The CSRD Cascade: Why Exempt SMEs Are Not Actually Exempt
The Corporate Sustainability Reporting Directive (CSRD) is the European Union's most ambitious sustainability reporting legislation. It requires approximately 50,000 companies to disclose detailed environmental, social, and governance (ESG) data — starting from fiscal year 2024 for the largest companies and expanding through 2028.
Here is the part most SMEs miss: CSRD does not just apply to the companies directly in scope. It cascades down the entire value chain.
Under the European Sustainability Reporting Standards (ESRS), companies subject to CSRD must report on their upstream and downstream value chain — which includes their suppliers, subcontractors, and service providers. That means you.
If you supply goods or services to a large European company, you will receive (or have already received) a data request. It might come as a formal questionnaire, a supplier portal submission, or an email from your client's sustainability team. Regardless of format, the message is the same: "We need your ESG data, and we need it structured."
This guide shows you exactly how to respond.
How the Value Chain Cascade Works
To understand why this affects you, here is how CSRD value chain reporting works in practice:
The Reporting Company's Obligation
A company in CSRD scope — say, a Dutch construction firm with 1,000 employees — must report on:
- Scope 3 GHG emissions (which includes emissions from their suppliers)
- Working conditions in the value chain (which includes your workforce practices)
- Governance and due diligence (which includes how they assess supplier ESG risks)
They cannot report on these topics without data from you.
The Data Request Flow
- The reporting company identifies material topics under ESRS double materiality assessment
- Their sustainability team maps the value chain to identify which suppliers contribute to those material topics
- They send structured data requests to key suppliers (that is you)
- They aggregate your data into their CSRD-compliant sustainability statement
- Their auditor verifies the data — including the supplier data
What Happens If You Do Not Respond
This is critical: CSRD requires companies to use "reasonable efforts" to collect value chain data. If a supplier refuses to provide data, the reporting company must:
- Use estimates or industry averages (which are less favorable than your actual data)
- Document that the supplier was non-responsive
- Potentially reconsider the supplier relationship
In practice, large companies are already building "ESG-ready" supplier shortlists. Suppliers who cannot provide data are being replaced by those who can. This is not theoretical — it is happening now across automotive, construction, FMCG, and professional services.
The 5 Most Common Data Requests SMEs Receive
Based on our work with SMEs across Europe, here are the five categories of data your clients are most likely to request:
1. Greenhouse Gas (GHG) Emissions
What they are asking for:
- Scope 1 emissions (direct emissions from owned sources — vehicles, heating, generators)
- Scope 2 emissions (indirect emissions from purchased energy — electricity, district heating)
- Scope 3 emissions (your own supply chain emissions — business travel, purchased goods)
Why they need it: Your emissions are their Scope 3. For many companies, Scope 3 represents 70–90% of their total carbon footprint. They literally cannot complete their climate disclosures without your data.
What to prepare:
- Annual energy bills (electricity, gas, fuel)
- Vehicle fleet data (mileage, fuel type)
- Business travel records
- If possible, a carbon footprint calculation using an established methodology (GHG Protocol)
2. Energy Consumption and Mix
What they are asking for:
- Total energy consumption in MWh or GJ
- Breakdown by source (grid electricity, natural gas, diesel, renewable)
- Percentage of renewable energy
- Energy efficiency measures implemented
Why they need it: ESRS E1 (Climate Change) requires reporting on energy consumption across the value chain. Companies setting Science-Based Targets need supplier energy data to track progress.
What to prepare:
- 12 months of utility bills
- Renewable energy certificates (if applicable)
- Energy audit reports (if available)
3. Workforce and Social Data
What they are asking for:
- Total headcount and FTE breakdown
- Gender diversity ratios
- Health and safety incident rates (LTIR, TRIR)
- Training hours per employee
- Living wage compliance
- Collective bargaining agreement coverage
Why they need it: ESRS S2 (Workers in the Value Chain) requires disclosure of working conditions across supply chains. This is where human rights due diligence meets reporting requirements.
What to prepare:
- HR headcount reports
- Incident and safety logs
- Training records
- Wage data (anonymized and aggregated)
4. Governance and Policies
What they are asking for:
- Environmental policy documentation
- Code of conduct / ethics policy
- Anti-corruption and bribery policy
- Sustainability governance structure
- ESG certifications (ISO 14001, ISO 45001, B Corp, EcoVadis)
Why they need it: ESRS G1 (Business Conduct) and due diligence requirements under ESRS S2 require companies to assess supplier governance maturity. Having documented policies — even simple ones — signals ESG readiness.
What to prepare:
- Existing policy documents (even if basic)
- Certification copies
- Description of governance responsibilities
5. Certifications and Third-Party Assessments
What they are asking for:
- ISO certifications (14001, 45001, 9001, 50001)
- EcoVadis or CDP scores
- Industry-specific certifications (FSC, BREEAM, Cradle to Cradle)
- Third-party audit reports
Why they need it: Certifications serve as proxy evidence for ESG maturity. They reduce the reporting company's audit risk and simplify their value chain assessment. A supplier with an EcoVadis Gold rating requires less individual data collection than an uncertified one.
What to prepare:
- Copies of all active certifications
- Most recent assessment scores
- Expiry and renewal dates
Step-by-Step Response Guide
Step 1: Acknowledge the Request Promptly
Do not ignore the email. Even if you do not have the data ready, respond within 5 business days to confirm receipt and set expectations for a timeline.
Template:
Thank you for your CSRD-related data request. We are committed to supporting your sustainability reporting obligations. We will compile the requested data and aim to respond fully within [X weeks]. If any clarification is needed regarding the data format or scope, we will reach out.
Step 2: Map the Request to Available Data
Create a simple tracking spreadsheet with three columns:
| Data Requested | Data Available | Gap / Action Needed |
|---|---|---|
| Scope 1 & 2 GHG emissions | Energy bills available, no calculation done | Calculate using GHG Protocol emission factors |
| Gender diversity ratio | HR system has data | Export and aggregate |
| ISO 14001 certification | Not certified | Note as "in progress" or "not applicable" |
This exercise usually reveals that 60–70% of the requested data already exists somewhere in your organization — it just has not been organized for ESG purposes.
Step 3: Gather and Calculate
For each data point, follow this hierarchy:
- Primary data (best): Your actual measured data — energy meters, HR systems, fuel receipts
- Activity data with emission factors (good): Multiply activity data (e.g., kWh consumed) by published emission factors (e.g., from the IEA or national grid operators)
- Estimates based on spend (acceptable): Use spend-based estimates as a last resort (e.g., €X spent on logistics × industry average emission factor per euro)
- Industry averages (last resort): Use only when no company-specific data exists. Flag these clearly as estimates.
Step 4: Structure Your Response
Use a consistent format. Here is a template structure that aligns with common CSRD data request formats:
Company Information
- Company name, registration number, sector (NACE code)
- Reporting period (fiscal year)
- Contact person for ESG data
Environmental Data
- GHG emissions: Scope 1, Scope 2 (location-based and market-based), Scope 3 (if available)
- Energy consumption: Total MWh, breakdown by source, renewable percentage
- Waste: Total tonnes generated, recycling rate
- Water: Total consumption in m³ (if relevant to your sector)
Social Data
- Headcount and FTE
- Gender breakdown (total and management)
- Health and safety: Lost Time Injury Rate (LTIR), fatalities
- Training hours per employee
- Living wage statement
Governance Data
- List of active policies (environmental, ethics, anti-corruption)
- List of certifications with validity dates
- Description of ESG governance (who is responsible internally)
Methodology Notes
- Data sources used
- Calculation methodologies
- Limitations and estimates flagged
Step 5: Submit and Follow Up
Send the completed response to your client's sustainability team. Offer to schedule a call to walk through any complex data points. Keep a copy of everything you submit — you will likely receive a similar request next year, and having a baseline makes the process dramatically faster.
Template: CSRD Supplier Data Response
Below is a simplified template you can adapt. For a full, fillable version, reach out to us at Pomegroup.
CSRD SUPPLIER DATA RESPONSE
============================
Reporting Period: FY [Year]
Company: [Your Company Name]
NACE Code: [Your Sector Code]
Prepared by: [Name, Title]
Date: [Submission Date]
1. ENVIRONMENTAL
1.1 GHG Emissions (tCO2e)
- Scope 1: [value]
- Scope 2 (location-based): [value]
- Scope 2 (market-based): [value]
- Methodology: [GHG Protocol / other]
1.2 Energy (MWh)
- Total consumption: [value]
- Renewable share: [value]%
- Sources: [grid, gas, solar, etc.]
2. SOCIAL
2.1 Workforce
- Total employees: [value]
- Female representation: [value]%
- Management gender ratio: [value]
2.2 Health & Safety
- LTIR: [value]
- Fatalities: [value]
3. GOVERNANCE
3.1 Policies in place: [list]
3.2 Certifications: [list with expiry dates]
4. NOTES
- [Flag any estimates, gaps, or methodology limitations]
The Cost of Ignoring CSRD Data Requests
Let us be direct about the business risk:
Contract Loss
Large companies are building ESG-screened supplier panels. If you cannot provide data, you will be deprioritized — or dropped — in favor of competitors who can. We are already seeing this in the Dutch construction and logistics sectors.
Procurement Exclusion
Public procurement in the EU is increasingly incorporating ESG criteria. Government tenders in the Netherlands, Germany, and France now include sustainability scoring. No data means a lower score. A lower score means losing bids.
Reputation Risk
As sustainability reporting becomes public (CSRD reports are published in company annual reports), your absence from a client's value chain data becomes visible. Auditors flag gaps. Investors ask questions. Your client's sustainability team has to explain why their supplier base has incomplete data.
Regulatory Creep
The EU is already discussing extending simplified reporting requirements to SMEs. The "we are exempt" window is closing. Companies that build ESG data infrastructure now will be ready. Those that do not will scramble later — at higher cost and lower quality.
Turning Compliance Into Competitive Advantage
Here is the reframe: CSRD data requests are not a burden. They are a market signal that your clients value ESG maturity in their supply chain. Every data point you provide is evidence that you are a reliable, transparent, future-proof partner.
How to Win With ESG Data
Be proactive. Do not wait for the request. Send your ESG data summary to key clients annually, unprompted. This positions you as a leader, not a laggard.
Get certified. An EcoVadis assessment (starting at ~€5,000/year for SMEs) or ISO 14001 certification gives you a credibility shortcut that reduces future data requests.
Benchmark and improve. Use your first year of data as a baseline. Set reduction targets. Report progress. Clients love suppliers who show year-over-year improvement.
Tell the story. Raw data is necessary. But a one-page narrative about your sustainability journey — what you are doing, why, and where you are headed — turns compliance into differentiation.
Automate It: How ExecutESG Handles This for You
If reading this guide made you think "this is a lot of manual work" — you are right. Collecting, calculating, formatting, and submitting ESG data across multiple client requests is exactly the kind of operationally intensive, repetitive task that should be automated.
ExecutESG — a product we are co-building at Pomegroup — is designed to solve this exact problem for SMEs:
- Automated data collection from your existing systems (energy bills, HR platforms, accounting software)
- GHG calculations using verified emission factors, aligned with the GHG Protocol
- Pre-formatted response templates that match common CSRD data request structures
- Client portal where your customers can request and receive data in a standardized format
- Year-over-year tracking so your second year is 10x faster than your first
Instead of spending weeks on spreadsheets, you spend hours on a platform that does the heavy lifting.
For ESG Consultants: Build Your Platform With Us
If you are an ESG consultant helping SMEs navigate CSRD data requests, you already know the pain: manual data collection, inconsistent client formats, and hours spent on work that should be automated.
Pomegroup's Co-Build program is designed for consultants like you who want to turn their methodology into a software product. We provide the technical co-founder, the development studio, and the product infrastructure. You bring the domain expertise and the client relationships.
Together, we build the platform that scales your consulting practice from serving 10 clients to serving 1,000.
Apply to Co-Build → and let's turn your ESG expertise into a product.
Key Takeaways
- CSRD affects you even if you are exempt. Your large customers must report on their value chain — and you are in it.
- Most of the data already exists. You just need to organize and format it.
- Responding promptly signals reliability. Non-responsive suppliers are being replaced.
- Use the template. A structured response reduces back-and-forth and builds trust.
- Automate for year two. Manual collection does not scale. Tools like ExecutESG do.
- Turn compliance into advantage. Proactive ESG data sharing wins contracts and builds loyalty.
The companies that treat CSRD as an opportunity — not an obligation — will be the ones that thrive in the next decade of European business.