CSRD Value Chain Reporting: What Non-EU Suppliers Need to Know

CSRD is not just an EU reporting regulation — it is a mechanism that transmits sustainability data requirements from large EU companies to their global supply chains. If you supply goods or services to a large EU company, that company's CSRD obligations will eventually create data requests directed at you. Understanding how this mechanism works — and preparing your data before the requests arrive — is the difference between being a preferred supplier and a compliance problem.

1. Who is directly subject to CSRD?

CSRD directly requires sustainability reporting from:

• Large EU companies — meeting at least 2 of 3 thresholds: 250+ employees, €40M+ net turnover, €20M+ total assets. First reports due for the financial year 2024 (published in 2025).
• EU-listed SMEs — companies listed on EU regulated markets; from 2026 (with opt-out to 2028).
• Non-EU companies with EU nexus — companies outside the EU with EU net turnover above €150M and either an EU branch with €40M+ turnover or an EU subsidiary that itself qualifies as a large company. First reports due for financial year 2028.

A non-EU manufacturer that is purely a supplier — not a subsidiary or branch operator in the EU — is not directly subject to CSRD. However, the indirect effect through value chain requirements is significant and growing.

2. The value chain cascade: how CSRD reaches non-EU suppliers

ESRS (European Sustainability Reporting Standards), the technical standards under CSRD, require reporting companies to assess and disclose material impacts, risks, and opportunities across their entire value chain — not just their own operations. For most manufacturers, the upstream supply chain is where the largest concentration of environmental and social impacts sits.

Concretely, an EU buyer subject to CSRD must:

• Conduct a double materiality assessment that identifies material topics across its upstream value chain
• Report on Scope 3 GHG emissions (Category 1: purchased goods and services from suppliers represents the largest Scope 3 category for most manufacturers)
• Disclose on social impacts in the value chain (ESRS S2: Workers in the value chain) including human rights due diligence
• Report on environmental risks in the supply chain (deforestation, water use in stressed areas, biodiversity impacts)

To report on these topics, the EU buyer needs data from its suppliers. That is where you come in.

3. What data will EU buyers request?

The specific data requests will vary by industry and the EU buyer's materiality assessment, but the most common categories are:

The requests arrive through buyer questionnaires (often using Ecovadis, CDP Supply Chain, Sedex, or proprietary portals), and increasingly through standardised frameworks like the VSME (see below).

4. How EU buyers decide which suppliers to engage

EU buyers cannot practically collect detailed sustainability data from every supplier. ESRS allows a proportionality approach: companies should focus their data collection on 'significant' suppliers — typically defined by spend concentration and risk profile.

In practice, buyers use a two-tier approach:

• Tier 1 data collection — direct questionnaires sent to suppliers representing ~80% of spend or operating in high-risk geographies / sectors. These are the suppliers from whom actual data is expected.
• Tier 2 estimation — spend-based or industry-average emissions estimates used for the remaining tail of suppliers where individual data collection is not proportionate.

If you are in a buyer's top spend tier, you will almost certainly receive a direct data request. If you supply a category the buyer's materiality assessment flags as high-risk (e.g., textiles from Asia, leather from South America, agricultural commodities), you may be prioritised even at lower spend levels.

5. The EFRAG VSME standard for SMEs

Recognising that cascading full ESRS requirements to every supplier would create disproportionate burden, EFRAG (the European Financial Reporting Advisory Group) has published the Voluntary SME Standard (VSME) — a simplified reporting framework that allows SMEs to respond to buyer questionnaires in a structured, consistent way without undertaking a full CSRD compliance exercise.

The VSME has two modules:

• Module BP (Basic) — approximately 40 data points covering basic information, governance, workforce, and climate. Intended for SMEs with no existing sustainability data infrastructure. Can be completed in 1–2 days with existing operational data.
• Module NP (Narrative and Policies) — adds policy-level disclosures and forward-looking targets. Intended for SMEs that already have some ESG practices in place and want to demonstrate them to buyers.

Non-EU SME suppliers are not legally required to use the VSME, but it is increasingly referenced in buyer questionnaires as the expected format. Using the VSME framework when responding to buyer requests signals competency and makes your data comparable across multiple EU buyers.

6. When non-EU companies are directly subject to CSRD

Non-EU companies become directly subject to CSRD when they have significant EU revenue and an EU presence. The threshold is: net EU turnover above €150M in each of the last two financial years, AND either: an EU branch generating €40M+ net turnover, or an EU subsidiary that itself qualifies as a large company under CSRD.

For companies meeting this threshold, the first CSRD report is due for the financial year 2028, with sustainability information disclosed in line with a 'sustainability reporting standard for third-country companies' (expected to be modelled on ESRS but adapted for non-EU entities).

If your company is approaching €150M in EU revenues and has an EU subsidiary, start preparing now. The 2028 deadline sounds distant but the data infrastructure and materiality assessment require 2–3 years of groundwork.

7. Timeline: when to expect data requests

8. 7-step preparation roadmap for non-EU suppliers

1. Identify your EU buyer exposure — list your EU buyers by revenue, segment them by size (likely CSRD mandatory or not), and prioritise preparation effort accordingly
2. Establish a GHG inventory — Scope 1 and 2 at minimum, with Scope 3 Category 1 if you have significant purchased goods exposure; this is the single most requested data point
3. Collect baseline operational data — energy, water, waste, and workforce metrics from your facility operations; these feed both buyer questionnaires and your own ESG reporting
4. Review certifications — ISO 14001, ISO 45001, SEDEX membership, and industry-specific certifications (GRS, FSC, etc.) are frequently verified in buyer questionnaires; audit status needs to be current
5. Develop policy documentation — an environmental policy, human rights policy, and supplier code of conduct (even a single-page version) demonstrates governance commitment
6. Familiarise with the VSME format — download the EFRAG VSME standard and map your existing data to the Module BP data points; identify gaps before your first buyer request arrives
7. Designate a sustainability data owner — CSRD questionnaires arrive on buyers' reporting timelines, not yours; having one person responsible for coordinating responses prevents delays that create supplier risk flags

FAQs