The ESRS Is Final. For Suppliers, the Bigger News Came From a Webinar.

Two things happened in the EU reporting world within a few days of each other this September. The first drew the headlines: the revised European Sustainability Reporting Standards cleared the EU's scrutiny period and entered into force, giving EU companies a settled rulebook for the first time since the Omnibus process began. The second happened on a webinar most suppliers will never hear about. On September 17, EFRAG held its US outreach session on ESRS-40a, the standard for large non-EU groups, jointly with AmCham EU. One answer given during that session matters more to many mid-market suppliers than anything in the final ESRS.

A settled rulebook for EU companies

The revised ESRS apply to financial years beginning on or after January 1, 2027, with the first reports due in 2028. The Commission removed roughly 70 percent of the original datapoints and cut mandatory datapoints by more than 60 percent, while keeping double materiality intact. Alongside the revised standards, the EU finalized a voluntary reporting standard for companies outside CSRD scope. EFRAG has published an updated datapoint list, and a revised XBRL taxonomy is next.

In May we showed that the EU's simplification would sharpen expectations rather than loosen them, and the final text bears that out. There are fewer datapoints, but the core question of how a company affects people and the environment, and how that affects the business, is unchanged. Companies are narrowing their focus to what the standard actually requires, and that includes the parts that depend on supplier data.

The guardrail for suppliers of EU reporters

The voluntary standard carries a second job that suppliers should understand. It underpins what is known as the value chain cap, which limits the information a larger reporting company can demand from smaller companies in its supply chain. For a mid-market manufacturer selling to EU-headquartered brands, that is real protection. A CSRD reporter asking you for sustainability data is expected to stay within what the voluntary standard covers.

The cap limits the scope of a regulatory request, but it does nothing to slow the overall flow of requests. It doesn't govern EcoVadis assessments, CDP supply chain requests, or supplier engagement targets a customer has set under SBTi. Those continue on their own track. As one person in the recent coverage put it, smaller companies will still face growing requests from customers, investors, and banks, and being able to answer them efficiently is becoming a competitive advantage.

The cap does not extend to Article 40a

This is where the webinar comes in. When we covered the ESRS-40a exposure draft in August, we pointed to value chain caps as one piece of good news for suppliers. During the September 17 session, an attendee asked directly whether the value chain cap applies to ESRS-40a. EFRAG's answer was that it does not. EFRAG staff added that this was a legislative decision by the European Commission, not a choice EFRAG made in drafting.

That distinction matters because of who ESRS-40a covers. EFRAG estimated in the session that roughly 400 to 500 US companies fall within its scope, out of around 1,500 in-scope groups from more than 50 countries. US groups are the largest single block. A cosmetics ingredient supplier or specialty chemical manufacturer can easily have both kinds of customer on its books: EU-headquartered brands reporting under the revised ESRS and bound by the cap, and US-headquartered groups reporting under ESRS-40a that are not.

The standard is still in consultation until October 31, and details could move before EFRAG delivers its technical advice in January 2027. But because the cap question was settled at the legislative level, it is not something EFRAG can change on its own.

Why the mixed approach won't shrink the ask

Much of the session focused on the mixed approach, the option that lets non-EU groups limit some disclosures to EU-related impacts. It is tempting to read that as a smaller footprint for suppliers. Three things said during the session suggest otherwise.

First, climate impacts stay global under every reporting route, so Scope 3 data requests are not affected by the mixed approach at all. Second, EFRAG staff signaled that they see own workforce reporting as something that probably makes sense on a global basis, and that human rights in this context include core labor rights. Third, EFRAG indicated that allocation methods, such as revenue share or headcount, could be acceptable for separating EU-related impacts where they faithfully represent those impacts. An allocation still needs the underlying number: a customer cannot apply an EU revenue share to supplier emissions or sourcing data it does not have. The request reaches you at full scope, and the customer does the slicing afterward.

The industry feedback pointed the same way. Participants pushed EFRAG for a clearer and more auditable boundary, and one of the largest US financial institutions proposed explicitly including the upstream value chain in the location-based test. Companies are arguing about where the boundary sits, not whether supplier data belongs inside it.

Two timelines landing on the same supplier

Put the two developments side by side and the sequence is clear. EU reporters begin collecting FY2027 data under the revised ESRS next year, with reports due in 2028. ESRS-40a reporters follow one year behind, on FY2028 data published in 2029, once the Commission adopts the standard in 2027. As we described in our look at the CSRD timeline, exposure for suppliers begins well before any reporting deadline, because customers need your data before they can publish theirs.

The practical conclusion is to prepare for the more demanding customer, not the capped one. A data package that satisfies a US group reporting under ESRS-40a will satisfy an EU customer operating within the cap, but the reverse is not true. We made a similar point when the Omnibus delay was announced: the extra time is a proving ground for the systems that make reporting routine, not a reason to pause.

Building to the higher standard

For most mid-market manufacturers, that preparation comes down to a small number of well-built assets. The core is a defensible GHG inventory with credible Scope 3 figures and product carbon footprints. Around it sit strong EcoVadis and CDP submissions that customers already rely on, and a disclosure aligned with the EU voluntary standard that serves as your baseline answer to capped requests. If a US customer's ESRS-40a report is going to draw on your data in 2029, the time to build that foundation is now, while the standard is still being finalized.