CSRD VSME Standard 2026: What SME Suppliers Need to Know as It Lands

CSRD VSME Standard 2026: What SME Suppliers Need to Know as It Lands

On 3 July 2026, the European Commission adopted the Voluntary Sustainability Reporting Standard for SMEs, the VSME, together with a revised set of European Sustainability Reporting Standards (ESRS), the technical rules underneath the EU's Corporate Sustainability Reporting Directive (CSRD). For SME suppliers, it is the first time "what can our customers ask us for" has a legal answer.

Spectreco, a sustainability technology and advisory firm with hubs in Atlanta, London, Lisbon, Dubai, Muscat, and Lahore, works with GCC and Pakistani exporters whose EU customers already send these questionnaires down the supply chain.

Here is what the CSRD VSME standard 2026 covers, why voluntary sustainability reporting just became a value chain requirement, and what SME suppliers should do before the cap takes effect.

What Is the CSRD VSME Standard?

The VSME is a simplified ESG reporting framework the European Commission turned into binding EU law on 3 July 2026 for companies outside mandatory CSRD scope. Built on a 2024 template from the European Financial Reporting Advisory Group (EFRAG), it gives SME suppliers one standard format to answer sustainability questions, instead of a different questionnaire for every customer.

EFRAG, the technical body that also drafted the mandatory ESRS, published the original VSME template in December 2024. The Commission recommended it for voluntary use in 2025, and the 3 July 2026 delegated act upgraded that recommendation into law, which is why some advisers now call it the Voluntary Standard, or VS, rather than VSME.

The act defines eligible companies as "protected undertakings": businesses outside mandatory CSRD scope with no more than 1,000 employees on average, reaching further up the supply chain than the original 250-employee VSME target.

Sources: European Commission, Mayer Brown, Zerovia

Why the VSME Exists: Large Companies Still Need SME Data

The Omnibus I simplification package raised the mandatory CSRD threshold from 250 employees to 1,000, cutting directly obligated companies from roughly 50,000 to around 5,000 EU-wide. Fewer companies report directly, but they have not lost their appetite for supplier data: they still must disclose Scope 3 emissions, and banks still need it for financed-emissions calculations.

Before 3 July 2026, that left a gap with no rulebook:

• Customers kept sending questionnaires to suppliers no longer obligated to answer
• Every customer and lender asked in a different format, with no shared baseline
• SMEs had no legal ceiling on what they could reasonably be asked to hand over

The VSME closes that gap: a shared format, and a cap on what can be demanded.

VSME vs Full ESRS: What Is Actually Different

VSME is not a lighter version of every ESRS requirement. It is a separate standard built on compatible data language, so a company that later crosses into mandatory CSRD scope can upgrade rather than start over. For the full mandatory framework, see our ESRS Standards Explained guide.

Sources: European Commission, Coolset, GetSunhat

Basic Module vs Comprehensive Module

The Basic Module is the floor every protected undertaking should be able to answer, across eleven disclosure areas (B1 to B11):

• General company and governance information
• Energy use and Scope 1 and 2 emissions
• Pollution, biodiversity, water, and waste
• Workforce, health, safety, and anti-corruption policy

A company can only move to the Comprehensive Module once it has fully applied Basic. Comprehensive adds strategy narrative, Scope 3, climate targets and risk, human rights incidents, and gender diversity. Both modules share ESRS taxonomy, so nothing collected for VSME goes to waste if a company later grows into mandatory scope.

Source: GetSunhat

The Value Chain Cap: What It Actually Protects

Companies subject to CSRD "cannot require companies in their value chains that have 1,000 employees or fewer to provide more sustainability information than is required by the voluntary reporting standard," the European Commission stated on adoption.

In practice, a protected undertaking now has a legal basis to decline a questionnaire that goes beyond the VSME Basic Module, rather than negotiating supplier by supplier.

Source: European Commission

Extra Shelter for Micro-Suppliers

Companies with 10 or fewer employees get extra shelter: some Basic Module environmental disclosures, including energy and Scope 1 and 2 emissions, become voluntary rather than expected.

Source: Mayer Brown

What the Cap Does Not Cover

The cap has real limits. Scope 3 sits outside it, since it belongs to the Comprehensive Module, not Basic. Climate targets and climate-risk disclosures are excluded too, along with requests tied to other EU law, including the Corporate Sustainability Due Diligence Directive.

If an EU customer needs Scope 3 or climate-risk data for its own ESRS disclosure, expect the ask to keep coming, cap or no cap.

Sources: Fiegenbaum Solutions, Cooley

The delegated acts enter into force around four months after adoption, after European Parliament and Council scrutiny. The cap and the wider VSME framework apply to financial years beginning on or after 1 January 2027.

How SME Suppliers Should Prepare Now

1. Confirm your protected-undertaking status. Check headcount against the 1,000-employee ceiling, and note if you sit at or under 10 for the extra relief.
2. Map who is already asking. List every EU customer, bank, and investor sending questionnaires, and check each against the VSME Basic Module.
3. Pull the records you already have. Energy bills, fuel invoices, waste and water logs, HR headcount, and safety data usually already sit in finance or HR systems.
4. Build one Basic Module disclosure pack. Assemble the roughly 50 datapoints once, and reuse it for every customer.
5. Plan separately for Scope 3 and climate-risk requests. These sit outside the cap, so budget for emissions calculation now, not at deadline.

Source: Emerald Power

Get Ahead of the Value Chain Cap

For GCC and Pakistani exporters, this is not a distant EU rule. Buyers in real estate, manufacturing, and financial services already run supply chain ESG programs that will ask for VSME-format data well before January 2027, the same pattern seen in the EU CBAM 2026 simplification, where EU importers now demand verified carbon data from exporters outside the bloc.

Spectreco's cloud-native ESG platform builds a Basic Module disclosure pack once and keeps it current. The Compliance, Reporting & Disclosures advisory team maps which EU asks fall inside the cap. For suppliers without the headcount to run this in-house, the Virtual Sustainability Office operates it as your team, without the hire.

Ready to see where your VSME gaps sit against your top EU customers? Request an SME ESG readiness assessment and we will map your Basic Module coverage sector by sector.

Frequently Asked Questions (FAQs)

For the full mandatory framework, see Spectreco's guide on ESRS standards explained for CSRD disclosure requirements, and, for value chain exposure into the EU, Pakistan textile exporters and EU CBAM.

‍

Get VSME-Ready Before FY2027

The value chain cap is now law, and EU buyers are already lining up VSME-format requests for financial years beginning 1 January 2027. That leaves a narrow window to build a Basic Module disclosure pack that survives scrutiny from every EU customer at once. Book a Spectreco SME ESG readiness assessment to map your protected-undertaking status, benchmark your data against the Basic Module, and prepare for the Scope 3 and climate-risk asks the cap does not cover.

‍