VSME. You're probably a 'protected undertaking'. But what does that even mean?

If a large tenant or customer has sent you a sustainability questionnaire, there's a good chance you're entitled to decline most of it.

It’s not a dodgy loophole and we’re not making it up for the clicks; it's the explicit purpose of a piece of EU law adopted in July.

First, the confusing part

There are three documents in circulation, but people tend to use one name for all of them.

EFRAG's VSME, delivered to the European Commission in December 2024, was a voluntary reporting standard for non-listed SMEs. Widely circulated, and not law.

A Commission recommendation from July 2025 endorsed it. Also not law – and it stopped having legal effect when the document below came into force in September 2026.

A Commission delegated regulation adopted on 3 July 2026 is the one that counts. Its title is a mouthful, but one worth savouring: establishing sustainability reporting standards for voluntary use by undertakings protected by the value chain cap*.

That’s voluntary for you – not voluntary for the company asking you.

The differences between the three were deliberately kept small, but one matters: EFRAG's version asked for a greenhouse gas intensity ratio, dividing emissions by turnover. The Commission removed it, so if you're working from a summary that mentions the intensity ratio, you’re working from the wrong summary. Sorry.

You’re (probably) protected

A "protected undertaking" is one that doesn't exceed an average of 1,000 employees in the preceding financial year. That’s it. Not even a vague SME definition. A property company holding billions in assets with 200 people on the payroll is a protected undertaking, and so is almost every Nordic real estate business that isn't vertically integrated.

Protected undertakings come in two bands: those with 10 or fewer employees, and those with more than 10.

So far, so simple. Energy and emissions – total consumption in MWh, estimated Scope 1 and Scope 2 – only sit in the cap for undertakings above 10. Below that, they're marked voluntary in the standard and absent from the cap entirely.

Checking your headcount is a pretty simple way to figure out which band you’re in. And if you’re under 10, you probably already know, to be fair.

Two things apply whatever your size. Anyone can still ask for more; they just have to flag what's above the cap and tell you that you may refuse. And the cap only covers requests made for sustainability reporting — if your bank wants the same data for a credit decision, none of this applies.

What they're allowed to ask for

The standard's basic module contains 11 disclosures: basis for preparation, sustainability practices, energy and emissions, pollution, biodiversity, water, resource use and waste, three on workforce, and one on convictions for corruption and bribery. In its own words, it "does not impose legal reporting obligations unlike the ESRS".

But the cap is narrower than the standard. Annex II lists the specific data points a reporting company may require, and for an undertaking with more than 10 employees the energy and emissions entries are two lines:

• total energy consumption in MWh – the first sentence of the disclosure, and nothing beyond it
• estimated absolute gross greenhouse gas emissions – Scope 1, and location-based Scope 2, in tonnes of CO₂ equivalent

The standard also asks for a renewable/non-renewable breakdown of electricity and fuels, but only "if it can obtain the necessary information" – and that table isn't in Annex II, so it can't be demanded.

Scope 3 sits outside the cap too. The standard discusses Scope 3 at length and notes that undertakings in real estate construction are likely to have significant categories, so report it properly if you report it (just don't mistake a request for an obligation).

What a large company can require from you, by size

Under the EU’s value chain cap. The 1,000 line is the average number of employees in the preceding financial year.

Whatever your size: anyone can still ask for more, as long as they flag what’s above the cap and tell you that you can refuse. The cap only covers requests made for sustainability reporting, and applies from financial years starting on or after 1 January 2027.

What the cap does not do

Although it would be nice, the cap is not a blanket right to refuse. There are four limits to it:

It doesn't stop anyone from asking. A reporting company may request above-cap information, provided it identifies what's above the cap and tells you that you have a statutory right to decline.

It doesn't prohibit voluntary sharing of information that's commonly exchanged in your sector.

It doesn't override existing obligations. The regulation is explicit that the cap doesn't affect any contractual obligation, or obligation under EU or national law, to provide information that stays within the standard.

And it only applies to information gathered for the purpose of sustainability reporting under the Accounting Directive.

Which brings us to the group most likely to be asking.

One little thing before we dig into that, just in case anyone tries to argue you're not in their value chain at all. The cap only applies to information gathered for sustainability reporting. So either you're in that value chain, and the cap protects you – or you're not, in which case the request has no reporting obligation behind it, and it's an ordinary commercial conversation.

There isn't a third option where you owe more than the standard.

So, back to that group most likely to be asking

Lenders are the exception

The cap only covers information gathered for sustainability reporting. So if your bank is collecting for its own CSRD report, it applies. If it's collecting for a credit assessment, a lending decision or a collateral valuation, it doesn't – and that's most of the time.

The regulation does ask for restraint: financial institutions and credit institutions are "encouraged to limit as far as possible" what they request beyond sustainability reporting. Encouraged – not required.

So your lender is the one asker the cap won't help you with. Reporting under the standard is still worth doing. Since January 2026, the European Banking Authority has told banks to make regular use of the sustainability information their counterparties disclose – which in this conversation means you – naming both the ESRS and a voluntary SME reporting standard.

This all means that when a credit questionnaire arrives, the standard's disclosures are the strongest thing to send back. Not because your bank has to accept them, but because its own regulator has pointed it at exactly that.

The dates

The regulation was published in the Official Journal on 21 September 2026 and came into force three days later. Since then, any undertaking with 1,000 employees or fewer can use the standard voluntarily.

The cap itself applies from financial years beginning on or after 1 January 2027, so there's a window: the questionnaires are already arriving, and the protection doesn't bite until next year.

Which is the useful way to think about all of this. Being protected caps what you can be required to hand over. It doesn't stop a tenant asking, it doesn't reach your lender at all, and it doesn't make the number any easier to produce. Total energy consumption in MWh sounds like one line until you try to assemble it across a portfolio.

Most owners find out whether they can answer it the first time somebody asks in writing, but the document that tells you what you'll owe is finished, public and free – and there’s no time like the present.

*The EU's value chain cap is a legal limit introduced by the Omnibus I Directive (EU) 2026/470 that stops large companies from demanding unlimited ESG data from the smaller companies in their value chain