do I need to submit sustainability policy as a separate document to customer

Often a paragraph suffices, sometimes a separate document is requested

It depends on what the questionnaire specifically asks: a separate upload, or only a yes/no with explanation. Many customer portals do not ask "do you have a document", but "do you have a policy" — and that can also be evident from a paragraph in a broader document, such as a quality manual or annual report. The VSME basic module of EFRAG, the standard on which an increasing number of these questionnaires rely, does not itself ask for a separate certificate or elaborate policy document: it is about a description of practices, objectives and actions on the relevant topics. A short, coherent piece of text — even if it does not appear on a separate sheet with its own title — usually meets the purpose of the question.

Where it is often specifically required to be a "document" or "statement" is on subjects that touch on a separate regulation, such as a policy against bribery and corruption or a whistleblower scheme. There the customer often expects a piece that you can point to, because the underlying risk — money laundering, corruption — is simply demonstrated with formally documented policy. For general sustainability policy the bar is lower: content matters, not form.

Where this is based on: VSME and the CSRD

The VSME basic module of EFRAG describes the expected reporting as descriptive information on policies and practices, without a requirement that this must be an independent, certified document. Directive (EU) 2022/2464, the CSRD, requires larger undertakings to report on sustainability in the management report — there too the form is part of a larger document, not a separate certificate. For SME sub-contractors questioned by customers, the VSME module is intended as a voluntary, proportionate alternative, precisely to prevent every subcontractor from having to set up its own policy document. Where a customer nonetheless specifically asks for a separate document, this is usually stated in the question itself — for example for the internal reporting channel for whistleblowers, where the underlying regulation requires a formally documented procedure.