Since March 18, 2026, Directive 2026/470 known as Omnibus I raised CSRD thresholds to more than 1,000 employees and more than €450 million in revenue. The result: the number of European companies bound to report fell from roughly 50,000 to approximately 5,000.
If your company has 300 employees and generates €80 million in revenue, you are no longer in scope. Technically, you do not have to prepare a sustainability report under ESRS. You do not need a double materiality assessment. You have no assurance obligation.
And yet, nothing changes about what the market asks of you.
Regulation left. Expectations did not.
Here is where many companies are making a critical reading error. They confuse “I am not legally required to report” with “I do not need to have my data in order.” Those are very different things.
Your large customer the one actually in CSRD scope needs scope 3 data from its supply chain to complete its own report. You are its supply chain. That the law does not force you to report does not mean your customer will not demand it. And if you do not provide it, your competitor will.
Banks are in the same dynamic. Financial entities subject to the Taxonomy Regulation and Pillar III requirements need ESG data from the companies they lend to. Not because they want to, but because they have to. If you apply for financing and cannot demonstrate you manage your climate risks, the cost of credit rises. Or you simply do not get it.
And then there are investment funds. ESG mandates remain active. Asset managers need comparable, reliable information to justify their investment decisions to their own regulators. That your company is not legally bound to report does not make it invisible to capital markets.
VSME: the standard nobody forces you to follow but everyone will ask for
In December 2024, EFRAG published the VSME Voluntary Sustainability Reporting Standard for SMEs. It is a voluntary standard designed for companies falling outside CSRD scope but needing to respond to supply chain data requests.
The VSME is not a miniaturized ESRS. It is a much lighter framework with three progressive levels: a basic level of minimum metrics, a level of policies and actions, and a level of strategic narrative. The idea is that each company chooses the level matching what others ask for, without having to build a full reporting department.
What is interesting is what is happening in practice. Large companies in CSRD scope are starting to tell their suppliers: “send me your data in VSME format.” It is not a legal obligation. It is a commercial request. But when your main customer asks for it, the difference between legal and commercial blurs pretty fast.
The formalization of VSME as an official reference is scheduled for June 2026. After that, expect these requests to multiply.
What they will ask for and what you should have ready
You do not need to build a complete CSRD report. But you do need to have a minimum data package you can share when asked and that is credible.
This is what we see large companies most frequently asking from their suppliers:
Carbon footprint: Scope 1 and 2 at minimum, ideally with upstream scope 3. You do not need a full audit, but you need a recognizable methodology (GHG Protocol) and traceable data.
Reduction plan: Not a 50-page document. Some targets quantified over 3-5 years with the main actions you will take. RD 214/2025 already forces this on you if you fall under Law 11/2018, so you probably should have it anyway.
Basic policies: Environment, labor rights, governance. They do not need to be perfect. They need to exist and be coherent with what you do.
Supply chain data: If you are a supplier to a CSRD-scope company, that company needs your data for its scope 3. The easier you make it for them, the harder it will be for them to replace you.
All of this fits into what we call a “VSME+ package”: a baseline VSME expanded with the specific KPIs your main customers and financiers ask for most. It is not theoretical. It is mapping the five questions you get asked most often and having the answers ready before you get asked again.
The cost of doing nothing
There is a scenario we see repeat. The company falls out of CSRD scope, management interprets it as “we no longer have to report,” and the sustainability team if it exists loses budget and priority.
Six months later, a major customer sends an RFP with a 40-question ESG questionnaire. Or the bank asks for data to renew a credit line. Or an investment fund requests information for due diligence. And the company has nothing prepared.
The cost is not a fine. The cost is losing a contract, paying more for financing, or being excluded from a procurement process. These are invisible costs until they hit you. And when they do, there is no quick way to recover lost time.
What you can do today
First, stop thinking of this as “complying with regulation” and start thinking of it as “having my data ready for when they ask.” The mindset shift matters because it changes the urgency.
Map who asks you for ESG data today: customers, banks, investors, partners. Identify the questions that repeat. Prepare standardized answers with up-to-date data.
Centralize the collection of emissions, energy, waste, and water data. Not in an Excel that only one person understands, but somewhere any team member can access, update, and export.
And if you still do not have your carbon footprint calculated: start there. RD 214/2025 already binds you, VSME will ask for it, and your customers will not wait for either.
Being outside the scope is not being out of the game. It is having the freedom to prepare at your own pace but prepare.