Compare Your Footprint — Carbon Intelligence Platform

If you run a UK business supplying an EU customer, you’ve probably received a carbon data request in the last twelve months. As of 18 March 2026, there’s a legal limit on what they can ask for.

Why your EU customers are asking for carbon data

The EU’s Corporate Sustainability Reporting Directive (CSRD) requires large companies to report their full value chain emissions — including data from suppliers. That pressure flows downhill. A Tier 1 supplier with 200 employees suddenly receives a 47-question ESG questionnaire from a client in Frankfurt, and has no idea what’s mandatory and what’s optional.

According to the Sustainability Reporting Standards website, 73% of UK SMEs now report increased customer requests for sustainability data. Most of those requests come from larger EU or UK companies responding to their own reporting obligations. The problem: until March 2026, there was no legal framework defining what SMEs actually had to provide.

The VSME standard changes the rules

The EU Omnibus Directive (EU) 2026/470 entered into force on 18 March 2026. Among several major changes to CSRD, it introduced the concept of “protected undertakings” — companies with fewer than 1,000 employees sitting in a reporting company’s value chain.

Here’s the key provision: protected undertakings have the legal right to refuse data requests that go beyond the Voluntary Standard for SMEs (VSME). That’s not guidance. It’s law.

Regulatory note: Under (EU) 2026/470, any company with fewer than 1,000 employees in a reporting entity’s value chain is a “protected undertaking” and cannot be required to provide data beyond the VSME standard. This applies from 18 March 2026.

The VSME itself has two modules:

Basic module — designed for micro-entities. Covers total GHG emissions (Scopes 1 and 2), total energy consumption, and a handful of governance metrics. This is the floor — the minimum any supply chain partner might reasonably need.

Comprehensive module — designed for SMEs facing more complex requests from banks, investors, or large corporate customers. Adds Scope 3 screening, climate risk narrative, and basic transition planning. This is the ceiling — even the most demanding customer cannot legally require more than this from a protected undertaking.

What this means in practice for UK SMEs

Three things you need to know right now.

1. You can push back on excessive questionnaires. If an EU customer sends a 50-field ESG data request covering biodiversity, water usage, social impact metrics, and detailed Scope 3 breakdowns, you have the legal right to respond with: “We’ll provide data to the VSME Comprehensive standard. We are a protected undertaking under (EU) 2026/470 and are not required to go beyond this.”

2. The VSME ceiling protects your time, not your obligation. You still need to provide the data within the VSME scope. If a customer asks for Scopes 1 and 2, total energy consumption, and a basic climate risk statement, that falls within the VSME Comprehensive module and you should provide it.

3. UK SMEs exporting to the EU are covered. The protection applies to any company in a reporting entity’s value chain with fewer than 1,000 employees — regardless of where that company is based. A 150-person manufacturer in Birmingham supplying an automotive OEM in Munich is a protected undertaking.

Common mistakes when responding to data requests

Providing everything asked for without checking what’s required. Many SMEs default to answering every question in a supplier questionnaire. The VSME cap means you should check what’s within scope and politely decline the rest.

Confusing EU CSRD requirements with UK SECR. The VSME cap applies to EU CSRD value chain requests. UK domestic reporting obligations (SECR, UK SRS) are separate frameworks. If you’re in scope for SECR, you still need to comply — the VSME cap doesn’t change that. See our SECR reporting guide for UK-specific requirements.

Assuming “voluntary” means “optional.” The VSME is technically voluntary for the SME — but the cap on what your customer can demand is not voluntary for them. They cannot penalise you for limiting your response to the VSME scope.

Not having the data ready at all. The VSME cap limits what you must provide, but the data within its scope (Scopes 1 and 2, energy consumption) is still expected. Responding with “we don’t measure any of this” isn’t protected by the cap — it’s simply an inability to comply with the baseline.

How CYF helps

Compare Your Footprint is built around UK frameworks — DEFRA/DESNZ conversion factors, SECR reporting requirements, and UK SRS data fields — but its output maps directly to the VSME Comprehensive module. When you complete your carbon footprint in CYF, you have Scopes 1, 2, and a Scope 3 screening ready to share. That’s precisely what the VSME standard requires, and nothing you don’t need. CYF’s benchmark dataset also lets you see how your emissions compare to other businesses in your sector, which strengthens your response to customer questionnaires with contextual data.

Methodology guidance from Alice Roberts, Head of Methodology at Compare Your Footprint.

Most SMEs complete their first carbon footprint in CYF within a few hours. Book a demo to see how your output maps to VSME requirements.