Your company is not listed, does not exceed 500 employees, and you have never heard of a sustainability report. Even so, in the coming months it is very likely that one of your main clients will send you an ESG questionnaire or a request for data on emissions, working conditions, or corporate governance. The reason has a name: Corporate Sustainability Reporting Directive (CSRD), the European regulation that is redrawing the rules of the game for thousands of Spanish SME suppliers.
What is the CSRD and why does it matter to those who do not have to report
The CSRD (Directive 2022/2464/EU) entered into force on 5 January 2023 and requires large European companies to publish a detailed sustainability report following the ESRS (European Sustainability Reporting Standards) developed by EFRAG. This is not a cosmetic change: companies subject to the obligation must report verified and audited data on their environmental, social, and governance impact, including data from their value chain.
That is the key point for the SME supplier. When Inditex, Iberdrola, Mercadona, or any listed or large private company has to report its scope 3 emissions (indirect emissions, which include suppliers and customers), the labour risks in its supply chain, or the human rights policies of its subcontractors, it will need data that you must provide. If you cannot do so, the risk is losing the contract.
Application timeline: who reports when
Spain began transposing the CSRD through Royal Decree-Law 5/2023, although full transposition (LIES, Law on Corporate Sustainability Information) required additional legislative processing that continued through 2025–2026. The calendar of obligated entities is phased:
| Type of company | First reporting year | First published report |
|---|---|---|
| Large companies already subject to NFIS (listed companies with >500 employees) | 2024 | 2025 |
| Large non-listed companies (>250 employees or >€50M turnover or >€25M assets) | 2025 | 2026 |
| SMEs listed on regulated European markets | 2028 (deferred by the Stop-the-Clock Directive, April 2025) | 2029 |
| Non-listed SMEs (voluntary or required by clients) | No direct obligation | Under value chain pressure from 2025–2026 |
In practice, large companies with a 2025 reporting year are already collecting data from their suppliers right now. If your company supplies any of them, the questionnaire may arrive before the end of 2026.
What ESG data your clients will ask for
The ESRS define twelve thematic standards. The most common ones in the value chain questionnaires already in circulation fall into three blocks:
Environmental data (E)
- Carbon footprint (scopes 1, 2, and 3): direct emissions from your facilities and vehicles, electricity consumption, and emissions from your own suppliers and logistics. The ESRS E1 standard requires GHG Protocol or ISO 14064 methodology.
- Water consumption and waste (ESRS E3 and E5), especially in industrial, agri-food, and construction sectors.
- Documented environmental policy: good intentions are not enough; the client needs a document, a responsible person, and evidence of training.
Social data (S)
- Working conditions: gender pay gap, turnover rates, percentage of permanent contracts, training hours per employee (ESRS S1).
- Health and safety: accident frequency rate, whether ISO 45001 or equivalent is applied.
- Whistleblowing channel policy and complaint mechanisms accessible to workers and third parties.
Governance data (G)
- Code of ethics or conduct approved and disseminated.
- Anti-bribery and anti-corruption policy (ESRS G1): whether ISO 37001 or an equivalent programme is implemented.
- Information security: if you handle client data, they will expect ISO 27001 or equivalent controls.
The ESG questionnaire: how it arrives and what happens if you do not respond
The most common formats are specialised digital platforms such as EcoVadis, CDP Supply Chain, Sedex (SMETA), or proprietary client questionnaires in Excel or web form. EcoVadis, for example, evaluates four categories (environment, labour and human rights, ethics, and sustainable procurement) and issues a score from 0 to 100. A score below 45 may result in exclusion from the approved supplier panel.
If you do not respond or your score is low, the practical consequences are:
- Disqualification from supplier tenders where the ESG criterion accounts for between 10% and 30% of the total score.
- Contractual penalties or continuous improvement clauses with deadlines.
- Loss of contracts in favour of competitors who are prepared.
- Reputational risk if the client publishes its supply chain and you appear without verified data.
Difference between CSRD, NFIS, and the green taxonomy: do not confuse them
| Framework | What it requires | Who it directly applies to | Impact on SME suppliers |
|---|---|---|---|
| NFIS (Law 11/2018) | Non-financial information statement | Companies with >500 employees (or >250 if listed) | Indirect: clients were already requesting basic data |
| CSRD (Dir. 2022/2464) | ESRS sustainability report, audited | Large companies from 2024; listed SMEs from 2026 | Direct: value chain questionnaires with verifiable data |
| Green Taxonomy (Reg. 2020/852) | Percentage of activities aligned with climate objectives | Financial institutions and large CSRD companies | Indirect: conditions green financing accessible to SMEs |
| CSDDD (Dir. 2024/1760, amended by Omnibus I) | Due diligence on human rights and environment | Very large companies (>5,000 employees + €1,500M turnover), from 2028 | Direct: on-site audits of first-tier suppliers |
The CSDDD (Corporate Sustainability Due Diligence Directive), adopted in 2024 and amended by Omnibus I Directive in 2026, adds an additional layer: very large companies (more than 5,000 employees and €1,500M turnover) will have to actively audit the human rights and environmental practices of their direct suppliers, with the possibility of visits and inspections. The implementation deadline (from 2028 for the first companies, following the Stop-the-Clock Directive of 2025) gives some breathing room, but preparing now for CSRD also means preparing for CSDDD.
Action plan for the SME supplier: five practical steps
There is no need to hire a sustainability department. The journey can be completed with methodology and without fabricating data. From Summum Consultoría, with more than nineteen years accompanying compliance projects in SMEs, we propose the following roadmap:
Step 1: ESG baseline audit
Before answering any questionnaire, it is worth knowing where the company stands. This involves reviewing existing documentation (environmental policy, waste records, collective agreement, security policy), identifying the gaps, and calculating a simplified carbon footprint for scopes 1 and 2. The goal is not perfection, but honesty with real data.
Step 2: Prioritise by client and sector
Not all clients will ask for the same thing. A company in the automotive sector already working with IATF 16949 will have different environmental requirements from a food distributor subject to IFS. Identifying the three or four clients that account for the most turnover and anticipating their preferred ESG platform allows you to focus your efforts effectively.
Step 3: Document what you already do
Most SMEs do more than they document. Selective waste separation, health and safety training, equality policy, code of ethics in the employment contract: all of this counts. Proper documentation can raise the ESG score without changing any process.
Step 4: Address critical gaps
After the audit, real shortcomings will emerge. The most common ones in industrial and service SMEs are: absence of carbon footprint calculation, lack of a documented anti-bribery policy, and absence of a whistleblowing channel. These three elements can be implemented in two to four months with external support.
Step 5: Align with recognised certifications
ESG platforms like EcoVadis positively value recognised certifications. ISO 14001 (environmental management) and ISO 45001 (health and safety) add points directly in the environment and social categories. If your company already holds ISO 9001, adding ISO 14001 in an integrated process is more efficient than starting from scratch. For the ethics category, ISO 37001 (anti-bribery) and an approved whistleblowing channel are the most effective levers.
If you are looking for a structured starting point, our ESG and CSRD consultancy service for SMEs covers everything from the initial diagnosis to support in responding to value chain questionnaires.
Concrete use cases by sector
Industrial automotive supplier (Castilla y León)
A machined parts company with 80 employees received, at the beginning of 2025, a questionnaire from an OEM manufacturer requiring CO₂ emission data per unit produced, the accident frequency rate for the past three years, and an anti-bribery policy signed by management. Without that data, it was excluded from the qualification process for new part references. With a three-month project that included a simplified GHG inventory, a review of the health and safety plan, and the approval of a code of ethics, it was able to respond with verifiable data and maintain its position on the approved supplier panel.
Logistics services company (Las Palmas)
A mid-sized logistics operator received a request to join the EcoVadis platform from one of its retail sector clients. The initial assessment yielded 38 points (bronze level, not achieved). After documenting the existing electric fleet, implementing a diversity policy, and producing a fuel consumption report, the score rose to 54 points (silver level) in the second assessment, sufficient to retain the contract.
Food manufacturer (Aranda de Duero)
An agri-food company supplying a large food distributor was required to report on water management, use of phytosanitary products, and working conditions for seasonal workers. The combination of an already implemented ISO 14001 and a two-pillar SMETA report (labour and health and safety) enabled it to pass the client's documentary audit without significant additional cost.
The role of scope 3 carbon footprint: the indirect supplier trap
Scope 3 of the GHG Protocol groups all indirect emissions that occur in a company's value chain: raw materials, supplier transport, use of the product by the end customer, and its end-of-life treatment. For a large industrial company, scope 3 emissions can account for between 70% and 90% of its total footprint. This means that your emissions data as a supplier are part of your client's account.
If you do not provide your own data, the client will use generic emission factors from databases such as Ecoinvent or the BEIS (UK) database, which tend to be less favourable than the real data of a company that has already optimised its processes. Paradoxically, calculating and communicating your actual footprint can improve your client's position in its own report, which turns transparency into a commercial argument.
Frequently asked questions
Do I have a legal obligation to respond to my clients' ESG questionnaires?
There is no direct legal obligation for a non-listed SME to produce a sustainability report under the CSRD. However, the obligation may arise contractually: if the contract with your client includes sustainability clauses or access to ESG platforms as a qualification condition, non-compliance may be grounds for contract termination. In practice, value chain pressure acts as a de facto obligation for strategic suppliers of large companies.
When will the first questionnaires reach Spanish SME suppliers?
Large companies obligated to report for the 2025 financial year (report published in 2026) are already collecting data from their value chain during 2025 and 2026. The first waves of intensive questionnaires to first-tier suppliers are taking place between late 2025 and mid-2026. If your company has significant contracts with large corporate groups, it is reasonable to expect contact before the end of 2026.
What happens if my company has no documented environmental or social policy?
Starting from scratch is not as unusual as it may seem: many SMEs have good practices that are not documented. The first step is to take an inventory of what already exists (electricity consumption records, accident reports, waste management contracts) and convert it into formal documentation. From there, implement the missing elements. A typical ESG preparation project for an SME of 50–150 employees can be completed in three to six months.
Is it worth getting ISO 14001 certified just for ESG questionnaires?
It depends on the volume of business at stake and the sector. If certification is an explicit qualification requirement from a client that accounts for more than 20% of your turnover, the return is clear. In other cases, a documented environmental management system — even if not externally certified — may be sufficient, and it still scores positively on platforms such as EcoVadis as long as you are in the implementation process. A prior diagnosis allows you to make that decision with data, not intuition. At Summum we support this type of analysis through our ESG and CSRD consultancy service, so that the investment is justified by real commercial return.