Point of View
Supply Chain · Sustainability · Regulatory Compliance
If You Supply a Large Company, Its Sustainability Report Is Quietly Becoming Your Compliance Obligation
That pressure is real, growing, and rarely explained to the small businesses feeling it. What's less well known: a legal ceiling now exists on what a large customer can actually demand from a small supplier -- and most small businesses being asked don't know it exists.
Jul 2026
Points of View is Vaxa's opinion column. Each article states a position on a question where reasonable people disagree — and makes the argument for that position directly.
VAXA POINT OF VIEW
If you supply a large company, its sustainability report is quietly becoming your compliance obligation. That pressure is real, growing, and rarely explained to the small businesses feeling it. What's less well known is that a legal ceiling now exists on what a large customer can actually demand from a small supplier — and most small businesses being asked don't know that ceiling exists, so they either overbuild a response out of fear or ignore the request and risk the relationship.
Pattern
Small and mid-sized enterprises make up more than 90% of businesses globally, and most of them have never been directly subject to a climate disclosure regulation. That's changing indirectly, not through new laws aimed at them, but through the reporting obligations of the large companies they sell to. The EU's Corporate Sustainability Reporting Directive requires large companies to disclose their full value chain emissions — which means those companies need emissions data from their suppliers to comply, regardless of where those suppliers are based or how large they are.
This isn't abstract. CDP, the nonprofit that runs the world's largest environmental disclosure system, requested emissions disclosure from roughly 45,000 suppliers through its Supply Chain program in 2025 alone. Walmart's supplier sustainability program, Project Gigaton, has driven participating suppliers to reduce or avoid more than 750 million metric tons of emissions since the program launched, using supplier reporting platforms and shared targets to get the data it needs. Microsoft requires its suppliers to report emissions annually through CDP as a condition of doing business with the company. If a small business supplies a large customer in Europe, or a large customer anywhere that itself supplies into Europe, a version of this request is either already in the inbox or headed there.
Leverage
Small and mid-sized enterprises make up more than 90% of businesses globally, and most of them have never been directly subject to a climate disclosure regulation. That's changing indirectly, not through new laws aimed at them, but through the reporting obligations of the large companies they sell to. The EU's Corporate Sustainability Reporting Directive requires large companies to disclose their full value chain emissions — which means those companies need emissions data from their suppliers to comply, regardless of where those suppliers are based or how large they are.
This isn't abstract. CDP, the nonprofit that runs the world's largest environmental disclosure system, requested emissions disclosure from roughly 45,000 suppliers through its Supply Chain program in 2025 alone. Walmart's supplier sustainability program, Project Gigaton, has driven participating suppliers to reduce or avoid more than 750 million metric tons of emissions since the program launched, using supplier reporting platforms and shared targets to get the data it needs. Microsoft requires its suppliers to report emissions annually through CDP as a condition of doing business with the company. If a small business supplies a large customer in Europe, or a large customer anywhere that itself supplies into Europe, a version of this request is either already in the inbox or headed there.
A wide gap exists between what large customers say they want and what small suppliers actually feel pressure to deliver — and much of that gap comes down to small businesses not knowing where the real ceiling on the request sits.
Ceiling
In December 2024, EFRAG — the EU body that developed the underlying sustainability reporting standards — published VSME, a simplified reporting format built specifically for smaller businesses responding to data requests from larger customers and banks. Under the EU's Omnibus package, which took effect in March 2026, VSME became more than a suggestion: it is now the legal cap on what a large, CSRD-reporting company is allowed to ask a smaller supplier to provide. A customer cannot demand more than VSME covers.
For most small businesses receiving a first request, the relevant tier is VSME Basic — 51 data points, with Scope 1 and Scope 2 emissions required and Scope 3 explicitly optional, built almost entirely from records a business already holds: utility bills, fuel receipts, basic operating data. VSME is an EU framework, but its relevance extends well beyond EU borders, because any business supplying a large EU company subject to CSRD may receive a request structured around it, regardless of where that supplier is located. A small business that understands this has a specific, bounded, and genuinely manageable answer to give — rather than facing an open-ended request with no sense of where it's supposed to end.
Implication
For a small business that receives a sustainability data request from a large customer, the practical response is to identify what's actually being asked — usually Scope 1 and 2 data at first, drawn from records already on hand — rather than assuming it requires hiring a consultant or building a full sustainability program. Knowing that VSME exists, and that it caps what a CSRD-reporting customer can require, turns an open-ended and anxiety-inducing request into a bounded, answerable one. Where a request does exceed that ceiling, or where informal pressure is pushing past what's formally required, that's a negotiating conversation with the customer — not a signal to build capability nobody actually asked for.
The Question to Ask
The next time a large customer sends a sustainability questionnaire, do you know whether what they're asking for is within the legal ceiling on what they can require — or are you about to overbuild a response out of not knowing where that ceiling sits?