--- title: "A large customer asks for ESG data per product" description: "A large customer may need value chain data for its sustainability report or its due diligence. Under the Accounting Directive as amended by Directive (EU) 2026/470, a supplier with up to 1 000 employees may decline reporting requests that go beyond the voluntary standard, and must be told which questions do. Give what product laws require, share verified data once, and agree the rest in writing." type: "problem" url: "https://www.conphora.com/solutions/problem/esg-customer-request/" markdown: "https://www.conphora.com/solutions/problem/esg-customer-request.md" locale: "en" language: "en" updated: "2026-10-04" author: "Conphora compliance team" publisher: "Conphora" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02013L0034-20260318" tags: ["sustainability-claims"] license: "Free to quote with attribution and a link to the page" --- # A large customer asks for ESG data per product A large customer may need value chain data for its sustainability report or its due diligence. Under the Accounting Directive as amended by Directive (EU) 2026/470, a supplier with up to 1 000 employees may decline reporting requests that go beyond the voluntary standard, and must be told which questions do. Give what product laws require, share verified data once, and agree the rest in writing. ## Why this happens Large customers ask suppliers for sustainability data for two legal reasons: their own sustainability report and their own due diligence. The reporting rules are in the Accounting Directive, Directive 2013/34/EU. In the consolidated text of 18 March 2026, undertakings above EUR 450 million net turnover and an average of 1 000 employees must report on their sustainability impacts, for financial years starting on or after 1 January 2027 under national law, including their value chain, products and services, business relationships and supply chain (Article 19a(1) to (3)). The 2026 amendments, made by Directive (EU) 2026/470, must be transposed by 19 March 2027 (Article 5(1) of that directive). [1][2] The same amendment protects smaller suppliers. A protected undertaking is one that did not exceed an average of 1 000 employees in the preceding financial year and is in the value chain of a reporting undertaking. It may decline to provide information that exceeds the voluntary standards in response to a request made for sustainability reporting. The reporting undertaking must not require more by contract, any contrary contract clause is not binding, and when it asks for more it must tell the supplier which information exceeds the standards and that the supplier may decline (Directive 2013/34/EU Article 19a(3)). [1] The voluntary standard was adopted as Commission Delegated Regulation (EU) 2026/1560. It lets undertakings outside mandatory reporting report voluntarily, and its Annex II lists the datapoints that make up the value chain cap; Article 3 applies from financial years beginning on or after 1 January 2027. [3] The cap does not touch requests made for other purposes, including Union due diligence requirements, and it imposes no obligation on any company in the value chain to provide information (Article 19a(3)). The Corporate Sustainability Due Diligence Directive, Directive (EU) 2024/1760, was also amended by Directive (EU) 2026/470: it now covers companies with more than 5 000 employees and EUR 1.5 billion net worldwide turnover (Article 2(1)(a)), for the in-depth assessment, information may be requested from business partners only where necessary, and from partners with fewer than 5 000 employees only where it cannot reasonably be obtained otherwise (Article 8(2a)). Member States apply it from 26 July 2029 (Article 37(1)). [2] Product laws are a separate track. Under the EU Deforestation Regulation, for example, the operator must pass the reference numbers of its due diligence statements to the companies it supplies (Regulation (EU) 2023/1115 Article 4(7)). That data is owed regardless of any questionnaire. [4] ## How to solve it 1. **Ask what the data is for** Find out whether the customer needs the data for its sustainability report, for its own due diligence, or for a product law such as the deforestation rules. Each purpose has different rules on what it may ask of you. 2. **Check whether you are a protected undertaking** If your average number of employees in the preceding financial year did not exceed 1 000 and you are in the customer's value chain, you are a protected undertaking for its sustainability reporting. A self-declaration is enough; the customer need not verify it unless it is manifestly incorrect. 3. **Separate legal duties from voluntary requests** Some data you must pass on by law, for example the reference numbers of deforestation due diligence statements if you are the operator. For reporting requests, the customer must tell you which questions go beyond the voluntary standard, and you may decline those. Due diligence requests are not limited by that cap. 4. **Answer from one verified product record** Keep the product data you share, such as materials, substances, origin and certificates, in one place, checked against the source documents. Answer every customer from the same record, so figures match across questionnaires and over time. 5. **Share the data in a controlled way and review the contract** Send the customer a link to the current, verified data instead of spreadsheets that age. Check the supply contract: a clause that obliges a protected undertaking to give more than the voluntary standard for reporting purposes is not binding, while the rest of the contract stands. ## What you need to show - **A self-declaration of your average number of employees** — Your finance or HR function (Directive 2013/34/EU Article 19a(3)) - **A product data sheet with sources for each figure you share** — Product compliance (Directive 2013/34/EU Article 19a(3); Regulation (EU) 2023/1115 Article 4(7)) - **A record of the questions you declined and why** — The person who answers the questionnaire (Directive 2013/34/EU Article 19a(3)) ## If you do nothing - **The cap does not cover due diligence requests** — The right to decline information beyond the voluntary standard applies to requests for sustainability reporting only. It does not affect information requests for other purposes, including Union due diligence requirements (Directive 2013/34/EU Article 19a(3)). - **Some data is a condition for your customer's purchase** — Under the EU Deforestation Regulation, operators pass the due diligence statement reference numbers to the downstream operators and traders they supply, who may sell the products only if they hold the required supplier information (Regulation (EU) 2023/1115 Articles 4(7) and 5(1)). - **Due diligence requests will follow a legal method** — Under the Corporate Sustainability Due Diligence Directive as amended, for the in-depth assessment companies may request information from business partners only where necessary and, from partners with fewer than 5 000 employees, only when it cannot reasonably be obtained otherwise (Directive (EU) 2024/1760 Article 8(2a), inserted by Directive (EU) 2026/470). ## Questions ### Can we refuse to answer? For sustainability reporting requests, a protected undertaking has a statutory right to decline information beyond the voluntary standard, and the customer must tell you which questions exceed it (Directive 2013/34/EU Article 19a(3)). That right does not cover due diligence requests or data a product law requires. ### What is the voluntary standard? A sustainability reporting standard for voluntary use by smaller undertakings, set by Commission Delegated Regulation (EU) 2026/1560. Its Annex II lists the datapoints that form the value chain cap, which applies from financial years beginning on or after 1 January 2027 (Articles 3 and 4). ### When do the due diligence rules apply to our customer? As amended, the Corporate Sustainability Due Diligence Directive covers EU companies with more than 5 000 employees and more than EUR 1.5 billion net worldwide turnover; other criteria apply to groups, franchising and non-EU companies. Member States must adopt the rules by 26 July 2028 and apply them from 26 July 2029 (Directive (EU) 2024/1760 Articles 2(1)(a) and 37(1), as amended by Directive (EU) 2026/470). ### Does the customer have to check our employee number? No. A reporting undertaking may rely on a self-declaration from a company in its value chain and need not verify it, unless it knows or can reasonably be expected to know that the declaration is manifestly incorrect (Directive 2013/34/EU Article 19a(3)). ## Sources 1. [Directive 2013/34/EU on annual and consolidated financial statements and related reports (consolidated text of 18 March 2026)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02013L0034-20260318) — EUR-Lex, 2026-10-04 2. [Directive (EU) 2026/470 amending Directives 2006/43/EC, 2013/34/EU, (EU) 2022/2464 and (EU) 2024/1760 as regards certain corporate sustainability reporting and due diligence requirements](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026L0470) — EUR-Lex, 2026-10-04 3. [Commission Delegated Regulation (EU) 2026/1560 establishing sustainability reporting standards for voluntary use](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32026R1560) — EUR-Lex, 2026-10-04 4. [Regulation (EU) 2023/1115 on deforestation-free products (consolidated text of 18 September 2026)](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02023R1115-20260918) — EUR-Lex, 2026-10-04