EU Value-Chain Cap: Five Gaps in the Voluntary Standard

Eight to fifteen ESG questionnaires per year: that is the reality for mid-market suppliers in Germany working with larger customers, and it is the reason the EU has built a value chain cap. Every company reporting under the CSRD develops its own templates, its own categories, its own definitions. The result: triple data collection for the same information, in three different formats, to three different deadlines.

The European Commission has recognised this problem. On 6 May 2026, it published the draft of a delegated act that codifies the VSME standard as a mandatory ceiling for value chain data requests: the so-called Voluntary Standard as value chain cap. On 3 July 2026, the Commission adopted the final version; it was published in the Official Journal on 21 September 2026 as Delegated Regulation (EU) 2026/1560 and has been in force since 24 September 2026. The concept is sound. But the final text carries four of the five structural shortcomings from the draft through unchanged and closes only half of the fifth, precisely the shortcomings that provoke the avoidance behaviour the regulation is meant to prevent.

As an independent ESG consultant, I submitted a formal response to the European Commission on 14 May 2026 regarding this draft. A parallel response addresses the simultaneously consulted delegated act on ESRS simplification. This article summarises what I identified and what it means for your organisation.

Update of 28 September 2026: The final text was published in the Official Journal on 21 September 2026 as Delegated Regulation (EU) 2026/1560 and entered into force on 24 September 2026. Comparing it with the wording shows: the exception for information customarily exchanged within a sector no longer appears in the recitals, while the exception for other legal obligations now also covers Member State law. The exclusion of climate data (C3, C4) and Scope 3 from the cap, the blanket micro-enterprise relief and the FY 2027 start date all remain unchanged. The details are in the section What the final text changed.

What is the value chain cap?

The value chain cap, called the Wertschöpfungsketten-Deckel in German-language coverage, is a limit on what one company may ask another for. Delegated Regulation (EU) 2026/1560 (Commission document C(2026) 5011 of 3 July 2026, published in the Official Journal on 21 September 2026; draft reference Ares(2026)4624010) supplements the Accounting Directive 2013/34/EU as amended by the Omnibus I act (Directive 2026/470) with a central protective mechanism: companies subject to the CSRD (Directive 2022/2464) will, from financial year 2027, only be permitted to request from suppliers and business partners with up to 1,000 employees the sustainability datapoints listed in Annex II of the regulation, a selection from the Voluntary Standard (Article 1, Article 3(2)). The standard itself is built on the VSME data model developed by EFRAG.

Who is bound matters as much as what is capped. After Omnibus I, CSRD scope covers companies with more than 1,000 employees and net turnover above 450 million euros, reporting from financial year 2027. Those are the companies the cap constrains when they send out questionnaires. The protection, however, has its own threshold: the cap shields companies whose average headcount does not exceed 1,000 employees (Article 1). Up to that size you are never the addressee of the obligation, only its beneficiary, protected as the recipient of requests without reporting under the CSRD yourself. A company with more than 1,000 employees but less than 450 million euros in turnover is neither obliged to report nor protected by the cap.

What the cap covers splits along module lines. The Voluntary Standard is organised in a basic module (B1 to B11) and a comprehensive module (C1 to C9), and the cap points at individual datapoints from those modules, listed in Annex II. That distinction decides how much of an incoming questionnaire a single sustainability reporting file can answer:

More on this point: VSME Report Example: What a Finished Report Contains, Disclosure by Disclosure.

Two things the table does not show. Buyers keep asking for the capped rows anyway, just in their own wording: a request for energy intensity per unit of revenue is B3 data with a divider on top, not a new disclosure. And building my own VSME reporting tool showed the same split on the implementation side, because B3, B6 and B7 come out of meter readings and invoices a company already holds, whereas C4 and Scope 3 need external data and a method decision. Those are the rows that turn into projects.

That is the concept. The question is whether the regulation can operationally enforce it.

My assessment after comparing the text with the final version: the cap genuinely limits only one of several data channels. The sector practice loophole has gone from the recitals, the one for other legal obligations now reaches into national law, climate data (C3, C4) and Scope 3 still sit outside the cap, and the mandatory FY 2027 start date is tight. Why the concept is nonetheless sound and overdue, and where it falls short in detail, I work through gap by gap below.

Why the concept is sound and urgently needed

The so-called trickle-down effect is real and measurable. Large corporates reporting under the CSRD need value chain data they do not hold themselves. They pass these requirements down to their suppliers, in individual formats, with varying deadlines and sometimes contradictory definitions.

Mid-market companies I work with currently receive between eight and fifteen different ESG questionnaires per year. The CSRD-driven share of those is a minority. The larger channels, sector initiatives, banking processes and rating agencies, run alongside it. This illustrates how significant the protection gap still is.

A single, standardised VSME report as a binding limit would have a genuine efficiency effect. For SMEs it means less duplicated data collection; for CSRD-obligated companies it means better data quality. Both sides benefit from a clear, shared data model. My benchmark pool of more than 1,000 European CSRD reports for financial years 2024 and 2025 shows that 67 per cent of reports contain values for all three Scope levels. The standard is therefore not an academic problem. Data as of September 2026.

Gap 1: Two loopholes leave the largest channels open

The recitals of the draft contained two exceptions that, taken together, can effectively hollow out the cap. The final text dropped the first and widened the second (see the section on the final text below):

"Information that is customarily exchanged within a sector" was to remain shareable on a voluntary basis under the draft. In practice, sectoral peer pressure is the strongest mechanism through which non-standardised questionnaires arise. Industry associations, major customers and rating providers drive this mechanism. The cap would not have applied here.

"Obligations under other Union law" are expressly excluded, and in the final text this extends to obligations under the law of the Member States as well (recital 4). This covers the CSDDD, the German Supply Chain Due Diligence Act, the EU Taxonomy and the EBA Pillar 3 requirements for banks. Companies subject to reporting obligations will use this legal basis to continue sending bespoke questionnaires.

The combined effect: the cap protects against exactly one channel (CSRD value chain reporting), whilst the larger channels remain open. That is better than nothing, but it is not what the act promises.

My recommendation: Recital 4 should clarify that the cap represents the coordination standard that other Union acts and sector practice should use as their starting point. Article 3 should introduce a documentation obligation: any party invoking the exception for other legal obligations must cite the specific legal basis and explain why the requirement goes beyond the cap.

Gap 2: Climate data is excluded from the cap, yet is the most requested

Annex II of the regulation sets out the disclosures covered by the cap exhaustively (Article 3(2)), and the climate-related disclosures of the comprehensive module are still absent from it; from that module only C1, C5, C6 and C7 appear: C3 (GHG reduction targets) and C4 (climate risks) remain outside the cap, as the two "No" rows in the table above show. This is structurally problematic, because precisely these data points are required by the most important customers.

Banks that must meet EBA Pillar 3 requirements need physical risk assessments from their borrowers. Large corporates subject to the CSRD that are preparing transition plans under ESRS E1 need GHG reduction targets from their supply chains. SFDR financial market participants need PAI data that depends on value chain inputs.

If the cap excludes C3 and C4, these data points will continue to be requested, but via individual questionnaires rather than the standardised VSME format. That is exactly the trickle-down effect the regulation is meant to prevent.

A practical example from my climate risk analysis for a mid-sized German corporate group: the quantified physical risk exposure was up to 31.5 million euros per year, of which 88 per cent were physical risks (primarily hail and heavy rainfall). A small number of sites concentrated more than a third of that exposure. Without structured climate risk disclosures within the cap, banks will continue to request bespoke assessments from value chain suppliers for such groups.

My recommendation: Include C3 and C4 in Annex II as "required where applicable". An SME with no identifiable climate risks would simply state that the disclosure does not apply. SMEs with material climate exposure, the majority in asset-heavy sectors, would provide a standardised disclosure once, rather than responding repeatedly to multiple ad hoc requests.

Gap 3: Scope 3 remains outside the cap, the most requested data point

Paragraphs 49 to 52 of the Voluntary Standard treat Scope 3 as an optional disclosure (paragraph 51 opens with the company deciding to disclose the metric), paragraph 12 groups it with sector-typical additional disclosures, and Annex II does not list it. That places Scope 3 explicitly above the cap. This is operationally the most significant problem.

Scope 3 is precisely the disclosure that CSRD-obligated companies most urgently need from their suppliers, because they cannot calculate it without supplier data. Excluding Scope 3 from the cap guarantees bespoke questionnaires.

The data from my CSRD benchmark is unambiguous:

• 67 per cent of more than 1,000 analysed CSRD reports (FY 2024 and 2025, as of September 2026) contain values for all three Scopes, which leaves 31 per cent of formally obligated companies without a complete Scope picture
• 14 per cent contain no extractable Scope data at all, despite a formal CSRD obligation
• 8 per cent of reports disclosing a Scope 3 figure report a Scope 3 value smaller than Scope 1 or 2, which is methodologically implausible in almost every sector

Methodology note: The CSRD benchmark pool comprises more than 1,000 publicly available European sustainability statements for financial years 2024 and 2025, analysed automatically via the VSEasy data platform. Scope values were included with an extraction confidence score of at least 0.75. Methodology description available on request.

The combination of weak Scope 3 data quality at reporting level and a lack of standardisation at supplier level means CSRD-obligated corporates will deploy bespoke Scope 3 questionnaires to fill the gaps. A minimum standard within the cap would reduce this friction and improve overall data quality. For more on this, see the article on the most common mistakes in Scope 3 accounting.

My recommendation: Codify a minimum standard for Scope 3 disclosures within the cap, for companies in climate-critical sectors (consistent with the C3 logic in paragraph 54). The minimum standard: the three largest Scope 3 categories using a spend-based methodology. This is achievable even without prior Scope 3 experience.

Gap 4: The micro-enterprise relief does not fit climate-critical sectors

The relief for micro-enterprises with up to 10 employees is sensible in principle. In its current design, it is too broad.

A property company with five employees can manage a portfolio with materially relevant energy consumption, embedded CO₂ emissions and physical risk exposure far exceeding what a fifty-person service firm generates. The relief permits this micro-enterprise to omit total energy consumption, Scope 1 and 2, water withdrawal and waste data (paragraphs 32, 33, 36 and 39 are voluntary for companies with up to 10 employees).

For banks and large customers working with such portfolios, all quantitative environmental data would be absent. This is also a contradiction from the perspective of the Omnibus reform package: reducing bureaucracy, yes, but not at the expense of climate-critical data points.

My recommendation: Restrict the relief to companies whose primary NACE sector does not fall within the climate-critical sectors (NACE Sections A to H and M). For climate-critical sectors, the environmental disclosures B3, B6, B7 as well as C3 and C4 (where applicable) should remain "required".

Gap 5: FY 2027 puts all parties under excessive pressure

The final text provides for mandatory application from financial year 2027 (the second paragraph of Article 4: Article 3 applies to financial years beginning on or after 1 January 2027); the deferral to FY 2028 that I recommended was not taken up. With entry into force on 24 September 2026, that leaves CSRD-obligated companies with a calendar financial year little more than three months to:

• Migrate internal supplier data systems to the VSME data model
• Redesign and communicate supplier questionnaires
• Train procurement and sustainability teams
• Apply the EFRAG Knowledge Hub guidance, which is not yet stable

The risk of an overly tight timeline: reporting companies cannot restructure their processes in time and continue using existing bespoke questionnaires for at least one further reporting cycle. The standard then launches with a credibility deficit.

Interestingly, this is a pattern also observed with the original CSRD introduction: too much implementation pressure leads to formal compliance without substantive process quality.

My recommendation: Defer mandatory application to FY 2028. Allow voluntary early application from FY 2027. Use the additional year to finalise the EFRAG Knowledge Hub and run a structured pilot with three to five reporting companies per Member State.

What this means for your organisation today

The value chain cap is settled: in force since 24 September 2026, applicable from financial year 2027. The question is no longer whether, but how well it functions in its first version. Several other consultation respondents have raised related points, including an NGO focused on financial market transparency and a network of certified purpose-driven companies, with recommendations on relief for climate-critical sectors and on strengthening climate data within the cap. The final text did not take these points up. Three strategic recommendations follow for your organisation.

Build a VSME report as your standard response

Building a structured VSME report today provides multiple layers of protection: as a response to current customer requests, as a benchmark for bank conversations, and as groundwork for the requests that fall under the cap from FY 2027. From FY 2027 it also gives you a straight reply to anything outside it: name the module the request maps to, and ask which legal basis takes it beyond the cap. The VSME Readiness Check shows you where you stand today in just a few minutes.

Do not defer climate data until the cap applies

Even though C3 and C4 currently sit outside the cap, banks and CSRD-obligated customers will continue to request this data. A structured climate risk analysis following TCFD logic gives you an audit-ready basis, rather than having to respond from scratch to individual requests each time.

Approach Scope 3 pragmatically, not by ignoring it

The spend-based methodology is practical for SMEs. Documenting the three largest Scope 3 categories using a spend-based approach covers a large share of CSRD-relevant requests, even though the cap does not include Scope 3.

Sources and transparency

Primary sources:

• EU Have Your Say: Voluntary Standard consultation (submitted responses)
• EUR-Lex: Delegated Regulation (EU) 2026/1560 (OJ of 21 September 2026)
• EUR-Lex: Accounting Directive 2013/34/EU
• EUR-Lex: CSRD (Directive 2022/2464)
• EUR-Lex: Omnibus I (Directive 2026/470)
• EFRAG: VSME Digital Template and XBRL Taxonomy

Transparency: Fiegenbaum Solutions provides VSME implementation and climate risk consulting for companies directly affected by this regulation. This article is based on the formal response I submitted to the European Commission on 14 May 2026, as well as practitioner experience from client projects. The anonymised practical examples (mid-market group with physical climate risk analysis) are verifiable but presented without client reference for reasons of confidentiality.

If you want to go deeper: EU AI Act for ESG and Carbon Accounting Software: Risk Class, Deployer Duties, Deadlines.

Not legal advice: This analysis reflects my practitioner perspective and does not substitute individual legal or tax advice on the application of the CSRD, the Voluntary Standard or related EU acts. For company-specific application questions, I recommend consulting a specialist legal adviser.

What the final text changed

The final text has been in the Official Journal since 21 September 2026 as Delegated Regulation (EU) 2026/1560 and in force since 24 September 2026 (Article 4). I checked my five gaps against the wording. Gap 1 is only half closed. The exception for information customarily exchanged within a sector no longer appears in the recitals; sector-typical information survives only in paragraph 12 of Annex I, as additional disclosures an SME may choose to make in its own report, and Annex II does not list it. The second exception, by contrast, has become wider: recital 4 leaves untouched requests made to meet obligations under other legislation of the Union or of the Member States. A purely national obligation such as the German Supply Chain Due Diligence Act can now rely on it, and the documentation duty I proposed for Article 3 is missing.

Gaps 2 to 4 stand unchanged. Article 3(2) limits the cap to the datapoints in Annex II, and the only comprehensive-module entries there are C1, C5, C6 and C7. C3 (GHG reduction targets) and C4 (climate risks) are still absent, as are the transition plan disclosures for climate-intensive sectors (NACE Sections A to H and M, paragraphs 54 and 55). Scope 3 remains optional: paragraph 12 refers to paragraphs 49 to 52, and paragraph 51 applies only if the company decides to disclose the metric. The micro-enterprise relief still applies across the board to companies with up to 10 employees: paragraphs 32, 33, 36 and 39 are voluntary for them, and Annex II takes B3, B6 and B7 out of the cap for that size class regardless of sector.

Gap 5 remains and has tightened. Under the second paragraph of Article 4, Article 3 applies to financial years beginning on or after 1 January 2027; there is no deferral to 2028. Because the regulation entered into force only in September, little more than three months separate entry into force from the first covered financial year, not the roughly twelve I assumed in May. Two further points are weaker than a first reading suggests. The limitation of the cap to information collected for sustainability reporting sits in recital 4, not in Article 1 or 3. And towards banks the text stays a request: recital 5 merely encourages credit institutions and other financial undertakings to limit what they ask of companies with up to 1,000 employees, as far as possible, to the information in Annex I.

As long as climate data and Scope 3 sit outside Annex II, the regulation caps the questions that cost suppliers least and leaves the expensive ones open.

Frequently asked questions