Customer ESG questionnaires: the 2027 limit

If you are a finance director in a company that is not itself subject to sustainability reporting, you have almost certainly received ESG questionnaires over the past two years: from the large customer you supply, from the parent group abroad or from your lending bank. Each comes in a different format, with a different deadline, and asks for data nobody in the company collects. Until now, no rule said how much information a customer may ask for.

From 2027 such a rule exists, and it protects you as the supplier.

What happens on 10 November 2026

Commission Delegated Regulation (EU) 2026/1563 of 3 July 2026 rewrites the European Sustainability Reporting Standards (ESRS). Article 3 is short and clear: the regulation enters into force on 10 November 2026 and applies to financial years beginning on or after 1 January 2027. For financial years beginning in 2026, reporting companies may choose between the previous standards and the new ones, but must state in the report which version they applied.

The European Commission estimates that the new standards reduce the number of mandatory datapoints by over 60% and the total number of datapoints by over 70%, with reporting costs falling by more than 30% per company.

For companies that do report, this is relief. For everyone else, which means the vast majority of Romanian companies, a different provision matters, and it is discussed far less.

The value chain cap

Directive (EU) 2026/470, known as Omnibus I, introduced into Directive 2013/34/EU the notion of a “protected undertaking”: an undertaking which, on its balance sheet date, had no more than 1,000 employees on average during the preceding financial year and which is in the value chain of a reporting undertaking.

For a protected undertaking, the directive provides three things:

1. it has the right to decline requests for information beyond the standard set;
2. any contractual provision to the contrary shall not be binding;
3. the reporting customer may rely on the supplier's self-declaration to determine whether it is a protected undertaking.

How large is the standard set? Commission Delegated Regulation (EU) 2026/1560, also of 3 July 2026, establishes the voluntary reporting standard and states in Article 3(2) that the cap comprises only the datapoints specified in Annex II to that regulation. The standard has a Basic Module (B1–B11) and a Comprehensive Module (C1–C9), and for undertakings with 10 employees or fewer some datapoints are optional. Article 4 provides that the cap applies to financial years beginning on or after 1 January 2027.

Where the cap does NOT apply

This is where most of the confusion arises, so let us be clear: the cap covers requests for information made for the purposes of the sustainability reporting required by the directive. The text says explicitly that it does not affect information requests for other purposes, and that it imposes no obligation on any undertaking in the value chain to provide sustainability information.

In practice: the questionnaire your bank sends you for credit risk assessment serves a different purpose and does not fall under the cap. Recital 5 of Regulation 2026/1560 says that credit institutions, insurers and other financial institutions “are still encouraged” to limit their requests as far as possible. They are encouraged, not required, so bank questionnaires will not disappear in January.

And who still reports, in the end?

Omnibus I raised the threshold considerably. Reporting applies to large undertakings exceeding EUR 450 million net turnover and 1,000 employees on average during the financial year; both conditions must be met, not just one. Member States must transpose the directive into national law by 19 March 2027.

What the finance director does in the coming months

• List the ESG requests received in 2026. For each one, note who asked, what for and how long the answer took. Without this list you have no arguments in the discussion with your customer.
• Check whether you are a protected undertaking. The test is the average number of employees in the preceding financial year, per entity: 1,000 at most. For most Romanian companies the answer is obvious, but write the figure down.
• Prepare the self-declaration. The directive allows your customer to rely on it to classify you. The sooner you send it, the shorter the discussion.
• Review your running contracts. ESG clauses exceeding the cap will no longer be binding for financial years beginning in 2027. You do not need to renegotiate every contract now, but you have an argument at the next renewal.
• Treat bank requests and customer requests separately. Different rules apply to them.
• Keep the data you have already collected. Energy consumption, emissions and workforce data remain useful in tenders, financing and due diligence.

In short

The period in which any large customer could ask for anything is ending. For financial years beginning in 2027 there is a standard set, the right to decline anything beyond it, and the rule that a contractual provision to the contrary is not binding. Until then you have four things to prepare: the list of requests, the headcount figure, the self-declaration and a review of your contracts.

If you would like to go through the ESG requests you receive and work out what still needs answering and what does not, write “value chain” and we will set up a one-hour online diagnostic, with a written summary at the end.

Cătălin Mazilu, FCCA, CIA — Managing Partner, Mazilu & Partners

Sources (consulted on 9 November 2026):

Commission Delegated Regulation (EU) 2026/1563 of 3 July 2026 amending Delegated Regulation (EU) 2023/2772 — eur-lex.europa.eu

Commission Delegated Regulation (EU) 2026/1560 of 3 July 2026 (voluntary standard and value chain cap) — eur-lex.europa.eu

Directive (EU) 2026/470 of 24 February 2026 (Omnibus I) — eur-lex.europa.eu

European Commission, press release of 3 July 2026 on the revised standards — finance.ec.europa.eu