Who Needs VSME? The Value Chain Cap Explained (2026 Guide)
By Ricky Schoeman | Last verified 6 November 2026 against Commission Delegated Regulation (EU) 2026/1560 as published in the Official Journal.
Quick answer
No company is legally required to report under VSME. But since the EU’s Voluntary Standard (Delegated Regulation (EU) 2026/1560) entered into force on 24 September 2026, any company with up to 1,000 employees that supplies a CSRD-scope customer or borrows from a bank is a realistic candidate. From financial years beginning on or after 1 January 2027, the value chain cap also stops CSRD-scope customers from demanding more than the standard’s Annex II datapoints from you for their sustainability reporting.
Key facts at a glance
| Question | Answer |
|---|---|
| Is VSME mandatory? | No. It is voluntary for any undertaking outside CSRD scope. |
| What is its legal status now? | Delegated Regulation (EU) 2026/1560, the “Voluntary Standard” (VS), published in the Official Journal on 21 September 2026 and in force since 24 September 2026. |
| Who is it designed for? | Undertakings with an average of up to 1,000 employees. |
| Who is in mandatory CSRD scope? | Undertakings above both 1,000 average employees and €450 million net turnover. |
| What is the value chain cap? | The upper limit of sustainability information a CSRD reporter may require from value-chain undertakings with up to 1,000 employees. |
| When does the cap apply? | Financial years beginning on or after 1 January 2027. |
| Can protected companies say no? | Yes. They have a statutory right to refuse information above the cap. |
VSME vs the Voluntary Standard: what’s in a name?
VSME began as EFRAG’s Voluntary Sustainability Reporting Standard for non-listed SMEs, delivered to the European Commission in December 2024 and endorsed as Commission Recommendation (EU) 2025/1710. The Omnibus I Directive ((EU) 2026/470) then required the Commission to adopt a standard for voluntary use as a delegated act, built on the original VSME.
That act is Delegated Regulation (EU) 2026/1560. It keeps VSME’s Basic and Comprehensive modules, trims datapoints to align with the revised ESRS, and supersedes the Recommendation, which no longer produces legal effects. Market participants still say “VSME”, so this guide does too, but the legally binding text is now the Voluntary Standard.
Who legally needs VSME? Nobody.
VSME is voluntary by design. The Regulation allows undertakings outside mandatory reporting under Articles 19a and 29a of the Accounting Directive to disclose under the standard if they choose. Assurance is not required either.
Mandatory CSRD reporting, by contrast, now sits with the largest companies: more than 1,000 average employees and more than €450 million net turnover. Those companies report under the revised ESRS (Delegated Regulation (EU) 2026/1563, in force 10 November 2026), not VSME.
Who realistically needs VSME?
The better question is who will be asked for VSME-type data. Pressure comes through contracts and credit, not through a statute.
| Your situation | How much you need it | Sensible starting point |
|---|---|---|
| Supplier to a CSRD-scope company | High. Your customer must still collect value chain data, and VSME is now the benchmark for what it can require. | Basic Module, then Comprehensive if customers ask for more |
| SME borrower or applicant for finance | High and rising. Banks are expected to integrate ESG risk into credit decisions under EBA guidelines. | Basic Module, plus the Comprehensive disclosures lenders request |
| Company courting investors or large procurement buyers | Medium to high. A ready-made dataset shortens due diligence. | Basic plus selected Comprehensive disclosures |
| Micro-undertaking (10 employees or fewer) | Low to medium. Several demanding environmental disclosures are voluntary for you. | Basic Module, only the disclosures requested |
| Company with no corporate customers or lenders asking for ESG data | Low. Reporting may still help you manage your own performance. | Optional |
| Company above 1,000 employees but below the €450m turnover threshold | Unclear. You sit outside CSRD scope, but the cap is defined by employee count, so you are not a protected undertaking. | Take legal advice |
The last row is our reading of the text rather than a published position, so treat it with care.
The value chain cap explained
The problem it solves
Large companies must report on their value chains. Before the cap, that meant a stream of differing, overlapping questionnaires landing on small suppliers. The Commission calls this the “trickle-down effect” and describes the information requests as sometimes disproportionate.
How it works: three rules
- A ceiling. CSRD reporters are prohibited from requiring more from protected undertakings than the information in the Voluntary Standard.
- A right to refuse. Protected undertakings can decline anything above the ceiling.
- A duty to tell you. A CSRD reporter that asks for more must make clear which information is extra and that you may decline it.
“Protected undertakings” are value chain companies that do not exceed 1,000 average employees in the preceding financial year.
Two tiers, and only essential datapoints
The cap does not cover the whole standard. Only essential datapoints are covered, and Annex II lists exactly which ones. There are two lists: one for undertakings with 10 employees or fewer and one for those with more than 10 and up to 1,000. According to Garrigues’ analysis, disclosures voluntary for the smallest firms include B3 (energy and GHG emissions), C3 (reduction targets), C5, C6 and C7. For anyone with more than 10 employees, the cap covers most of the Basic Module plus parts of the Comprehensive Module.
Because the Official Journal text corrected some details from the July version, always check your datapoints against Annex II of Regulation 2026/1560 itself.
What the cap does not do
- It only applies to CSRD reporting. The cap governs information gathered to report under the Accounting Directive as amended. Requests needed to comply with other EU or national law are unaffected.
- It does not govern lenders’ own purposes. The Regulation only encourages banks, insurers and investors to limit requests to the standard for purposes beyond CSRD reporting. It does not bind them.
- It does not stop voluntary sharing. Information commonly shared among companies in a sector can still be exchanged voluntarily.
- It does not override existing obligations. Contractual or legal obligations to provide information that does not exceed the standard remain in force.
An illustration
Imagine a 60-employee packaging supplier receiving a 140-question questionnaire from a CSRD-scope customer. From the customer’s 2027 reporting year, if that questionnaire is being used for CSRD reporting, anything beyond Annex II is optional for the supplier, and the customer must say so. (Illustrative example, not legal advice.)
Timeline: how we got here
| Date | Milestone |
|---|---|
| 30 July 2025 | Commission Recommendation (EU) 2025/1710 endorses VSME |
| 26 February 2026 | Omnibus I Directive (EU) 2026/470 published; in force 18 March 2026 |
| 6 May to 3 June 2026 | Draft delegated act consultation (203 responses) |
| 3 July 2026 | Commission adopts the Voluntary Standard |
| 21 September 2026 | Published in the Official Journal as Regulation (EU) 2026/1560 |
| 24 September 2026 | Voluntary Standard in force |
| 10 November 2026 | Revised ESRS (2026/1563) in force |
| 1 January 2027 | Value chain cap applies to financial years from this date |
What’s inside: Basic and Comprehensive modules
The Basic Module (B1 to B11) covers general information, energy and greenhouse gas emissions, pollution, biodiversity, water, circular economy and waste, workforce, health and safety, remuneration and training, and anti-corruption. The Comprehensive Module (C1 to C9) can only be used on top of the Basic Module and adds strategy, climate targets and risks, human rights, and governance disclosures that banks and large customers tend to ask for. See our guide to Basic vs Comprehensive Module differences for detail.
How to prepare
- Map who asks you for data. List customers, banks and investors, and note which are CSRD-scope.
- Choose your module. Start with Basic; add Comprehensive only where a counterpart needs it.
- Build one reusable data pack. Answer once, share many times.
- Use EFRAG’s guidance and templates. Garrigues notes a digital template is due in November.
- Audit incoming questionnaires against Annex II from 1 January 2027.
- Pick tooling that fits your size. Compare options in our VSME software comparison.
Frequently asked questions
Is VSME mandatory?
No. It is a voluntary standard for undertakings outside mandatory CSRD reporting, and no assurance is required.
Who is protected by the value chain cap?
Companies in the value chain of a CSRD reporter that do not exceed 1,000 average employees in the preceding financial year.
When does the value chain cap start?
It applies to financial years beginning on or after 1 January 2027, though the Voluntary Standard itself has been in force since 24 September 2026.
Can a customer force me to answer beyond the cap?
Not for CSRD reporting purposes. You can refuse, and they must tell you which requests exceed the cap. Requests for other legal or commercial purposes may fall outside the cap, so check the purpose.
Can banks require VSME?
No statute makes banks use it, and the cap does not bind lenders’ own purposes. The Regulation encourages them to align requests with the standard.
Does my company need VSME if it has fewer than 10 employees?
Not by law. If you do report, several demanding environmental disclosures are voluntary for you.
What is the difference between VSME and CSRD?
CSRD is mandatory for the largest companies and uses the ESRS. VSME is voluntary and proportionate, and also sets the ceiling on data requests passed down to smaller suppliers.
