Short answer
Build the data collection, not the report. A smaller company is unlikely to be in scope of the CSRD and the scope has been narrowing, but its customers are in scope and will ask — and the EU published a voluntary standard, the VSME, precisely so those requests have a common shape. What survives every change of threshold is the underlying measurement: consumption, suppliers, headcount, boundaries, year on year. Automate the collection of that. Do not automate the disclosures.
This summarizes official Commission publications as at 10 August 2026 and is not legal or accounting advice. This is an area where the rules have changed repeatedly; check any figure against the current text before relying on it.
Scope, and why it keeps moving
The Corporate Sustainability Reporting Directive was published in the Official Journal on 14 December 2022 and the first companies subject to it applied the rules for the 2024 financial year, reporting in 2025. Since then the timeline recorded on the Commission’s own page — last updated on 3 July 2026 — reads as a sustained retreat from the original ambition.
- 26 February 2025. A simplification package that, among other things, “proposes to apply the CSRD only to the largest companies (those with more than 1000 employees), focusing the sustainability reporting obligations on the companies which are more likely to have the biggest impacts on people and the environment”.
- 14 April 2025. Political agreement on the “stop-the-clock” Directive, which “postpones the entry into application of the reporting requirements for those companies that were previously required to report for the first time for financial years 2025 or 2026” — the second and third waves.
- 11 July 2025. A “quick-fix” delegated act ensuring first-wave companies “do not have to report additional information for financial years 2025 and 2026 compared to what they had to report for financial 2024”.
- 9 December 2025. Political agreement on the Omnibus I simplification package.
- 3 July 2026. Adoption of two delegated acts simplifying certain reporting standards and establishing standards for voluntary use by undertakings protected by the value chain cap.
One number we are not giving you: the final adopted scope threshold. The Commission page we can open records the February 2025 proposal, not the figure ultimately enacted, and the consolidated text sits behind an access barrier we could not get through. If your position depends on which side of a threshold you fall, read the directive rather than any secondary summary. On a file amended this many times in eighteen months, that is not pedantry.
The route that reaches you anyway
Being out of scope settles your legal obligation and almost nothing about your workload. Large companies that must report need data about their value chains, and the only way to get it is to ask their suppliers.
So the request arrives as a commercial condition rather than a legal one, usually in the form of a bespoke spreadsheet, with a deadline attached to a contract renewal. That is often the moment a smaller supplier discovers it has no measurement at all — not because it is difficult, but because nobody had a reason to collect it before.
The commercial reframing worth making at that point: a supplier who can answer quickly and consistently is easier to keep than one who cannot, and this becomes a procurement differentiator well before it becomes a legal duty.
The standard built for your position
The EU noticed this dynamic and responded to it. On 30 July 2025 the Commission adopted a recommendation on a voluntary sustainability reporting standard for SMEs, the VSME, developed by EFRAG.
Its stated purpose is exactly the problem above: the standard “will reduce administrative burden on SMEs by making it easier for them to respond to requests for sustainability information from large companies and financial institutions which are subject to mandatory reporting under the Corporate Sustainability Reporting Directive (CSRD) and which have such SMEs in their value chains”. The Commission “encourages large companies and financial institutions that seek sustainability information from SMEs to base their requests on the voluntary standard as far as possible”.
Two practical consequences. First, when a customer sends a bespoke questionnaire, you have something to point at — a Commission-backed common format is a reasonable thing to propose. Second, and more valuable: preparing once against a published standard means the second and third questionnaires are extractions rather than projects. The Commission also notes that SMEs may report voluntarily “to improve their access to sustainable finance”, which is a reason to do it that has nothing to do with any customer.
Where the work actually is
Sustainability reporting looks like a writing exercise and is a data exercise. The proportions are not the ones the framework documents suggest.
| Stage | What it involves | Automate? |
|---|---|---|
| Finding the data | Utility bills, fuel cards, travel bookings, waste invoices, payroll, supplier records — each in a different system or a different inbox | Yes. This is document extraction — the stage with the most items to touch, and the one that sets the schedule. |
| Normalizing it | Different units, different periods, different sites, mid-year changes of supplier | Yes, with the conversion rules written down and version-controlled. |
| Setting the boundary | Which entities, which sites, which activities count — and applying the same choice next year | No. This is a judgement that determines whether your numbers mean anything. |
| Answering a specific questionnaire | Mapping your measured figures onto someone else’s question wording | Yes, by retrieval from what you already prepared, not by generation. |
| Writing the narrative | Explaining what the figures show and what you intend to do | No, beyond a first draft. This is an assertion about your own business. |
The boundary problem nobody warns you about
The single most common failure in a first sustainability exercise is not a wrong number. It is a boundary that shifts between years, making the comparison meaningless while looking entirely credible.
A site is added, a subsidiary is folded in, home working is counted this year and was not last year, a leased vehicle moves category. The total changes, someone attributes the change to performance, and nobody can reconstruct which part of it was a definition. Write the boundary down as a document — entities, sites, activities, inclusions and deliberate exclusions, with the date it was set and by whom. Then treat any change to it as an event that gets recorded, not a detail.
Where the measured data is energy consumption specifically, the monitoring side of this is covered in AI for energy optimization, and the same discipline about scheme definitions applies.
Why the writing is the wrong thing to automate
Generated sustainability prose is fluent, plausible, and unmoored from measurement. It is also, for companies in scope, potentially subject to third-party assurance — which means the reader most likely to test a claim is a professional looking for exactly the gap between narrative and data.
The narrower risk for a smaller supplier is subtler but real. An answer given to a customer’s questionnaire is a representation made in a commercial relationship. A generated claim about a policy you do not have, or a target nobody set, is the kind of statement that surfaces at the worst moment. Draft from your figures, and let a person own each sentence that makes a claim.
Build the data once
- Start from the questionnaire you have already received. It tells you what your actual market asks for, which is a better specification than any framework.
- List where each figure lives — the system, the inbox, the person. In a first exercise the hard part is locating the data, not calculating it.
- Write the boundary document before the first number. Entities, sites, activities, exclusions, date, owner.
- Automate extraction from the recurring documents. Utility bills, fuel, waste, travel. These arrive monthly forever, which is what makes them worth the setup.
- Prepare once against the VSME rather than per customer, then answer each request by retrieval from that. The second questionnaire should cost a fraction of the first, and if it does not, the data was never structured.
- Date-stamp the whole thing. The rules underneath this have changed several times since 2024 and the timeline suggests they are not finished.
The document plumbing this depends on is the same as everywhere else: AI document management, and the reporting layer on top is automated reporting. Where this sits in a wider program of internal automation is in our guide to AI automation for small business.
Frequently asked questions
Is a small company required to report under the CSRD?
Almost certainly not, and the direction of travel has been to narrow the scope further rather than widen it. The Commission's February 2025 simplification package proposed applying the CSRD "only to the largest companies (those with more than 1000 employees)". That was the proposal; the final adopted thresholds are set in the directive text and should be checked there rather than taken from any summary, including this one.
Then why are our customers sending us sustainability questionnaires?
Because they are in scope and you are in their value chain. That is the mechanism by which reporting obligations reach companies that have none. Your customer needs data about its supply chain to complete its own report, and the request arrives as a commercial condition rather than a legal one.
Is there a standard we can point them to?
Yes, and it exists for exactly this. On 30 July 2025 the Commission adopted a recommendation on a voluntary sustainability reporting standard for SMEs, the VSME, developed by EFRAG. In the Commission's words it "will reduce administrative burden on SMEs by making it easier for them to respond to requests for sustainability information from large companies and financial institutions" that have such SMEs in their value chains, and it "encourages large companies and financial institutions that seek sustainability information from SMEs to base their requests on the voluntary standard as far as possible".
Did the CSRD deadlines move?
Yes, more than once. A "stop-the-clock" Directive reached political agreement on 14 April 2025 and postponed the entry into application of reporting requirements for the companies previously due to report first for financial years 2025 or 2026 — the second and third waves. A further political agreement on the simplification omnibus followed on 9 December 2025, and two delegated acts simplifying the reporting standards were adopted on 3 July 2026.
Where does AI actually help with sustainability reporting?
In collection and reconciliation, which is where the effort goes. Pulling consumption figures out of utility bills, extracting supplier data from documents that arrive in a dozen formats, and matching this year's numbers to last year's boundary so the comparison means something. Writing the narrative is the visible part and the smallest part.
Can AI write the disclosures themselves?
It can draft them, and that is the part of the work least worth automating. A sustainability disclosure is an assertion about your own operations that may be assured by a third party. Generated prose that is not traceable to a measured figure is a liability dressed as a deliverable — and the reader most likely to notice is an auditor.
If a customer questionnaire has landed and you are assembling the answer from scratch each time, the fix is a data pipeline rather than a better template. Book a call.
