Anyone still working from the 2024 state of sustainability reporting is using outdated figures. The reporting obligations were fundamentally scaled back in 2026, and for small suppliers something essential has changed: they are allowed to refuse excessive data requests from their large customers.
That is good news, and a reason to take a closer look. Because "fewer obligations" does not mean "no more questions". Anyone expected to supply environmental data as a supplier is still part of the conversation – just with clearer limits. This article sets out the current legal position, sorts out what applies to small companies, and shows where ISO 14001 genuinely takes work off your hands.
"The reporting obligation has shrunk, customers' data needs have not. The difference is: you can now say no with good reason – if you know what you can document anyway." – Frank Semmig, COO Eucerta España SL and ECA auditor 9001/14001/27001
What the Omnibus Package Changed
The governing legal basis is Directive (EU) 2026/470 of 24 February 2026, published in the Official Journal of the EU on 26 February 2026. Among other things, it amends the Accounting Directive and the CSRD. Three points are decisive for mid-sized companies.
First, the thresholds: in future, companies with more than 1,000 employees and more than 450 million euros in net turnover will be subject to reporting. The turnover threshold has thus been raised from 150 to 450 million euros. This applies to financial years beginning on or after 1 January 2027. The group of directly obligated companies will therefore shrink drastically – the previously planned extension to smaller listed companies has been dropped.
Second, the sector-specific standards: the power to adopt them as binding has been deleted. Guidelines take their place.
Third – and most important for suppliers – the limit within the value chain: companies with fewer than 1,000 employees may not be required to provide more information than the voluntary standards foresee. The directive expressly provides that companies must inform their suppliers of their right to refuse requests that go beyond this.
This third rule is the heart of the matter for SMEs. It does not put an end to data requests, but it gives them an upper limit.
Why the Questions Will Still Come
The companies that remain subject to reporting are large buyers. They have to present the impacts of their business activities and need information from their value chain to do so – particularly on emissions, energy and resources. Which topics are asked about follows from the European standards: Delegated Regulation (EU) 2023/2772 contains the environmental standards ESRS E1 Climate Change, E2 Pollution, E3 Water and Marine Resources, E4 Biodiversity and Ecosystems, and E5 Resource Use and Circular Economy. Their demand does not disappear because the number of obligated companies falls. If anything, it becomes more concentrated, because the same corporations ask the same suppliers.
On top of that: many large customers request ESG data regardless of any legal obligation, for instance for their own climate targets, for ratings or for financing. These requests do not fall under the protection of the directive, because they do not follow from the reporting obligation. To you as a supplier, however, the questionnaire looks exactly the same.
The practical consequence is unspectacular: you do not need CSRD reporting. You need robust environmental data about your own operations – and the ability to supply it without launching a special project.
What ISO 14001 Delivers Here
This is precisely where ISO 14001 comes in. The standard requires you to systematically identify, evaluate and control the significant environmental aspects of your own activities – energy use, emissions, waste, water, resource consumption – and to know and comply with the binding legal obligations that go with them. It also prescribes objectives, indicators and their monitoring.
The overlap with the environmental standards is substantial: energy consumption and emissions fall within the scope of ESRS E1, waste and material use within E5, water consumption within E3. If you already record and monitor these aspects under ISO 14001, you do not have to collect the data afresh – you only have to transfer it into the format the customer wants.
That creates exactly the data base customers ask for, with three advantages over an ad hoc answer:
- The data is generated continuously, not on request. A questionnaire becomes a query from the system rather than a project.
- The data is collected in a traceable way. If you can explain how you count, you are on solid ground when follow-up questions come.
- A certificate is a signal that is understood without explanation – verifiable in the public register at eucerta.org.
What ISO 14001 does not cover belongs to an honest account: the social and governance topics. Anyone receiving questionnaires on working conditions, supply chain due diligence or corporate governance will not find an answer in the environmental standard. For the governance part, ISO 9001 is the obvious complement, because it organises responsibilities, document control and improvement processes. Details of the requirements can be found on our page on ISO 14001.
The Pragmatic Route for Suppliers
For a mid-sized company receiving ESG requests, a clear sequence emerges:
- Check who is asking and why. A request that follows from the customer's reporting obligation is subject to the limit set by the directive. A voluntary request is not – but you are free to negotiate that one too.
- Clarify which data you already have. Energy bills, vehicle fleet, waste disposal, procurement: the basic material is usually there, just unsorted.
- Turn this collection into a system. That is exactly what ISO 14001 is: evaluate aspects, set objectives, measure, review, improve.
- Combine where it pays off. ISO 9001 and ISO 14001 are the most common combination, because both build on the same basic structure. Context, leadership, objectives, internal audit and management review only arise once; essentially, you add the environmental aspects.
The costs are predictable: 179 euros a month for the first standard, 149 euros for each additional one, a term of 36 months, a fixed price for companies with up to 30 employees. From two standards onwards, we run your system as an integrated management system with one audit programme and one management review. You can do the maths in the cost calculator. Certificates are valid for three years from the audit date; between audits, the system stays up to date in the platform.
Conclusion
The CSRD has become smaller, and for suppliers with fewer than 1,000 employees there is now an upper limit on data requests from the value chain. Anyone concluding from this that the topic is settled is confusing legal obligation with market reality: the large customers will keep asking, and the fastest way to answer them is an environmental management system that keeps the figures anyway.
The difference between 2024 and today lies in the stance you take into that conversation. With ISO 14001 you supply what makes sense and can refuse, with good reason, what goes beyond it. Without a system, you supply whatever is being demanded at the time – starting from scratch every time.
Your next step: Use the cost calculator to work out the bundle price for ISO 9001 and ISO 14001 – or use express certification to check whether your aspects and your legal register are already in place.
Further reading:
