Reporting requests should be necessary, reusable and bounded

The amended Accounting Directive defines a protected undertaking through two cumulative conditions. It must be in the value chain of a reporting undertaking, and it must not exceed an average of 1,000 employees during the preceding financial year, assessed on its balance sheet date. This is not a loose description of any small supplier. The workforce basis, period and value-chain relationship belong in the applicability record.[S35]

A reporting undertaking may rely on the value-chain undertaking's self-declaration to determine whether it is protected. The adopted text does not require the reporting undertaking to verify that declaration, but it may not rely on a declaration that it knows, or can reasonably be expected to know, is manifestly incorrect. GFT recommends a dated declaration that states its employee calculation and is reopened when the workforce basis or corporate relationship changes.[S35]

The substantive protection concerns information exceeding the voluntary standards. For a request made for sustainability reporting as required by the Accounting Directive, the protected undertaking has a right to decline the excess. The reporting undertaking must not require that excess through contractual or other arrangements established for its reporting requirements. A contrary contractual provision is not binding, without destroying the remainder of the contract.[S35]

The adopted text also places a notification duty on a reporting undertaking that directly or indirectly requests information beyond the voluntary standards from a protected undertaking. It must identify which information exceeds those standards and ensure that the protected undertaking is informed of its statutory right to decline it. A useful buyer request should therefore make the excess visible rather than leaving the supplier to reverse engineer the boundary from a portal.[S35]

The mechanism is bounded in both directions. It does not prohibit voluntary sharing, and it does not itself impose a general obligation on a value-chain undertaking to provide sustainability information. It also preserves requests for other purposes, including due diligence. A reporting undertaking that reports necessary value-chain information without exceeding the specified voluntary-standard information from protected undertakings is deemed to comply with the relevant value-chain reporting obligation. The cap is thus a reporting design rule, not a licence to conceal a material gap.[S35]

Legal status needs its own dated check. The Commission records that Directive (EU) 2026/470 was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026. The adopted amendment requires national measures for the reporting changes after entry into force, while the Commission's acts page lists the July 2026 voluntary standards as not in force until their own Official Journal publication. A supplier should not convert the adopted cap into an undated, universal refusal without checking the applicable national measure and effective standard.[S02][S04][S35]

The CSDDD request safeguard answers another question. For an in-depth assessment, companies may request partner information only where necessary. Where the partner has fewer than 5,000 employees, the information must also be unobtainable by other reasonable means. That test differs from the reporting cap's employee boundary, voluntary-standard reference and corporate-reporting purpose. The two regimes should appear as separate rows in the response record, not as one blended size exemption.[S35]

In practice, GFT proposes a protection assessment containing the request purpose, supplier workforce declaration, value-chain relationship, applicable voluntary-standard version, national-law check and any buyer notice of excess. The reviewer should record which fields are accepted, which are voluntarily supplied and which are declined with reasons. If the relationship or legal premise is unresolved, the response should say so and offer a proportionate alternative where possible.

This discipline also protects the buyer. A bounded response tells the reporting team which necessary information remains unavailable and why. It prevents an apparently complete supplier portal from concealing an unresolved scope question. The supplier should preserve that limitation in its submission, while the buyer retains responsibility for explaining missing value-chain information where its own reporting rules require that explanation.[S35]

A reusable answer begins with a definition, not a value. GFT proposes a dictionary that identifies the site, legal entity where relevant, reporting period, workforce basis, output denominator, energy source, incident status and evidence owner. It should also state whether the record covers a whole site, a product family, an order or an allocated process. Without those fields, two accurate source records can produce an inaccurate consolidated answer.

The dictionary should distinguish a measured value from an estimate, an unavailable field and a non-applicable field. “Unavailable” means that the question applies but the supplier does not have adequate evidence. “Not applicable” requires a scope reason. An estimate needs a method, inputs, boundary and reviewer. None of these states should be converted to zero merely because a portal accepts only numeric entries.

This separation is particularly important when a buyer permits estimation. The estimate should not borrow an unmarked sector average and present it as site performance. Its method should show which measured records were available, which assumptions filled the gap and how sensitive the answer is to those assumptions. If the buyer needs a precise figure, the supplier should clarify whether an estimate is acceptable before investing in false precision.

A period lock provides another control. Once a reporting period closes, the source extract and dictionary version used for the submission should remain identifiable. A later payroll correction or meter reconciliation can create a new version, but it should not overwrite the evidence that supported the original answer. The review record should state whether the change is material for each recipient and whether a correction notice is required.

Exhibit 26 shows a compact illustrative structure. Its rows are design examples, not observed factory data and not prescribed ESRS definitions. The actual buyer standard and operating context must determine the final definition. The table deliberately keeps method, evidence and review beside the value so that reuse does not detach the number from its meaning.

The dictionary should also define transformations. If a buyer asks for energy per accepted garment, the numerator and denominator must cover the same site and period unless a documented allocation says otherwise. If another buyer asks for total site energy, the supplier should not submit the order-allocated value without explanation. The source measurement may be identical, but the reporting products are different.

Workforce fields need equal care. Period-end employees, average employees and full-time equivalent capacity answer different questions. Contractors and agency workers need an explicit inclusion rule rather than silent insertion into whichever category makes the answer appear stable. The protected-undertaking self-declaration has its own average-employee test, so its calculation should not be replaced by an unrelated portal field.[S35]

Incident and corrective-action records should preserve status at the reporting date. A concern reported but still investigated is not equivalent to a confirmed breach, and an action marked closed is not equivalent to an outcome verified with affected people. These distinctions allow the buyer to understand what is known without turning an unresolved case into either an accusation or a clean bill of health.

The dictionary is complete only when its ownership works in practice. Operations should explain production records, HR should explain workforce boundaries, and the evidence reviewer should test whether the submission matches the question. A sustainability coordinator can orchestrate the pack, but should not become the silent author of every operational estimate. Accountability remains with the roles that can explain and correct the source.