Sustainability Reporting for SMEs: A 2026 Starter Guide

If you run an SME in Europe and have been forwarded an “ESG questionnaire” by your bank, your largest customer, or a prospective investor in the last twelve months, you are not alone — and the question you are probably asking is: do I actually have to do this, or can I ignore it?

The honest answer is: legally, most SMEs do not have to publish a sustainability report. Practically, most SMEs are being asked to share sustainability data anyway — and there is now a single, voluntary, EU-recognised standard built specifically to answer those requests without forcing you into the full reporting machinery designed for large corporations.

This guide walks through who has to report, who is being asked to report even when they do not have to, what counts as “the smallest report that does the job”, and where to start if you decide it is time.

Why this is suddenly on every SME’s desk

Three forces converged in 2024–2025 and they all point at SMEs:

1. CSRD pulled large companies into mandatory reporting. Roughly 50,000 EU companies are now obliged to publish detailed sustainability reports under the European Sustainability Reporting Standards (ESRS). Those companies need ESG data from their suppliers — most of whom are SMEs.
2. Banks tightened ESG-linked lending. EU banks are themselves regulated under SFDR and CSRD and need portfolio-level ESG data. Loan applications, renewals, and ESG-linked pricing now ask SMEs for emissions data and policy attestations they did not used to be asked for.
3. Procurement teams added ESG gates. Large customers — public procurement especially — now include ESG criteria in supplier qualification. “Provide your latest sustainability disclosure” has become a normal RFP line.

The result: an SME that has never been in any reporting scope is suddenly being asked the same data questions that ESRS-bound large companies are being asked.

Who actually has to report

EU sustainability reporting obligations in 2026, simplified:

• Large companies (>250 employees, or >€50M turnover, or >€25M balance sheet) — in CSRD scope. Must publish a full ESRS report.
• Listed SMEs on EU regulated markets — in CSRD scope but allowed to use a lighter listed-SME standard (LSME).
• Non-listed SMEs — not in CSRD scope. No statutory obligation to publish a sustainability report.
• Microenterprises (fewer than 10 employees and under €2M turnover or balance sheet) — exempt from CSRD entirely.

If you fall in the bottom two groups, no EU directive forces you to publish a report. That is the law. What follows is the reality.

Who is being asked to report

The same SMEs that are not legally obliged to report are being asked for ESG data by:

• Banks — at loan origination, refinancing, and during the ESG review attached to sustainability-linked loans (SLLs). Typical asks: Scope 1+2 emissions, energy use, headcount, anti-corruption policy, environmental incident history.
• Large customers — under their CSRD Scope 3 obligations. Typical asks: emissions per product or per €, supplier code-of-conduct attestation, operational data tied to the products you sell them.
• Insurers — particularly for property, fleet, and D&O policies. Typical asks: physical climate risk exposure, environmental incident history.
• Private equity owners — quarterly or annual ESG KPI rollups for portfolio reporting.
• Public procurement — increasingly built into RFPs in DACH, Benelux, and the Nordics.

This is the shift: demand for ESG data from SMEs decoupled from any obligation on the SME to publish it. You can refuse — but the cost is real.

VSME: the standard built for this exact problem

EFRAG (the same body that wrote ESRS for large companies) published the Voluntary Sustainability Reporting Standard for non-listed SMEs (VSME) to solve the “every counterparty asks something different” problem.

Two key properties:

• Voluntary. No regulator enforces VSME. You publish it because it is useful, not because you must.
• Proportionate. Designed to be answerable from data an SME already has, not a brand-new data infrastructure.

VSME is split into two modules:

• Module Basic — minimum viable disclosure: company info, energy, Scope 1+2 emissions, workforce headcount, key policy attestations. Producible by most SMEs in their first cycle.
• Module Comprehensive — adds business-model context, lighter-touch double materiality, targets, Scope 3 categories where data exists, value-chain disclosures.

Most SMEs should start at Basic and only progress to Comprehensive when a counterparty explicitly asks for it. The deep walkthrough is in our VSME sustainability reporting guide.

”But I am not in scope, why bother?”

Three concrete reasons SMEs publish a VSME report despite no obligation:

1. It is cheaper than answering questionnaires forever. If three banks and four customers ask different ESG questions every year, the cumulative time spent is larger than producing one VSME report once and pointing everyone at it.
2. It de-risks growth deals. A VSME report on file shortens diligence in supplier onboarding, refinancing, and acquisition conversations. Deals where ESG diligence drags often die from delay, not from rejection.
3. It is a soft hedge against future scope. The CSRD review process is examining whether to extend obligations downstream. Companies who already have a VSME report in production face zero transition cost if rules change.

What VSME does not do:

• It does not replace CBAM if you import steel, aluminium, cement, fertiliser, hydrogen, or electricity into the EU
• It does not satisfy SFDR Article 8/9 product-level disclosures for financial counterparties
• It does not exempt you from any sector-specific obligation (waste shipment, F-gases, etc.)

VSME is a reporting chassis — bolt sector or counterparty obligations on where they apply.

What “the smallest report that does the job” looks like

A first-cycle VSME Module Basic report will typically include:

• Company identifier section — legal form, sector codes, headcount, locations, ownership
• Energy — total consumption split by source (grid electricity, gas, fuel)
• Greenhouse gas emissions — Scope 1 (your fuel and refrigerants) and Scope 2 (your purchased electricity, location-based)
• Workforce headcount — total, gender split, employment type, geographic split
• Health and safety — recordable incident counts and lost-time injuries
• Policy attestations — yes/no presence of anti-corruption, human-rights, and environmental policies, with link or reference

Most of this exists in HR exports, utility invoices, payroll, and the company handbook. The work is collecting it into one report-shaped artefact, not producing new data.

Where to start, in order

1. Inventory the asks. Pull out every ESG questionnaire you have received in the last year. Tally what is being asked. The overlap is large — it almost always reduces to a VSME Basic-shaped data set.
2. Decide Basic or Comprehensive. Default to Basic. Only choose Comprehensive if a named counterparty has asked for something Basic does not cover.
3. Pick a data owner per disclosure. One person, named, per row. Not “the team.”
4. Pull existing evidence first. HR system, utility portal, finance system. Collect six months before designing any new data flow.
5. Draft, review with finance, ship. Iteration is fine. Perfection in cycle one is not the goal — answering the questions is the goal.
6. Publish or share privately. Some SMEs publish VSME reports on their website (good for SEO and credibility). Others share privately with counterparties on request. Both are valid.

The next decision

If you are not in CSRD scope but you are getting asked, your decision is not “report or not report.” It is “bespoke answers forever or one standard report.” VSME exists to make the second option viable.

If you want to move on to standard mechanics, our VSME reporting guide covers Module Basic and Comprehensive in depth. Future posts in this series will walk through the Basic disclosures one by one, double materiality for SMEs, Scope 3 calculation methods, and how to map existing evidence to specific VSME line items without rebuilding your data stack.