ESG for Medium-Sized Companies: What Customers and Banks Still Ask

Since the Omnibus directive, the Corporate Sustainability Reporting Directive (CSRD) reaches only companies with more than 1,000 employees and more than €450 million net turnover. Most medium-sized companies have dropped out of the legal obligation. The environmental, social and governance (ESG) requests on their desks have not dropped. They now come from customers, banks and auditors, in different formats and with different deadlines.

This guide is about answering those requests from one dataset instead of building a new spreadsheet for every customer.

Does the CSRD still apply to medium-sized companies?

Only above both thresholds. Directive (EU) 2026/470 limits the CSRD to companies with more than 1,000 employees and more than €450 million net turnover. Both criteria have to be met. The narrowed scope applies to financial years starting on or after 1 January 2027, so the first reports under the new rules are due in 2028. Member states have until 19 March 2027 to transpose the directive, and they may exempt companies that were in scope before but fall below the new thresholds for financial years 2025 and 2026.

Listed SMEs, once scheduled to report from 2028, are out of scope entirely. For a company with 300 or 800 employees, the CSRD is therefore no longer a legal duty. It remains the reason why its largest customers ask questions.

Where ESG requests come from now

Customers. In my benchmarking pool of more than 1,000 European CSRD reports, 67 percent disclose Scope 1, Scope 2 and Scope 3 emissions (as of October 2026). Scope 3 includes purchased goods and services, so every one of these companies needs figures from its suppliers or has to estimate them. The GHG Protocol Scope 3 Standard allows spend-based estimates as a start; supplier-specific data replaces them where purchase volumes are large. That replacement is the questionnaire on your desk. How large companies handle Scope 3 targets is covered in my SBTi and Scope 3 guide.

Banks. The European Central Bank's guide on climate-related and environmental risks (2020) expects banks to consider these risks at every stage of the credit process and to monitor them across their loan books. In practice, the relationship manager asks for energy consumption, emissions and the exposure of your sites to heat, flooding or heavy rain, often as part of a loan renewal. None of this depends on whether you fall under the CSRD; what large reporters disclose on climate risk is summarised in CSRD climate risk reporting. If you want to see how sustainable finance markets are moving, the Fiegenbaum Atlas tracks green bond volumes and EU ETS prices.

Auditors and certifiers. Supplier ratings and audits by large customers ask for policies, targets and evidence. They follow their own catalogues, which overlap with the VSME standard but are not identical to it. My guide to ESG questionnaires covers the typical structure.

What the value-chain cap covers, and what it does not

The Omnibus directive added a value-chain cap: a company reporting under the CSRD may request from suppliers with up to 1,000 employees only the information covered by the voluntary standard. That standard is now Delegated Regulation (EU) 2026/1560, in force since 24 September 2026 and designed for companies with up to 1,000 employees. The cap itself applies from financial years starting on or after 1 January 2027, the same years for which the narrowed CSRD scope applies.

The cap helps, but it is narrower than many suppliers assume. It limits what a customer may ask for its sustainability report. Information requested under other EU or national laws is expressly unaffected, and banks, insurers and investors are only encouraged, not obliged, to keep their requests within the standard. Purchasing terms, supplier audits and credit processes therefore remain open channels. And the annex that lists the capped items is exhaustive: climate risks, module C4 of the comprehensive module, are not on it. Climate data will keep arriving, just not in a standard format. I describe the details in five gaps in the value-chain cap.

How to integrate ESG in five steps

1. Name one owner. ESG data touches energy, purchasing, human resources and finance. Without one person who holds the dataset, every request lands with whoever answered the last one.
2. Start with Scope 1 and Scope 2. Fuel, heat and electricity by site, calculated with the GHG Protocol Corporate Standard, electricity location-based as the voluntary standard requires, and market-based as well if you buy green electricity. Customers ask for this first, and the invoices already exist.
3. Use the VSME basic module as your data model. Most capped datapoints come from it: energy, Scope 1 and location-based Scope 2 emissions, water withdrawal, waste and workforce figures. A few come from the comprehensive module, such as business relationships, employee turnover and human rights policies. Structuring your data along the basic module covers most questionnaires. My overview of the basic and comprehensive modules shows what each one contains.
4. Build an answer library. Map recurring questionnaire items to your dataset once, with source and date. The next request then becomes a lookup, not a project.
5. Add a climate risk assessment for your sites when banks start asking. Physical risks such as heat and flooding, and transition risks such as carbon prices, are what lenders want to understand; the difference is explained in physical and transition risks. The method is described in my guide to ISO 14091 climate risk analysis.

Where it usually goes wrong

The most common problem is not missing data but inconsistent data. Three customers receive three different electricity figures, because three people answered from three spreadsheets. A large customer that compares suppliers notices that faster than the supplier does.

The second problem is estimates presented as measurements. A spend-based Scope 3 figure is a legitimate start, but it moves with prices, not with emissions. Label it as an estimate, and say what you will measure next.

The third is treating the first report as a brochure. A VSME report that reads well but cannot be traced back to invoices and meter readings will not survive the first follow-up question from a bank. The value of the exercise lies in the dataset behind it: it feeds energy cost analysis, supplier assessments and the climate risk question that comes next.

The fourth is waiting for a law. For a supplier to a large customer, the deadline is set by that customer's reporting calendar, not by Brussels.

My take: voluntary is a legal category, not a market one

The Omnibus has removed the legal obligation for almost all medium-sized companies. It has not removed the questions. A supplier to a company that reports Scope 3, or a borrower renewing a loan, has no real choice about whether to provide data. "Voluntary" means there is no fine. It does not mean there is no consequence.

That is not an argument for maximum reporting. It is an argument for a small, consistent dataset that you control, structured along the voluntary standard, with clear labels for what is measured and what is estimated. Companies that build it once spend their time on what the data shows, energy costs, supplier risks, site risks, instead of on filling in forms.

If you want to go further on metrics, my overview of 7 key ESG metrics shows which ones customers and lenders ask for most.

FAQ