The CSRD Value-Chain Cap: What In-Scope Companies May Ask Suppliers with up to 1,000 Employees, and What Not

The cap, also called trickle-down protection, limits how far sustainability data requests can be passed down to smaller suppliers.

The CSRD is Directive (EU) 2022/2464, and Directive (EU) 2026/470 (Omnibus I), in force since 18 March 2026, added the cap to the Accounting Directive 2013/34/EU. That directive reaches companies through national law; Delegated Regulation (EU) 2026/1560 is "binding in its entirety and directly applicable in all Member States". The cap limits requests from undertakings subject to Articles 19a and 29a, the companies set out under who reports under the Corporate Sustainability Reporting Directive (CSRD).

This page explains the protected-undertaking test, the Annex II list of the voluntary standard (VS, formerly VSME), the right to decline and the four duties of the requesting company, the carve-outs and the first financial year.

What Is the Value-Chain Cap?

Delegated Regulation (EU) 2026/1560 defines the value-chain cap as "the upper limit of sustainability information" that undertakings subject to Articles 19a and 29a of Directive 2013/34/EU "may require from undertakings in their value chain" that do not exceed, on their balance sheet date, an average of 1,000 employees during the preceding financial year (Article 1(1)).

"The voluntary standard shall establish the value chain cap" (Article 3(1)), and "The value chain cap shall only comprise the datapoints specified in Annex II" (Article 3(2)). The cap is therefore not the whole voluntary standard: the standard itself is Annex I, and only the datapoints listed in Annex II form the upper limit. Undertakings that are not subject to Articles 19a and 29a may report under Annex I on a voluntary basis (Article 2(1)).

Where the Cap Sits in the Law

The cap rests on provisions that Directive (EU) 2026/470 wrote into Directive 2013/34/EU and on Delegated Regulation (EU) 2026/1560. Article 19a(3), as amended by Article 2(4)(b), defines the reporting undertaking, the protected undertaking and the voluntary standards, and sets out the right to decline and the duties of the requesting company; Article 29a(3), as amended by Article 2(5)(b), does the same for consolidated reporting. Article 29ca, inserted by Article 2(8), empowers the Commission to adopt standards for voluntary use. These provisions came from Omnibus I, which wrote the cap into the law.

Under Article 29b(4), as replaced by Article 2(6)(c) of Directive (EU) 2026/470, the ESRS shall not specify disclosures that would require undertakings to obtain from value-chain undertakings that do not exceed an average of 1,000 employees "during the financial year" information exceeding the standards for voluntary use. Article 34(2a), inserted by Article 2(12)(b), binds the assurance opinion. The Commission adopted Delegated Regulation (EU) 2026/1560 under Article 29ca(1) on 3 July 2026, and paragraph 66 of ESRS 1 in the 2026 set points to its Annex II.

The table maps each provision to its amending point.

Which Undertakings Are Protected?

A protected undertaking is an undertaking that does not exceed, on its balance sheet date, an average number of 1,000 employees during the preceding financial year and is in the value chain of a reporting undertaking (Article 19a(3) of Directive 2013/34/EU as amended by Article 2(4)(b) of Directive (EU) 2026/470). The act joins the two conditions with "and": the size condition and the value-chain condition must both be met. A reporting undertaking is "an undertaking required to report pursuant to paragraph 1" of Article 19a, and Article 29a(3), as amended by Article 2(5)(b), applies the same definitions to groups reporting under Article 29a(1).

The 1,000-Employee Test on the Preceding Financial Year

Only one figure decides the size condition: the supplier's average number of employees during the preceding financial year, taken on its balance sheet date, with no turnover or balance-sheet criterion. "Does not exceed" includes the limit itself, so a supplier with an average of exactly 1,000 employees is protected and a supplier with 1,001 is not (calculated). A supplier with 900 employees and a turnover of EUR 2 billion is protected, because turnover plays no part in the test (calculated).

The CSRD scope test uses different values and a different period. Under Articles 19a(1) and 29a(1), as replaced by Articles 2(4)(a) and 2(5)(a) of Directive (EU) 2026/470, a company reports when it exceeds both a net turnover of EUR 450 million and an average of 1,000 employees during the financial year. The two periods must not be mixed: the preceding financial year for protection, the current one for scope. The scope side is set out under the 1,000-employee test in the CSRD thresholds.

Relying on a Supplier's Self-Declaration

A reporting undertaking "may rely on a self-declaration" from an undertaking in its value chain to decide whether it is protected, and it "shall not be required to take steps to verify" that declaration (Article 19a(3) of Directive 2013/34/EU as amended by Directive (EU) 2026/470).

One exception applies. A reporting undertaking "shall not rely on the self-declaration where they know, or can reasonably be expected to know, that the declaration is manifestly incorrect".

What In-Scope Companies May Ask For under the Voluntary Standard: The Annex II List

From financial years beginning on or after 1 January 2027, the most a reporting undertaking may require from a protected undertaking is the list in Annex II of Delegated Regulation (EU) 2026/1560: 23 rows for suppliers with more than 10 employees and 9 of them for suppliers with 10 employees or less. Annex II of Delegated Regulation (EU) 2026/1560 has one column for each size group.

The rows are paragraphs of Annex I, the voluntary standard. Annex I has a Basic Module with 11 disclosures, B1 to B11, and a Comprehensive Module with 9 disclosures, C1 to C9, and the Annex II list draws on both modules. Each disclosure is explained in full under the voluntary standard (VS, formerly VSME).

The table lists every row of Annex II.

Annex II counts rows, not datapoints.

Suppliers with 10 Employees or Less

For a supplier with 10 employees or less, the list covers basis-of-preparation, workforce, health and safety and pay items only. A requester may ask under B1 for the module option, the individual or consolidated basis and general information on the undertaking (paragraphs 27(a), 27(c) and 27(e)), under B8 for employees by type of contract and by gender (paragraph 40(a) and (b)), under B9 for the number and rate of recordable work-related accidents (paragraph 41(a)), and under B10 for minimum wage, collective bargaining coverage and training hours (paragraph 42(a), (c) and (d)). No environmental row applies to this size group.

Suppliers with More than 10 Employees

A supplier with more than 10 employees can be asked for the same rows plus environmental and Comprehensive Module rows. The environmental rows are B3 energy consumption in MWh (paragraph 32, first sentence) and Scope 1 and location-based Scope 2 greenhouse gas emissions in tCO2eq (paragraph 33), B6 water withdrawal (paragraph 36), and B7 circular-economy principles, waste weight and the proportion of waste diverted (paragraph 38, first sentence, and paragraph 39(a) and (b)).

The Comprehensive Module rows are C1 products or services, markets and main business relationships (paragraph 46(a) to (c)), C5 the employee turnover rate (paragraph 58), C6 a code of conduct or human rights policy and a complaints-handling mechanism (paragraph 61(a) and (c)), and C7 confirmed incidents in the own workforce (paragraph 62(a)(i) to (v)) and in the value chain (the first sentence of paragraph 62(c)). Every Comprehensive Module row applies only to suppliers with more than 10 employees.

What Lies Above the Cap

Everything in the voluntary standard that Annex II does not list lies above the cap, including whole disclosures and parts of disclosures that are otherwise inside it. The items of Annex I with no Annex II row are listed below.

• Whole disclosures: B2 practices, policies and future initiatives, B4 pollution of air, water and soil, B5 biodiversity, B11 convictions and fines for corruption and bribery, C2 description of practices, policies and future initiatives, C3 GHG reduction targets and climate transition, C4 climate risks, C8 revenues from certain activities and C9 gender diversity ratio in the governance body.
• The Scope 3 consideration in paragraphs 49 to 52.
• Parts of Basic Module disclosures: B1 points (b) and (d), paragraph 28 (certifications), the breakdown table of B3, B6 paragraph 37 (water consumption), B7 paragraph 39(c), B8 point (c), B9 point (b) and B10 point (b).
• Parts of Comprehensive Module disclosures: C1 point (d), C5 paragraphs 59 to 60, C6 point (b) and C7 point (b).

A requester may still ask for these items, but must say which of them exceed the cap (point (c), below).

The Right to Decline and What Requesting Companies Must Do

Protected undertakings "shall have the right to decline to provide information exceeding the information specified in the voluntary standards in response to a request made for the purpose of sustainability reporting as required by this Directive" (Article 19a(3) of Directive 2013/34/EU as amended by Directive (EU) 2026/470). Article 29a(3) gives the same right where the request serves consolidated reporting. The consolidated text of Directive 2013/34/EU of 18 March 2026 on EUR-Lex contains both provisions as amended. The reporting undertaking carries four duties, set out in points (a) to (d) of Article 19a(3) and explained below. The right and the duties reach companies through national law.

Contract Clauses That Ask for More

When reporting undertakings establish "contractual and other arrangements" to meet the reporting requirements, they "shall not require protected undertakings to provide information exceeding" the voluntary standards (point (a) of Article 19a(3) as amended by Directive (EU) 2026/470). Point (b) sets the consequence for clauses that do: a contractual provision contrary to point (a) "shall not be binding, without however affecting the binding nature of the remaining provisions of the contract".

Telling Suppliers Which Information Exceeds the Cap

A reporting undertaking that requests, "directly or indirectly", information beyond the voluntary standards must ensure that the protected undertaking is informed of two things: which information exceeds the voluntary standards, and that it has a statutory right to decline to provide it (point (c) of Article 19a(3) as amended by Directive (EU) 2026/470).

Deemed Compliance for Value-Chain Information

A reporting undertaking that reports the necessary value-chain information without reporting above-cap information from protected undertakings is deemed to have complied with its value-chain reporting obligation (point (d) of Article 19a(3) as amended by Directive (EU) 2026/470).

A separate transition applies to the value chain as a whole. For the first three years of being subject to the reporting requirements, an undertaking that cannot obtain the necessary value-chain information explains its efforts, the reasons and its plans (Article 19a(3) as amended); the request routine below includes this step.

How Assurance Respects the Right to Decline

Article 34(2a) of Directive 2013/34/EU, inserted by Article 2(12)(b) of Directive (EU) 2026/470, requires Member States to ensure that the assurance opinion is prepared in a manner that fully respects the protected undertakings' right to decline. The provision protects value-chain undertakings that do not exceed an average of 1,000 employees in the preceding financial year and refers to information exceeding the standards for voluntary use in Article 29ca. The opinion concerned is the one in Article 34(1)(aa), which, as replaced by Article 2(12)(a) of Directive (EU) 2026/470, is given on the basis of limited assurance only, as set out under limited assurance of the sustainability statement.

What the Cap Does Not Cover

The cap governs only requests made for the purpose of sustainability reporting under Directive 2013/34/EU, and it imposes no obligation on any undertaking in the value chain to provide sustainability information. Article 19a(3) states that nothing in the value-chain rules "imposes or implies any obligation on any undertaking in the value chain to provide sustainability information". A supplier may decline above-cap requests, and it may also answer them.

According to recital 12 of Directive (EU) 2026/470, the value-chain cap does not prohibit the voluntary sharing of information, such as information commonly shared among undertakings in a sector; it does not affect existing contractual or legal obligations to provide information within the voluntary standard, and it applies only to information gathering for sustainability reporting.

Requests for Other Purposes, Including Bank Requests

Article 19a(3) states that the cap does not affect information requests for purposes other than sustainability reporting under the Directive. These include requests for the purpose of complying with Union requirements on undertakings to conduct a due diligence process. A bank request made for lending is one such other purpose.

Recommendation (EU) 2025/1710 no longer produces legal effects since 24 September 2026 (recital 5 of Delegated Regulation (EU) 2026/1560). The same recital states that financial institutions, financial market participants, insurance undertakings and credit institutions "are still encouraged to limit as far as possible" their requests to undertakings with 1,000 employees or less, for purposes beyond reporting under Directive 2013/34/EU, to the information in Annex I. This is an encouragement, not a bar; how lenders use such requests is covered under the data banks ask borrowers for.

From Which Financial Year Does the Cap Apply?

Article 3 of Delegated Regulation (EU) 2026/1560, which ties the cap to the Annex II list, applies to financial years beginning on or after 1 January 2027 (Article 4, second paragraph). Delegated Regulation (EU) 2026/1560 of 3 July 2026 (OJ 21.9.2026) has been in force since 24 September 2026. Recital 6 gives the reason: the later date gives undertakings subject to mandatory reporting "appropriate time to prepare".

Article 19a(3) and Article 29a(3) were amended by Directive (EU) 2026/470, in force at EU level since 18 March 2026, and they reach companies through national law, which Member States must adopt by 19 March 2027 (Article 5(1)). Financial years starting on or after 1 January 2027 are also the first under the new CSRD scope (Article 5(2) of Directive (EU) 2022/2464 as amended by Directive (EU) 2025/794 and Directive (EU) 2026/470); wave 1 reports for financial years 2024 to 2026 only.

As of 29 October 2026, both acts are in force at EU level, and the transposition deadline of 19 March 2027 lies ahead. The dated status in each Member State is kept under national laws that transpose the cap.

How to Request and Report Supplier Information under the Cap

A reporting undertaking can organise its value-chain requests in the order below, each step tied to a point of Article 19a(3) of Directive 2013/34/EU as amended by Directive (EU) 2026/470. The Annex II list in step 3 applies to financial years beginning on or after 1 January 2027.

1. Collect a self-declaration of each supplier's average number of employees, and do not rely on one that is manifestly incorrect.
2. Sort suppliers into protected and not protected on the average of not more than 1,000 employees during the preceding financial year.
3. Split protected suppliers at 10 employees and request only their Annex II rows: 9 rows for 10 employees or less, 23 rows for more than 10.
4. Mark every item that exceeds the voluntary standards and state the supplier's statutory right to decline it (point (c)).
5. Check contract templates for clauses that require more than the voluntary standards (points (a) and (b)).
6. Report without above-cap information from protected suppliers (point (d)) and, in the first three years, explain efforts, reasons and plans where information is missing, as set out for the value chain in CSRD reporting.

Once your supplier requests are mapped, the remaining reporting steps are set out in our CSRD compliance plan.

What Applied Before: The Listed-SME Limit the Cap Replaced

Before Directive (EU) 2026/470, Article 29b(4) as inserted by Directive (EU) 2022/2464 limited what the ESRS could require from SMEs in the value chain to the information in the listed-SME standards. In the 2023 set of the ESRS (Delegated Regulation (EU) 2023/2772), paragraphs 132 to 135 of ESRS 1 carried a three-year value-chain transition, and from the fourth year information from SMEs was not to exceed the future listed-SME standard (paragraph 135). Directive (EU) 2026/470 deleted the empowerment for listed-SME standards in Article 29c (Article 2(7)) and replaced Article 29b(4) with the cap tied to the standards for voluntary use (Article 2(6)(c)). The listed-SME standard was never adopted, and EFRAG lists its project as concluded. In the 2026 set, paragraph 66 of ESRS 1 refers to Annex II of Delegated Regulation (EU) 2026/1560 instead of paragraph 135.

Value-Chain Cap Questions

These questions recur about the cap.

Can a supplier with 1,200 employees rely on the cap?

No: protection ends above an average of 1,000 employees during the preceding financial year, so a supplier with 1,200 cannot rely on the cap, whatever its turnover.

Does the cap protect only SMEs?

No: the test is an average of not more than 1,000 employees during the preceding financial year, with no turnover criterion, so it reaches beyond the SME category. How the two groups relate is set out under SMEs and value-chain requests under the CSRD.

Does the cap apply to suppliers outside the EU?

Yes for ESRS reporting: paragraph 66 of ESRS 1 in Delegated Regulation (EU) 2026/1563, which enters into force on 10 November 2026, applies the Annex II limit also to non-EU value-chain undertakings.

Can a bank still ask for more than the voluntary standard?

Yes, for purposes other than CSRD reporting such as lending, because the cap does not affect those requests; recital 5 of Delegated Regulation (EU) 2026/1560 only encourages financial institutions to limit them.

Does a protected undertaking have to answer requests at all?

No: Article 19a(3) states that nothing in the value-chain rules imposes or implies any obligation on an undertaking in the value chain to provide sustainability information.

Must suppliers have their information assured?

No: undertakings applying the voluntary standard are not obliged to seek assurance (recital 5 of Delegated Regulation (EU) 2026/1560).