I received a VSME list from my customer, what should I do
VSME is the basic module: identity, size, environmental figures
The VSME list is the voluntary EFRAG standard for non-listed SME enterprises. Your customer is requesting it because they themselves are subject to reporting obligations under the CSRD (Directive (EU) 2022/2464) and need figures from their supply chain for scope 3. The basic module consists of two parts: general company data and a limited set of environmental and social key figures. There is also an extended module, but a customer will only ask you for it if they themselves are further down the supply chain than most SME suppliers.
The first part overlaps strongly with what you already record in your supply chain file: the statutory name, the trade register number, the registered address and the number of employees. It fills itself automatically. The second part — energy consumption, emissions, water consumption, waste, and in the extended module also working conditions and human rights policy — only has an answer if you have already measured those figures. If you do not yet have energy or CO2 figures, then there is no "yes" to suggest: that field remains open until you have supplied it yourself. Filling in an estimate because the field would otherwise be empty is not a substitute for a measured figure.
Why the basic module is broader than environment alone
The EFRAG VSME standard describes itself which data points belong to the basic module and which to the extended module; this division determines whether a question can be answered with existing company data or only with a separate measurement. Separately from this, the Trade Register Act 2007 stipulates which basic data of every enterprise are already registered — this is precisely the part of the VSME list that fills in automatically. For the figures above that, there is no legal source that already records them for you.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.