NewsOct 2026

Your big customer's supplier form now has a legal ceiling. Here's the list.

Monday, 8:40 in the morning. We'll call her Maria. She runs a print shop with nine people, and she's made up.

A mail from her biggest customer has sat open since Friday. The customer is preparing its sustainability report and needs "supplier information." A form is attached. It runs to pages: energy, emissions, water, waste, policies, incidents.

Maria's first thought is the one many owners have. If I leave it blank, do I lose the contract?

From next year, the answer starts to change. A new EU rule sets a ceiling on what a big customer may require from a small supplier for its sustainability report. For a business of ten people or fewer, that ceiling is nine items, and most of them sit in the accounts and payroll already. Above the ceiling, the supplier gets a legal right to say no.

What changed

Two EU laws work together here.

The first is the of February 2026. It cut the number of companies that must publish a sustainability report to those with more than 1,000 employees and more than EUR 450 million in net turnover.¹ It also created a "": those companies may not require more than a set list of information from suppliers with 1,000 employees or fewer.²

The second sets the list. On 3 July 2026 the European Commission adopted a , a law that applies directly in every EU country.⁹ Its names every item a big customer may require.¹⁰ The cap applies to financial years beginning on or after 1 January 2027.¹¹

Who it covers

The customer side: companies that must report under the EU . After Omnibus I, that means the largest firms, above both the 1,000 employee and EUR 450 million lines.

The supplier side: any business in their value chain that averaged 1,000 employees or fewer in the previous financial year. A customer may take your word for your size through a simple .³

Inside the cap there are two columns.¹² One for businesses with ten employees or fewer, and one for everyone else up to 1,000.

The list, item by item

For ten employees or fewer, like Maria's shop, a customer may require:

which reporting option you chose (basic, or basic plus comprehensive)
whether you report for your company alone or as a group
basic company details: legal form, sector code, balance sheet total, turnover, number of employees, country of operations, and where your sites are
employees by type of contract, temporary or permanent
employees by gender
the number and rate of recordable work accidents (an accident is recordable if it leads to death or more than three days off work)
whether everyone is paid at least the minimum wage
the share of staff covered by collective agreements
average training hours per employee

That is it. Energy use and greenhouse gas emissions are not on the small-business list.¹³

For eleven to 1,000 employees, the list adds fourteen items: total energy use in MWh, estimated greenhouse gas emissions, water drawn, waste and how much is recycled, whether you apply circular economy principles, short descriptions of your products, markets and main business partners, staff turnover, whether you have a code of conduct and a complaints channel, and any confirmed human rights incidents.¹⁴

A worked example

Here is how Maria's answer sheet could look. The numbers are made up to show the method.

Company details come from her latest accounts. Contract type and gender come from payroll: say seven permanent and two temporary, five women and four men. Accidents: none that kept anyone off for more than three days. Minimum wage: yes. Collective agreements: say none, so 0%. Training: if the team logged 90 hours of courses last year, that is 90 divided by nine, or 10 hours each.

Nine answers, almost all from records she already keeps. Every other question on the form is above the ceiling.

Your right to say no

This is the part most owners haven't heard.

Under Omnibus I, a protected supplier has a any request that goes beyond the list.⁴ A big customer may not write extra demands into a contract for its sustainability report, and a contract clause that tries is not binding.⁵ If a customer does ask for more, it must tell you which questions go beyond the list, and that you have the right to decline them.⁶

Member states must put these rules into national law by 19 March 2027.⁷ Cyprus is no exception.

What the cap does not do

It only covers information a big customer gathers for its own sustainability report under the accounting directive. Requests needed to meet other EU or national law are untouched.¹⁵ Banks, insurers and investors are only encouraged to keep their questions within the same standard.¹⁶ So Maria may still get a longer bank questionnaire.

It doesn't stop you from sharing more. You can answer extra questions if you choose to.

If you ignore the form

The law lets a reporting company use information from its suppliers or estimates for that information.⁸ So if Maria sends nothing, her customer can fill the gap with its own estimate of her figures. Answering the nine items keeps the numbers about her business in her hands.

What to do this month

Check last year's average headcount. It tells you whether you are protected (1,000 or fewer) and which column applies (ten or fewer, or more).
Pull the nine items from your accounts and payroll into one page, and keep it.
When a form arrives, mark each question as on the list or above it.
Read the sustainability clauses in your contracts with big customers.
Decide, calmly, which extra questions you are happy to answer anyway.

Common mistakes

Thinking it applies now. It applies to financial years starting on or after 1 January 2027.
Thinking it covers bank questionnaires. It doesn't. Banks are only encouraged.
Thinking a ten-person firm must report carbon. Energy and emissions are only on the list for firms with more than ten employees.
Refusing everything. The list items are exactly what the law allows a customer to require.
Mixing up the two lines. 1,000 employees decides whether you are protected. Ten decides which list.

Where Vuneli fits

Vuneli is our software for this paperwork. For a firm like Maria's, it prepares the customer's supplier form from the business's own records, so the answers match what the books and bills already say. Maria reads the page and signs.

Next spring, when the form comes back, Maria won't stare at it all weekend. She'll answer nine questions, and she'll know why she can stop there.

Questions owners ask

What is the value chain cap?

It is the upper limit of sustainability information that companies required to report under the EU accounting directive may require from businesses in their value chain with 1,000 employees or fewer. The list is set in Annex II of Delegated Regulation (EU) 2026/1560.

When does it start?

It applies to the reporting customer's financial years beginning on or after 1 January 2027. The right to decline extra requests comes through national law, which EU countries must adopt by 19 March 2027.

Does a small business have to report its carbon emissions to customers?

Not under the cap if it has ten employees or fewer. Energy use and emissions are on the list only for businesses with more than ten employees.

Can a customer put extra demands in a contract?

Not for the purpose of its sustainability report. Omnibus I says reporting companies shall not require more than the list in contracts, and a clause that does is not binding.

Does the cap apply to my bank?

No. Banks and other financial firms are only encouraged to keep their requests within the same voluntary standard.

What is the voluntary standard?

It is the EU's simple sustainability reporting standard for businesses with 1,000 employees or fewer, set out in Annex I of the same regulation and based on the earlier VSME recommendation.¹⁸ Using it is voluntary, and you don't need an auditor to check it.¹⁷

Visit Vuneli

Sources

Directive (EU) 2026/470 of 24 February 2026 (Omnibus I Directive), amending Directive 2013/34/EU and others on sustainability reporting European Parliament and Council, EUR-Lex
1. 1Reporting is limited to companies above EUR 450 million net turnover and 1,000 employees. Recital 7 and Article 2, amending Article 19a(1)
2. 2The value chain cap protects suppliers with 1,000 employees or fewer. Recital 12 and Article 2, new Article 19a(3)
3. 3Reporting companies may rely on a supplier's self-declaration of size. Article 2, new Article 19a(3)
4. 4Protected suppliers may decline information beyond the voluntary standard. Article 2, new Article 19a(3)
5. 5No extra demands in contracts, and clauses that try are not binding. Article 2, new Article 19a(3), points (a) and (b)
6. 6A customer asking for more must say which questions go beyond the list and that the supplier may decline. Recital 12 and Article 2, new Article 19a(3), point (c)
7. 7Member states must transpose the rules by 19 March 2027. Article 5(1)
8. 8Reporting companies may use supplier information or estimates. Recital 12 and amended Article 19a(3)
Commission Delegated Regulation (EU) 2026/1560 of 3 July 2026 on sustainability reporting standards for voluntary use and the value chain cap European Commission, EUR-Lex
1. 9Adopted on 3 July 2026, binding and directly applicable in all member states. Title and Article 4
2. 10The cap is only the datapoints listed in Annex II. Article 3(2) and Annex II
3. 11It applies from financial years beginning on or after 1 January 2027. Article 4 and Recital 6
4. 12Separate lists for ten employees or fewer and for more than ten. Recital 4 and Annex II
5. 13The nine items for ten or fewer, including company details (Annex I, paragraph 27(e)) and the recordable accident definition (Annex I, Appendix A); no energy or emissions. Annex II and Annex I
6. 14The fourteen items added for more than ten employees. Annex II
7. 15Requests needed under other EU or national law are not affected. Recital 4
8. 16Banks and financial firms are only encouraged to stay within the standard. Recital 5
9. 17No obligation to seek assurance on a voluntary report. Recital 5
Commission Recommendation (EU) 2025/1710 of 30 July 2025 on a voluntary sustainability reporting standard for small and medium-sized undertakings European Commission, EUR-Lex
1. 18The voluntary SME standard (VSME) the regulation's standard is built on. Annex; see Recital 3 of Regulation (EU) 2026/1560