 2027 questionnaire round, label each supplier question as VS baseline, additional, or other legal basis such as CBAM or EUDR.
  2. 02From financial year 2027, suppliers with on average up to 1,000 employees may refuse additional CSRD requests; state that right with every additional question.
  3. 03Ask for a self-declaration of average headcount at onboarding to determine who falls under the cap.
  4. 04Have legal review ESG clauses that demand more than the VS and amend them at renewal.
  5. 05If you are a supplier with up to 1,000 employees yourself, agree per OEM which additional questions you answer voluntarily.

Relevant for: procurement and ESG leads at Dutch companies that remain within the CSRD and send out supplier questionnaires, and suppliers in machine-building and metals with up to 1,000 employees that receive ESG questionnaires from Dutch and German OEMs.

On 3 July 2026, the European Commission adopted the voluntary standard (VS), including the value chain cap from Omnibus I. For financial years starting on or after 1 January 2027, CSRD reporters may not require sustainability information from suppliers with up to 1,000 employees beyond the value chain cap: the datapoints in Annex II of the VS regulation, not the whole standard. Asking is still allowed. The supplier may refuse and must be told so. Before the 2027 cycle, split your questionnaire into datapoints within the value chain cap, voluntary additional questions and questions with another legal basis, and identify now which ESG clauses make more mandatory.

What is actually happening

The value chain cap comes from Omnibus I, formally Directive (EU) 2026/470. According to Linklaters, the directive was published in the Official Journal on 26 February 2026. Noerr reports that the Council approved it on 24 February 2026 and that the directive entered into force on 18 March 2026. RVO, the Netherlands Enterprise Agency, confirms the agreement of 24 February.

The directive narrows the CSRD. According to Linklaters and Latham & Watkins, only companies with more than 1,000 employees and more than €450 million net turnover remain subject to reporting. Both thresholds must be met. For the CSDDD, according to Arthur Cox, the threshold is more than 5,000 employees and more than €1.5 billion net worldwide turnover.

The core for procurement is in the directive itself, in the amended Articles 19a(3) and 29a(3) of the Accounting Directive:

  • A supplier with an average of up to 1,000 employees in the previous financial year is a protected undertaking.
  • A reporting undertaking may not require information from such a supplier beyond what the voluntary standard (VS, formerly VSME) designates for that purpose. This also applies in contractual arrangements.
  • The supplier gains a legal right to refuse such additional requests.
  • Do you still ask for more? Then you must tell the supplier which additional information is involved and that it may refuse.
  • You may rely on the supplier's own declaration of its size. That does not apply if you know, or could reasonably know, that the declaration is manifestly incorrect.
  • A contractual provision contrary to this is not binding; the rest of the contract remains in force.
  • Voluntary sharing remains permitted, for example of what is customary in a sector. Existing contractual or legal obligations for information within the cap remain in place.

According to an explanatory note from the European Commission, reporting undertakings under the CSRD may still ask for additional information. They may only not require it. The cap also imposes no obligation on value chain companies to provide sustainability information; Annex II, too, is a maximum, not an obligation to supply. In its explanatory memorandum to the delegated regulation, the Commission states that the cap applies only to information collected for sustainability reporting under the Accounting Directive.

Following adoption by the Commission (see timeline), the VS was published as Delegated Regulation (EU) 2026/1560 in the Official Journal on 21 September 2026. Important for procurement: the value chain cap is not the whole standard. The regulation designates the datapoints covered by the cap in Annex II, with a shorter list for undertakings with up to 10 employees. Other datapoints from the VS may be requested, but not required. Mayer Brown reports that the cap provision applies to financial years starting on or after 1 January 2027. The standard itself can be used from its entry into force.

Date What Source
18 March 2026 Omnibus I directive enters into force Noerr
3 July 2026 Commission adopts revised ESRS and VS European Commission
21 September 2026 VS Regulation (EU) 2026/1560 published in the Official Journal Garrigues
1 January 2027 Cap applies to financial years from this date Mayer Brown
19 March 2027 Transposition deadline for CSRD amendments by Member States Latham & Watkins, Linklaters
26 July 2028 Transposition deadline for CSDDD amendments, in the Netherlands via the WIVO bill Latham & Watkins, RVO
26 July 2029 CSDDD applies Law & More

Structural drivers

The Commission states the motive itself. Large reporters passed their data demands on to smaller companies, through "differing, uncoordinated and overlapping questionnaires". Every customer sent its own list, with its own definitions. A supplier with many customers filled in the same data again and again in different formats.

The VSME already existed. According to csr-tools, EFRAG published it in December 2024 as a voluntary standard. A supplier then had no right to refuse more. Omnibus I builds on its successor, the VS, the first legal limit on what a customer may require; the limit itself is set in Annex II.

The second driver is the narrower CSRD scope. Fewer companies report, but those that remain are large and have a broad supplier base. Orbecta analysis: at an industrial OEM, the long tail of suppliers typically falls below the 1,000-employee threshold. If that is the case for you, the cap hits precisely the part of the supplier base where procurement sends out the most questionnaires.

Who is directly affected

Direct: Dutch companies above both CSRD thresholds that use ESG questionnaires, onboarding forms or ESG clauses for suppliers with up to 1,000 employees. Think of chemicals, agrifood, high-tech and machine-building with a broad supplier base.

Direct: Dutch suppliers with up to 1,000 employees, including SMEs in machine-building and metals. They gain a right of refusal towards every CSRD reporter in the EU, including German OEMs that fall under the CSRD.

Not directly affected:

  • Requests for CBAM emissions data, EUDR geolocation, the forced labour ban or CSDDD due diligence. The cap covers only CSRD reporting. This is an Orbecta inference from the scope the Commission describes.
  • Suppliers with more than 1,000 employees.
  • Companies that fall out of the CSRD through Omnibus I and no longer collect supplier data for reporting. According to RVO, the Netherlands will use the Member State option: companies that had to report from financial year 2024 but fall outside the scope from financial year 2027 do not have to report for financial years 2025 and 2026.

That last group comes back into view as soon as it grows and again exceeds both thresholds. A supplier above 1,000 employees falls under the cap if its average headcount in the previous financial year drops to 1,000 or fewer.

The second-order effect

Orbecta analysis of the chain: the CSRD narrows and the cap takes effect. What customers may require from protected suppliers for CSRD reporting is limited to the datapoints in Annex II. Suppliers may refuse the rest and must be told so. Procurement therefore splits questionnaires into a part within the cap and a voluntary part. What happens next depends on how the market responds.

Scenario 1: the VS becomes the market standard

This scenario plays out once large customers widely reduce their lists to the VS as a shared format. A single shared dataset then emerges for the long tail. Suppliers fill it in once and send it to all their customers. The administrative burden on those suppliers falls. Customers get more comparable data, but less depth per supplier.

Scenario 2: refusal follows market power

This scenario plays out if customers keep asking additional questions, with the required notice attached. Bargaining power then decides who refuses. A specialised supplier with few competitors refuses. A replaceable supplier keeps answering, because asking is still allowed.

Scenario 3: scope 3 shifts to estimates

If a large part of the tail refuses additional requests, customers fill the gap with estimates and sector averages. The quality of scope 3 figures for that group falls. Anyone steering on supplier-specific data, such as CO2 reduction targets per supplier, loses sight of those suppliers.

In none of these scenarios does the total questionnaire burden have to fall: data requests outside the CSRD fall outside the cap.

Dutch procurement impact

Questionnaire and onboarding

Direct: every question in your supplier questionnaire gets a label. If it falls under the Annex II datapoints for that supplier's size, it falls within the maximum information request that the value chain cap allows for CSRD reporting. Whether the supplier has to answer does not follow from the cap but from a valid contractual or other legal basis. Other VS datapoints and questions beyond the cap are voluntary, unless another valid legal basis applies; they must come with the notice of the right to refuse. Put questions for CBAM or EUDR in a separate module, with their own legal basis. That prevents a supplier from refusing a CBAM question by invoking the cap.

Direct: supplier size becomes a fixed onboarding field. The supplier's own declaration of its average number of employees in the previous financial year determines which regime applies: up to 10, 11 to 1,000, or more than 1,000. Decide who in your team flags a manifestly incorrect declaration, for example from a supplier you know to be part of a large group.

ESG clauses in framework agreements

Direct: framework agreements may contain an ESG information obligation that refers to your own questionnaire or to a rating platform. If such a clause requires more than the value chain cap for CSRD reporting, it is not binding on that point under Omnibus I. The Netherlands still has to transpose that rule. So identify now which clauses are affected, have legal determine how they work out under the Dutch transposition, and adjust your templates and renewals accordingly.

If a contract attaches sanctions to missing ESG data above the value chain cap: that clause belongs at the top of legal's review list. It concerns information you may no longer require from a protected supplier from financial year 2027.

Supplier conversations

If you are a supplier with up to 1,000 employees yourself: from financial year 2027 you have a legal limit in hand, for CSRD requests only. Practical advice: supply the Annex II datapoints for your size as standard. That is the maximum a customer may require for CSRD reporting, not a legal obligation to supply. Agree with each customer which additional questions you answer voluntarily.

If you are a customer and need supplier-specific scope 3 data: make the voluntary part worthwhile for the supplier. For example, share benchmark results back or agree on one joint questionnaire round per year. That keeps your dataset up to standard without requiring anything.

What is certain and what is still uncertain

What is certain

  • Omnibus I has been in force since 18 March 2026.
  • The Commission adopted the VS and value chain cap on 3 July 2026.
  • The cap protects suppliers with an average of up to 1,000 employees.
  • Asking is allowed, requiring beyond the value chain cap (Annex II) is not; for CSRD reporting only.
  • According to RVO, the Netherlands will exempt affected Wave 1 companies for financial years 2025 and 2026.

What is still uncertain

  • Whether the Netherlands will have transposed the CSRD amendments before 19 March 2027.
  • How the Dutch transposition implements the rule that conflicting contractual provisions are not binding.
  • How many suppliers will actually refuse additional requests.

What to watch

  • Dutch bill transposing the CSRD amendments.
  • Response rate to voluntary questions in your 2027 questionnaire round.
  • Share of estimated versus supplier-specific scope 3 data.
  • Number of suppliers invoking the right to refuse.

What you can do now

  1. This month: have your category and ESG team label every question in your supplier questionnaire as a value chain cap datapoint (Annex II), voluntary extra or other legal basis (CBAM, EUDR). For suppliers with up to 10 employees, check separately which Annex II datapoints apply to them. Decide which additional questions you keep as voluntary for the 2027 questionnaire round.
  2. This quarter: ask suppliers at onboarding and in your next questionnaire round for a written self-declaration of their average number of employees in the previous financial year. Use it to determine which suppliers fall under the cap.
  3. This quarter: identify framework agreements with ESG information clauses that make more mandatory than the value chain cap and have legal review them. Then adjust your contract templates and include the affected clauses in the next renewal.
  4. This year: are you a supplier with up to 1,000 employees yourself? Before 1 January 2027, set out which Annex II datapoints you supply as standard and discuss with your OEM customers which additional questions you will refuse.

How Orbecta helps

Contract Intelligence analyses an uploaded framework agreement for clauses and risks, such as an ESG information obligation and the term until renewal. Warroom Prep prepares the supplier conversation in which you agree which additional questions a supplier answers voluntarily. Company exposure: not yet calculated. Connect spend and supplier data.

Sources

Primary source: European Union (EUR-Lex) — Directive (EU) 2026/470 (Omnibus I) — 26 February 2026

Primary source: European Union (EUR-Lex) — Delegated Regulation (EU) 2026/1560 (voluntary standard) — 21 September 2026

Primary source: European Commission — Feedback on sustainability reporting standards: additional explanatory information regarding the value chain cap — 6 May 2026

Primary source: European Commission — Commission adopts revised sustainability reporting standards to reduce administrative burdens in the EU — 3 July 2026

Primary source: European Commission — Explanatory memorandum C(2026)5011 — July 2026

Primary source: RVO — CSRD — reviewed 30 March 2026

Primary source: RVO — Omnibusvoorstel — April 2026

Additional context: Linklaters — EU Omnibus I Directive published in the Official Journal of the EU — 26 February 2026

Additional context: Latham & Watkins — EU Sustainability Omnibus Published in the Official Journal — February 2026

Additional context: Noerr — CSDDD – Amending Directive published in the Official Journal of the European Union — June 2026

Additional context: Arthur Cox — Omnibus I Directive published: revised scope and reduced obligations under CSRD and CSDDD — February 2026

Additional context: Mayer Brown — European Commission adopts revised European Sustainability Reporting Standards — July 2026

Additional context: Garrigues — EU publishes voluntary sustainability standard for companies with more than 1,000 employees and caps value chain — September 2026

Additional context: Law & More — ESG-regelgeving: wat moeten Nederlandse bedrijven weten in 2026 — October 2026

Additional context: csr-tools — VSME — date not specified

Orbecta analysis based on the sources above.

Orbecta

Link these signals to your own suppliers and contracts?

Orbecta sets market signals against your suppliers, orders and contracts and prepares the next step.

Request a demo
ShareLinkedInEmail

By email

New analyses in your inbox

As soon as an analysis is published. No spam, unsubscribe at any time.