my customer's questionnaire is completely unsuitable for a small business like ours what now
Large CSRD questionnaire, small business: how to fill it in
Fill in what you know, and use the EFRAG SME basic module as a conversion table for the rest. Large customers often send a questionnaire that is based on their own CSRD reporting under Directive (EU) 2022/2464 — with scope 3 chains, double materiality and dozens of data points that for a non-listed enterprise are simply not all relevant or available. That is not your mistake. The VSME standard from EFRAG is specifically designed for this situation: a compact set of indicators that an SME can reasonably provide, and that large customers increasingly accept as fulfillment of their own demand for chain data.
In practice, this means: go through the questionnaire and mark for each question whether your customer actually means a VSME data point in different wording. Energy consumption, employee numbers, basic policy statements — those kinds of questions can often be traced back to a VSME item you already have or can easily fill in, such as how many employees the undertaking has. Questions that are clearly tailored to scope 3 chain analysis of a listed company — with supplier audits over multiple years — you can usually answer with "not applicable" or "not available at our level", without that being a shortcoming.
What this is based on
The basis is the EFRAG VSME itself, which is explicitly designed as a voluntary, proportionate standard for non-listed SMEs that are asked for CSRD-like data by larger chain partners; the CSRD Directive (Directive (EU) 2022/2464) regulates the reporting obligation of the large enterprise itself, not that of the smaller supplier. A question that does not align with company size at all can also be tested against factual data that are established, such as the sector in which the enterprise operates — if a question simply does not align with that, that in itself is already an indication that the questionnaire was not written for your scale.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.