we are a small business why are we receiving ESG questions from our customer

The questions don't come from the legislator, but from your customer themselves

A small business receives ESG questions because the customer must pass those questions on to their entire chain, not because the company itself falls under the CSRD (Directive (EU) 2022/2464). Large, listed or otherwise reporting-required buyers must report on their own chain, and scope 3 — the emissions and risks at suppliers — is usually the largest part of that. The customer can only fill in those figures if suppliers, large and small, provide something. Hence the list in your mailbox, even though you yourself are far too small to fall under the directive.

For small businesses, there is now a lighter format: the VSME from EFRAG, a voluntary basic module specially created for non-listed SMEs. Many large buyers use this module — or their own variant of it — precisely to avoid burdening the small business with the full CSRD questionnaire. If you recognize parts of the questionnaire that look like VSME (energy consumption, number of employees, basic policies), that is often precisely that lighter variant. If a figure or policy is missing, then "no, not yet in place" is a valid answer — an empty file is not an error, it is a starting position.

Where this begins: the customer's CSRD chain obligation

The obligation to request chain data does not follow from a separate article that affects small suppliers, but from the reporting obligation of the customer itself under Directive (EU) 2022/2464. Recognizable basic data that often already exist elsewhere in the file independently of the ESG subject — how many employees the undertaking has and in which countries the enterprise has establishments — appear in almost every variant of the questionnaire, whether based on VSME or on the customer's own portal format.