the list asks for a diversity policy, do I need to have that as a small business

No, a formal policy is usually not required

No, the VSME basic module does not require a separate diversity policy from small enterprises. What the module does require is a factual figure: the breakdown of your workforce by gender, usually split between management and non-management positions. That is a count, not a policy document. If you don't have those figures readily available, you can usually add them up within a day from your payroll administration — no need for a multi-year analysis.

Some customer portals phrase the question as 'do you have a diversity policy?' — but that does not come from the VSME basic module but from the customer's own or more extensive questionnaire, often inspired by what larger reporting-obligated companies under the CSRD must work out. For a small enterprise that is not itself subject to the CSRD, that distinction is relevant: you may factually answer that there is no separate policy, without having to present that as a shortcoming. How you set that 'no, but we do have the figures' situation in the questionnaire is explained in questionnaire asks about diversity in our workforce, how do I approach this. For the precise definition of what 'breakdown' means, see what is the male-female breakdown within your workforce.

Where this appears in the VSME base module

The basic module of EFRAG VSME is designed as the minimal, factual set of indicators for non-listed SME enterprises — intended to meet the most common information requests from banks, insurers and larger supply chain partners without requiring a policy statement. The gender breakdown of your workforce is included as a quantitative indicator, separate from the question of whether there is a policy. Directive (EU) 2022/2464 (CSRD) sets the more stringent reporting obligations, including policy descriptions, for large and listed enterprises; a small enterprise operating as a supplier in the chain does not automatically become subject to reporting itself.