A manufacturing business with 180 staff receives a supplier sustainability questionnaire from its largest customer. Sixty-two questions. Four weeks to respond. The commercial director forwards it to the finance director, who forwards it to the operations manager, who spends the best part of two days pulling half of it together from utility bills and payroll. The rest is answered with best estimates. Nobody checks what happens to the answers, and nobody asks what the account is worth.
Six months later a second customer sends a different form asking for much the same information in a different structure. The process starts again.
This is now a routine pattern in UK mid-market businesses, and it is worth being precise about what is happening. These companies are not being regulated. They are being asked, by customers who are regulated, to supply the raw material for someone else's disclosure. The obligation is commercial, arriving through procurement and account management rather than through legislation.
That distinction matters, because it changes what a sensible response looks like.
Why the volume is rising now
Three things are pushing more requests down the chain at once.
The UK published its final Sustainability Reporting Standards on 25 February 2026, aligned to the ISSB standards, and the FCA is consulting on requiring listed companies to report against them from 1 January 2027. Listed companies that report climate disclosures need emissions data from their supply chains to do it. They will ask their suppliers.
UK central government procurement has required bidders on major contracts to publish a Carbon Reduction Plan and commit to net zero by 2050 since PPN 06/21, now PPN 006 under the Procurement Act 2023. The stated threshold is £5m per annum, but in practice the requirement appears in procurements well below that level, and it cascades to subcontractors.
And large customers with their own targets, whether or not they face any reporting duty, have written sustainability criteria into tender scoring. This is the least visible driver and often the most commercially significant, because a low score on a weighted criterion loses a bid without any explicit conversation about sustainability ever taking place.
None of this is temporary. The direction of travel is settled even where the timetable is not.
The rule most suppliers have not heard about
Something changed in 2026 that works in suppliers' favour.
The Omnibus I Directive (EU) 2026/470 came into force on 18 March 2026 and introduced what is known as the value chain cap. Companies reporting under the EU Corporate Sustainability Reporting Directive cannot require suppliers with fewer than 1,000 employees to provide sustainability information beyond what is covered by the VSME standard. The Commission adopted VSME as a delegated act on 3 July 2026, with entry into force expected around November 2026, and its Basic Module contains roughly 50 data points covering energy, Scope 1 and Scope 2 emissions, waste, water, basic workforce data and basic governance.
Two qualifications are important, and they are the reason this is useful rather than merely interesting.
First, the cap limits what a CSRD reporter can require through the CSRD value chain process. It does not stop a customer asking for more as a commercial matter, and it does not stop a customer making a contract conditional on the answer. What it does is remove the "we are legally obliged to collect this" argument from anything beyond VSME, which converts the conversation from compliance into negotiation. That is a materially better position to be in.
Second, this is EU law. A UK supplier is not directly bound by it and does not directly benefit from it. It bites where a UK business supplies an EU-headquartered group or an EU subsidiary that reports under CSRD, which covers a large share of UK mid-market export and supply relationships. UK customers reporting under UK SRS operate under a separate regime with no equivalent cap.
The practical takeaway is narrower than "you can say no", and more useful. It is that there is now a recognised standard set of supplier data, published by the Commission, that a supplier can point to as the reasonable scope of a request. Having a defensible reference point changes the tone of the exchange.
Three questions before you answer anything
The mistake is treating each request as a task to complete. It should be treated as a decision to make. Three questions settle it, and they take about ten minutes.
What is the request attached to? A weighted criterion in a live tender is a different proposition from a general supplier survey sent to 400 companies for a corporate report. Ask the account manager directly. Most will tell you.
What is the basis for it? Is the customer subject to CSRD, UK SRS, public procurement rules, or none of them? Is this their own target, or their customer's requirement passed through? A request with a named regulatory basis has a defined scope you can work to. A request with no basis has no defined scope, which is why those questionnaires tend to be the longest.
What revenue sits behind it? The annual value of the account or the bid, and what share of turnover that represents. This is the question that almost never gets asked, and it is the one that should determine how much effort the response deserves.
Write the three answers at the top of the request before anything else happens. A business that does this for six months will find that its effort has been badly distributed, usually with the most work going to the requests with the least revenue attached.
Four ways to answer
Once the three questions are answered, there are four sensible responses. Most businesses only use one.
The fourth option is the one that gets ignored, and it is worth being clear that declining well is a commercial skill rather than an act of obstruction. A reply that offers the VSME-equivalent data set, provides it immediately, and asks a specific question about the purpose of anything beyond it, will usually end the exchange without damaging the relationship. Sometimes the requester does not know why they are asking either.
The third option deserves more attention than it gets. When a customer wants something you do not have, such as verified Scope 3 data or a third-party certification, that is a cost. It should be treated the same way as any other customer-specific requirement: named, costed and reflected in the price or the contract term. Suppliers routinely absorb these costs silently, at a point in the cycle when, as Deloitte's Q2 2026 CFO survey shows, only around one in ten UK businesses can pass higher costs through in full.
Build the pack once
The single highest-return action here is unglamorous. Assemble one standing data set, keep it current, and answer from it.
The scope is settled for you. The VSME Basic Module is the closest thing to an agreed baseline for what a smaller supplier should hold, and it maps onto the majority of what questionnaires ask. Build to that and you will answer most requests from stock.
The environmental block covers energy consumption by source, Scope 1 and Scope 2 emissions for the last reported year, waste by broad category and disposal route, water consumption where material, and the method and boundary used for the emissions calculation. That last item is the one most often missing and the one most likely to be challenged.
The workforce block covers headcount, contract types, turnover, health and safety incidents, gender split by level, and training hours. Most of this already sits in payroll and HR systems.
The governance block covers your policies on anti-bribery, whistleblowing, modern slavery, environmental management and supplier conduct, with the dates they were last reviewed. Review dates matter. An undated policy invites a follow-up question.
The assurance block covers certifications such as ISO 14001 and ISO 45001 where held, your net zero commitment and Carbon Reduction Plan if you bid for public work, and the name of the person accountable for the data.
Keep it in one document, refresh it once a year on a fixed date, and give the commercial team direct access. The test of whether this has worked is simple: can a bid manager answer a standard questionnaire without asking anyone in finance or operations for help? If not, the pack is not finished.
Warning signs the process is costing you
Six patterns suggest the response process needs designing rather than tolerating.
The same information is being recalculated for different customers because nobody kept the last version. Requests arrive at individuals rather than at a defined inbox or owner. The commercial director is personally involved in questionnaires for accounts worth less than a month's overheads. Answers are inconsistent across customers, which is a reputational risk if two customers ever compare notes. Deadlines are met at the last minute or missed. And no one in the business can say how many requests came in last year, or what they cost.
The last one is the most telling. A cost nobody has counted is a cost nobody has managed.
What to do in the next quarter
This does not need a programme. It needs a fortnight of proper work and a decision about ownership.
In the first two weeks, gather every sustainability request received in the past twelve months and put the revenue figure next to each one. Estimate the hours spent. Most leadership teams find this exercise uncomfortable, which is the point.
In weeks three and four, build the standing data pack to the VSME Basic Module scope, using real figures where you have them and a documented estimation method where you do not. An honest, well-explained estimate is more credible than a precise-looking number with no method behind it.
In weeks five to eight, agree the triage rules and the four response levels with the commercial team, and name a single owner. In a business of this size the owner is usually the finance director or the head of bids, not a new sustainability hire.
In weeks nine to twelve, review the three or four largest customer relationships specifically. Find out what is coming, whether sustainability criteria are weighted in any upcoming renewal, and whether any of them fall under CSRD. Ask the question before the questionnaire arrives.
The commercial framing
Sustainability requirements reaching a mid-market business through procurement are, in the end, a customer requirement like any other. The businesses that handle them well treat them accordingly: they know what each request is attached to, they answer the important ones properly and quickly, they price the ones that require new capability, and they decline the ones with no basis and no revenue behind them.
The businesses that handle them badly answer everything with equal effort, absorb every cost, and find out too late that a tender was lost on a criterion nobody was watching.
If your leadership team is fielding more of these requests than it used to and has never sat down to work out what they cost or what revenue depends on them, a short readiness review will usually pay for itself in the first tender cycle. Allington Advisors works with founders and leadership teams on practical sustainability positioning, the operating processes behind it and the commercial decisions it touches.