The European Commission published Commission Delegated Regulation (EU) 2026/1560 in the Official Journal on 21 September 2026. It turns the Voluntary SME Sustainability Reporting Standard (VSME), delivered by EFRAG on 17 December 2024, into binding EU law. The standard now sets the statutory ceiling on what CSRD reporters may ask from undertakings with up to 1,000 employees in their value chain.

The headline for 2026 is not a new disclosure standard. The headline is that VSME now defines, in binding EU law, the maximum sustainability information a bank or large customer can ask you for. That changes how mid-market companies should treat the 2025 data they are collecting right now.

What changed between the December 2024 VSME release and the 2026 reporting cycle

The substantive change for 2026 is regulatory status, not content. EFRAG approved the VSME on 13 November 2024 and delivered it to Commissioner Maria Luís Albuquerque on 17 December 2024, after a public consultation that ran from 22 January to 21 May 2024. The text of the standard has been stable since then. What has changed is the legal weight behind it.

The Omnibus simplification proposal of 26 February 2025 introduced the idea of a proportionate voluntary standard based on VSME, together with a value-chain cap that would protect all undertakings with up to 1,000 employees, not only SMEs. The Commission then issued Recommendation (EU) 2025/1710 on 30 July 2025 as an interim measure, before adopting the binding Delegated Regulation (EU) 2026/1560 on 3 July 2026.

The standard keeps the modular design EFRAG proposed: a Basic Module that all users complete and a Comprehensive Module for undertakings facing larger stakeholder demands. Under the Commission Recommendation, the Basic Module is the minimum requirement for small and medium undertakings and the target approach for micro-undertakings. Reporting against the Basic Module is a prerequisite for reporting against the Comprehensive Module.

The Omnibus proposal (COM 2025/80) also narrowed mandatory CSRD scope and set the cap directly on reporting companies, which pushes information-gathering onto value-chain questionnaires. VSME now sets the legal ceiling for what those questionnaires can ask. For a sustainability manager at a mid-market supplier, that is the material 2026 change.

How the value-chain cap limits what customers and banks can ask SMEs

The value-chain cap is a legal maximum on supplier data requests, defined inside the Delegated Regulation itself. Article 1 of Regulation (EU) 2026/1560 sets the cap as the maximum sustainability information that CSRD reporters may require from undertakings in their value chain with up to 1,000 employees on average in the previous financial year. Article 3 then narrows the cap further: it comprises only the datapoints specified in Annex II of the regulation.

The Explanatory Memorandum to the delegated act is explicit about the consequences. Reporting undertakings subject to mandatory sustainability reporting are prohibited from requiring information that exceeds the voluntary standard, and protected undertakings have a statutory right to refuse such requests. The cap is enforceable, not aspirational.

For day-to-day operations, that means a bank, a Wave 1 CSRD reporter, or a listed insurer can no longer send a 400-line ESG questionnaire to a 300-employee supplier and expect answers. If the datapoint is not in Annex II, the supplier can decline. The legal basis for refusal is Article 29ca of the Accounting Directive, inserted by Directive (EU) 2026/470 (the Omnibus I Directive), which empowers the Commission to adopt voluntary standards for undertakings with no more than 1,000 employees.

The cap is also a maximum, not a minimum. An undertaking can choose to disclose less than the Basic Module, since VSME remains voluntary at the entity level. In practice, large customers will treat full Basic Module disclosure as the lowest-friction path to retaining supply contracts and credit lines, because it answers their questions without triggering a refusal exchange. That dynamic is the reason EFRAG designed VSME to harmonize and eventually replace multiple ESG questionnaires used by banks and large companies to collect data from SMEs.

{{product-tour-injectable}}

The Basic Module datapoints SMEs should have ready for 2025 figures

The Basic Module is the eleven-disclosure core (B1 to B11) that every VSME user must complete. According to Commission Recommendation (EU) 2025/1710, it covers general information about the undertaking, environmental metrics (energy, greenhouse gas emissions, pollution, water, biodiversity-sensitive sites, resource use and waste) and social metrics (workforce characteristics, health and safety, remuneration). The Comprehensive Module (C1 to C9) builds on top of it.

The point for 2025 figures is that these are not aspirational metrics. Scope 1 and Scope 2 greenhouse gas emissions must be produced in tonnes CO2 equivalent, with the methodology (location-based or market-based) disclosed. Workforce data must cover headcount, contract type and gender, together with health and safety incidents. For most mid-market companies, every one of these numbers already exists somewhere: in energy bills, HR records, waste contractor statements, insurance returns. The work in 2026 is to pull them together into a single reporting dataset instead of recreating them every time a customer sends a new template.

The Delegated Regulation builds in a proportionality rule for the smallest users. More challenging environmental disclosures are voluntary for undertakings with 10 employees or less, even where they are essential for larger undertakings applying the standard. A micro-undertaking responding to a bank questionnaire can therefore legitimately leave certain environmental fields blank, while a 250-employee manufacturer cannot.

The planning consequence is straightforward. If customer or lender questionnaires are likely in the first half of 2026, 2025 figures need to be computable against the Basic Module datapoints by the time those questionnaires arrive. A single Basic Module dataset, prepared once, produces an answer that works for every customer instead of a bespoke response per questionnaire.

When the Comprehensive Module becomes worth the extra effort

The Comprehensive Module is worth the extra effort when a specific customer, lender or procurement process asks for datapoints beyond the Basic Module. The Commission Recommendation is clear that the Comprehensive Module layers additional disclosures on top of the Basic Module, and that reporting against the Basic Module is a prerequisite. You do not pick one or the other, you add Comprehensive content to a Basic foundation.

Three scenarios typically make it worthwhile:

• Supplying a Wave 1 CSRD reporter that still needs value-chain inputs to complete its own ESRS disclosures.
• Negotiating sustainability-linked finance where the lender's covenants reference metrics beyond the Basic Module.
• Participating in public procurement that references ESRS datapoints for award criteria or performance clauses.

In each of these, the economics favor doing the Comprehensive Module once per year rather than answering repeated bespoke questionnaires. EFRAG's cost-benefit work concluded that the cost of VSME is likely to be largely offset in due time by the corresponding benefits, including the replacement of multiple ESG questionnaires. The offset is more visible when the Comprehensive Module is used, because the alternative is dozens of custom responses to lenders and large customers.

For undertakings with no financing exposure beyond standard working-capital facilities and no large CSRD-reporting customers, the Basic Module is sufficient and the Comprehensive Module can be deferred.

{{custom-cta}}

What the Omnibus timeline means for SME preparation in 2026

The Omnibus timeline fixes the first mandatory application of the value-chain cap to financial years starting on or after 1 January 2027, but the practical preparation window is 2026. Commission Delegated Regulation (EU) 2026/1560 was adopted on 3 July 2026 and entered into force on 24 September 2026, three days after publication in the Official Journal.

Alongside it, Commission Delegated Regulation (EU) 2026/1563 amended the main ESRS and allowed in-scope undertakings reporting on financial years beginning between 1 January 2026 and 31 December 2026 to apply either the previous standards or the amended ones. That transition year gives Wave 1 reporters flexibility, and it is the same year during which they will push updated supplier questionnaires out to the value chain. For Coolset's view on how the broader regime is settling after the simplification package, see ESG reporting after Omnibus.

EFRAG and the European Commission co-hosted a hybrid outreach event on 9 October 2026 titled 'From VSME to the Voluntary Standard: A practical approach to sustainability reporting'. The event covered what has changed between the 2025 Recommendation and the binding standard, and the practical implications for SMEs.

The timing implication for a mid-market supplier is this: 2025 data collected during 2026 is the first full VSME-aligned dataset, even if the first external report is published later. Preparing to the Basic Module in 2026 preserves optionality. It covers the baseline cap and can be extended to the Comprehensive Module when a specific customer or bank asks for more.

Where to start if VSME will apply to your 2025 figures

Start by mapping the Basic Module's eleven disclosures to the data finance, HR and operations teams already produce.

Frequently asked questions

Who does the VSME apply to?

The VSME is a voluntary standard aimed at undertakings outside the mandatory CSRD scope. Under Commission Delegated Regulation (EU) 2026/1560, its value-chain cap protects undertakings with up to 1,000 employees on average in the preceding financial year, so both non-listed SMEs and larger mid-market companies fall within its coverage.

Is VSME reporting mandatory?

No. VSME remains voluntary at the entity level. What is mandatory under Article 29ca of the Accounting Directive is the ceiling it places on CSRD reporters: they cannot require information from protected undertakings that goes beyond the datapoints listed in Annex II of the Delegated Regulation.

What is the difference between the Basic and Comprehensive Modules?

The Basic Module covers eleven general, environmental and social disclosures (B1 to B11) and is the minimum for small and medium undertakings. The Comprehensive Module adds further disclosures (C1 to C9) aimed at banks, investors and large corporate buyers. Under Recommendation (EU) 2025/1710, reporting against the Basic Module is a prerequisite for reporting against the Comprehensive Module.

When does the value-chain cap take effect?

The Delegated Regulation establishing the Voluntary Standard entered into force on 24 September 2026 after publication in the Official Journal on 21 September 2026. It applies to financial years starting on or after 1 January 2027, which makes 2025 figures the first dataset most suppliers will prepare on a VSME-aligned basis.

Can a supplier refuse to answer questions that go beyond VSME?

Yes. The Explanatory Memorandum to the Delegated Regulation confirms that protected undertakings have a statutory right to refuse requests that exceed the voluntary standard. The practical response is usually to point the requester to the equivalent datapoint inside the Basic or Comprehensive Module.