What the EU's New Value-Chain Cap Means for UK SME Suppliers

On 19 March 2026, the EU Omnibus I Directive entered into force. If you're a UK SME with customers in the EU, this matters — and not just because of what it asks of you, but because of what it now prohibits your customers from asking.

For the past two years, the dominant narrative around the EU's Corporate Sustainability Reporting Directive (CSRD) has been one of growing pressure: large companies building Scope 3 emissions inventories would need data from their supply chains, which meant smaller suppliers — including UK SMEs — would face increasingly demanding questionnaires and data requests. That pressure hasn't disappeared. But the Omnibus I Directive has introduced a legal ceiling on how far those requests can go.

What the Omnibus I Directive actually says

The Omnibus I Directive made several significant changes to CSRD, most notably removing companies with fewer than 1,000 employees and turnover below €450 million from the mandatory reporting scope entirely. But the provision with the most immediate commercial relevance for UK SME suppliers is the statutory value-chain cap.

Under the Directive, large companies that are subject to CSRD and need to report on their Scope 3 (value chain) emissions are now explicitly restricted in what they can request from their supply chain partners. Specifically: if a supplier has fewer than 1,000 employees, the large company may not request sustainability data beyond what is specified in the VSME — the Voluntary SME Standard developed by EFRAG, the European Financial Reporting Advisory Group.

This is not a guideline or a soft norm. It is a legal floor. Suppliers with fewer than 1,000 employees have a legal right to refuse requests that go beyond VSME scope, and the Directive places the burden on the large company to limit its requests accordingly.

What is the VSME standard — and what will it require?

The VSME standard is currently being finalised. The European Commission has until 19 July 2026 to define its exact content, so we are in a transitional window where the outer boundaries of what customers can ask are defined by the Directive, but the precise data fields are still being specified.

Based on current EFRAG guidance and the logic of how large companies must report their Scope 3 Category 1 (purchased goods and services) and Category 11 (use of sold products) emissions, the VSME is expected to cover:

• Scope 1 emissions — direct emissions from company operations (fuel combustion, company-owned vehicles)
• Scope 2 emissions — indirect emissions from purchased electricity and heat
• Simplified Scope 3 — likely limited to the most material upstream and downstream categories, rather than all 15 GHG Protocol Scope 3 categories

This is precisely the scope that CYF's platform is built to support. A company using CYF to track and report its SECR obligations already has the Scope 1 and 2 data that will form the core of any VSME-compliant response. Extending to simplified Scope 3 — a step many CYF users are already taking — puts a supplier in a fully defensible position under the new legal framework.

What does this mean practically, if you're a UK supplier with EU customers?

If your company has fewer than 1,000 employees and you supply goods or services to EU-based large companies, the new framework means several things in practice.

First, you now have a legal basis to push back on requests that go beyond VSME scope. If an EU customer sends you a 40-question sustainability questionnaire that asks for detailed supplier spend data, Scope 3 calculations across multiple categories, or governance disclosures you don't have the infrastructure to produce — you can decline those elements with a clear legal basis.

Second, and more importantly for long-term business relationships: you still need to be ready with VSME-scope data. The cap protects you from excessive requests, but it does not reduce your customers' underlying need for supply chain carbon data. EU-listed companies will still need to report Scope 3, and they will still come to their suppliers for input. The difference is that the request will now be more standardised and more proportionate.

Third, being ready with credible Scope 1 and 2 data — and ideally a clear methodology statement — before you're asked puts you ahead of the majority of UK SME suppliers, most of whom are still unprepared. In competitive procurement situations, being able to respond immediately and accurately to a carbon data request is increasingly a differentiator, not just a compliance task.

The "measure once, respond to many" opportunity

One of the most consistent findings in research on Scope 3 supply chain programmes is that many SME suppliers receive multiple, nearly identical data requests from different customers — each in a different format, through a different portal, on a different timeline. This creates duplication without improving data quality.

The VSME standard, once finalised, has the potential to solve this problem by standardising what large companies can ask for. A supplier that produces a single, rigorous, VSME-compliant carbon data package will be able to respond to multiple customers from a single baseline measurement, rather than rebuilding the same data from scratch for every questionnaire.

This is the "measure once, respond to many" model — and it is the most commercially efficient way for a UK SME to manage the growing volume of supply chain carbon requests.