More and more SMEs in the province are receiving questionnaires on emissions, energy consumption, workforce or anti-corruption policies. They come from retail chains, from European industrial groups, from financial institutions when a loan is renewed or from a potential investor. The company is not required to prepare a sustainability report, but it does not want to lose the customer either. In this article we explain why these requests arrive, what limit EU legislation sets and how to respond in an orderly way.
If you would first like to know which companies are required to report after the reform, start with our guide to the Omnibus I Directive and the companies required to report on sustainability.
Why am I being asked for ESG data if I am not required to report?
Companies that must report on sustainability have to explain the impacts of their value chain, not only their own. To do so, they need data from their suppliers. There are other reasons too:
- Financing: financial institutions have their own reporting and risk management obligations, and pass questions on to their business customers.
- Commercial requirements: many groups include environmental or social criteria in supplier approval, regardless of legislation.
- Corporate transactions: in a sale or an equity investment, the buyer analyses environmental, employment and compliance risks.
- Tenders and grants: some calls assess or require sustainability commitments and data.
For Alicante exporters and for the footwear supply industry in Elche, Elda and Petrer, these requests often arrive in other languages and in each customer’s own format, which multiplies the work if there is no single database.
The “protected undertaking” in Omnibus I
Directive (EU) 2026/470 sets a limit on these requests. It creates the concept of the protected undertaking in the value chain: one with no more than 1,000 employees on average. That undertaking may refuse to provide the reporting company with information that goes beyond what is set out in the voluntary sustainability reporting standards.
In practice, this means that an SME supplier can answer a customer that is required to report with the information covered by the voluntary standard and, if it wishes, decline broader requests. There are three important caveats:
- The protection will apply once the directive is transposed. Spain has not done so as at the date of this update.
- It concerns the information that the reporting company requests for its sustainability report. It does not limit what a customer may require under a contract, nor what a bank may request under its own regulations.
- Being able to refuse does not mean it is advisable to do so. The decision is a commercial one: the relationship with the customer often makes it advisable to cooperate, but within reasonable limits.
What the VSME is and its modules
The VSME (Voluntary Sustainability Reporting Standard for SMEs) is a voluntary sustainability reporting standard designed for unlisted SMEs. According to the Spanish Institute of Accounting and Auditing (ICAC), it is backed by a 2025 European Commission Recommendation and is structured in two modules:
- Basic Module: general information about the company, sustainability practices and policies, and a set of essential environmental, social and governance metrics.
- Comprehensive Module: extends the data with the points usually requested by investors, lenders or large customers.
On 22 September 2026 the ICAC reported that the European Commission has published the delegated regulations for the revised European Sustainability Reporting Standards and for the voluntary standard. It is worth following these developments, because the voluntary standard is the benchmark for the protected undertaking’s limit.
| What you may be asked for | If you are a protected undertaking (up to 1,000 employees) | Where to find it in the VSME |
|---|---|---|
| Energy consumption and greenhouse gas emissions | Information set out in the voluntary standard; you may limit additional detail | Environmental metrics in the Basic Module |
| Workforce data: headcount, type of contract, accidents | As above | Social metrics in the Basic Module |
| Anti-corruption policies, convictions or penalties | As above | Governance metrics in the Basic Module |
| Transition plans, targets and risks | You may not be required to go beyond the voluntary standard | Comprehensive Module |
| Customers’ own questionnaires with hundreds of questions | You may answer with your VSME report and decline anything beyond it | Full VSME report as a single response |
The table is for guidance only. The exact content of each module should be checked in the official text of the standard.
Where to start
- Inventory of requests: gather the questionnaires received in the last year and who sent them.
- Data you already have: energy and fuel invoices, payroll and workforce data, occupational health and safety records, internal policies. Much of what is requested already exists in the accounts and in HR management.
- Choose the module: for most SMEs, the Basic Module is enough to start with.
- Person responsible and timetable: appoint a person and set an annual update, coordinated with the accounting year-end close.
- One report, many answers: prepare a VSME report and use it as the basis for answering all customers.
Voluntary assurance: when it adds value
An SME is not required to have its sustainability data assured. Even so, an independent review can be useful when a key customer or lender attaches weight to that data, when the company is preparing a corporate transaction or when it wants to make sure its energy and workforce figures are consistent with its accounts. In sale transactions, ESG data increasingly forms part of the due diligence commissioned by the buyer.
Frequently asked questions
Am I required to answer a customer’s ESG questionnaire?
No legislation currently requires an SME in Spain to respond. The obligation, if any, arises from the contract with the customer. Once Omnibus I is transposed, companies with up to 1,000 employees will be able to refuse to provide information that goes beyond the voluntary standard.
Is the VSME mandatory?
No. It is a voluntary standard. Its value lies in offering a common, recognised format for responding to customers, banks and investors.
Do I need a consultant to prepare a VSME report?
Not necessarily. Many SMEs can prepare it with their own data. An external review helps when the data will be used with third parties or when the company wants to ensure its consistency.
What happens if I give a customer incorrect data?
It depends on what has been agreed in the contract, but it may affect the business relationship and the company’s reputation. That is why the data should come from verifiable records and be reviewed by someone before it is sent.
Official sources
- Directive (EU) 2026/470, text published in the OJEU (copy on boe.es)
- Directive (EU) 2026/470 on EUR-Lex
- ICAC: sustainability reporting (VSME)
- ICAC: announcements (22/09/2026, revised ESRS and voluntary standard)
If your company receives requests for sustainability data and wants to organise or review them before sending them to a customer or a bank, our sustainability information assurance service, led by partner José Antonio Valiente Velasco (ROAC no. 12609), an economist specialising in sustainability reports, can help. We are auditors in Alicante and work with companies throughout the province. Contact us.
Article prepared by Controlaudit’s technical team. Updated on 8 October 2026. This content is for information purposes only and is not a substitute for professional advice on your specific case.