Your EU customer sent an ESG questionnaire: what a Vietnamese SME must prepare, who owns each item, in what order

Short answer: the ESG questionnaire from your EU customer is not an arbitrary test — it is the downstream effect of four separate legal mechanisms, and each one gives you different rights. Since March 2026, EU law states plainly that a supplier with no more than 1,000 employees is a "protected undertaking" with a statutory right to decline questions that go beyond the voluntary reporting standard — but that right applies only to questions asked for sustainability reporting purposes, not to everything a customer asks. Knowing that boundary is the difference between a week of paperwork and three months chasing an open-ended request.

Last updated: 05/08/2026.

Quick summary for the time-poor

Six things to remember, each citing the source document inline:

• You have a right to decline, and it is written into law. Not customer goodwill, not a negotiating position.
• But the right is narrow. It only blocks questions serving sustainability reporting under the CSRD. Questions serving supply-chain due diligence, CBAM, deforestation compliance, or simply commercial terms in your contract are not blocked.
• The benchmark is VSME — 11 disclosures in the Basic Module, 9 additional in the Comprehensive Module. That is the yardstick for what counts as "excessive".
• Contract clauses that contradict this cap are not binding, even if you already signed.
• Most answers already exist in your filing cabinet — environmental permit, annual environmental report, labour records, electricity bills. Only a small group has to be newly measured.
• The deadlines changed twice in eight months. Most material written in 2025 still cites dates that are now dead.

Key facts — one verifiable source per line:

• EU sustainability reporting now applies only to undertakings with net turnover above EUR 450 million and more than 1,000 employees on average (Directive (EU) 2026/470 of 24 February 2026, OJ 26 February 2026).
• A "protected undertaking" is one that does not exceed an average of 1,000 employees in the preceding financial year and sits in the value chain of a reporting undertaking (same source, amending Article 19a(3) of Directive 2013/34/EU).
• The reference voluntary standard is VSME, issued with Commission Recommendation (EU) 2025/1710 of 30 July 2025, OJ 5 August 2025; the Commission must adopt the formal standard by delegated act by 19 July 2026.
• The CBAM mass-based exemption is 50 tonnes net per calendar year, counted cumulatively across iron and steel, aluminium, fertilisers and cement — electricity and hydrogen are excluded from the exemption (Regulation (EU) 2025/2083 of 8 October 2025, OJ 17 October 2025, Annex VII).
• EUDR now applies from 30 December 2026 for large and medium operators and 30 June 2027 for micro, small and individual operators, after a second postponement by Regulation (EU) 2025/2650, OJ 23 December 2025, in force 26 December 2025.
• In Vietnam, the annual environmental protection report is due before 15 January of the following year, covering 1 January to 31 December (Circular 02/2022/TT-BTNMT, consolidated text 55/VBHN-BNNMT, Article 66(2)).

Why that questionnaire reached you: four mechanisms, four different obligations

Direct answer: do not answer a questionnaire before you know which mechanism produced it. The same spreadsheet landing in your inbox may serve four entirely different legal purposes — and your right to decline exists in only one of them.

This is where most Vietnamese suppliers go wrong at the very first step. Someone receives the file, sees 180 rows of questions, and either fills in everything or panics and goes quiet. Both are expensive. The correct move is to open the covering email and find out what the customer is invoking.

The stakes are not small. According to customs data published on the Vietnamese Ministry of Industry and Trade portal, two-way Vietnam–EU trade reached more than USD 73.8 billion in 2025 (up almost 8%), of which Vietnamese exports to the EU were over USD 56 billion (up 8.6%). In the first five months of 2026, exports to the EU reached USD 25.78 billion, up 13.3% year on year, producing Vietnam's largest bloc-level trade surplus at USD 17.87 billion. Every company behind those numbers is a link that can be asked.

The legal foundation is the EVFTA, signed in Hanoi on 30 June 2019 and in force since 1 August 2020. Notably, the EVFTA contains a full Chapter 13 on Trade and Sustainable Development, in which Article 13.4(2) commits both parties to core International Labour Organization principles, Article 13.5(2) to implementing multilateral environmental agreements, and Article 13.6 explicitly to the Paris Agreement. ESG expectations are not something your EU customer invented — they are already inside the trade agreement.

Table 1 — The four mechanisms that generate ESG questionnaires for Vietnamese suppliers, and your rights under each. Legal status as at 5 August 2026.

Mechanism	Instrument currently in force	Who is directly bound	What it asks you for	Can you decline?
Sustainability reporting (CSRD)	Directive 2013/34/EU as amended by Directive (EU) 2026/470	EU customers with >EUR 450m turnover and >1,000 employees	Value-chain data for their own sustainability report	YES — if you have ≤1,000 employees, for anything beyond VSME
Supply-chain due diligence (CSDDD)	Directive (EU) 2024/1760 as amended by Directive (EU) 2026/470	EU customers with >5,000 employees and >EUR 1.5bn worldwide turnover	Human-rights and environmental risk in your operations	NO — the law asks them to restrain themselves; it gives you no right to refuse
Carbon border adjustment (CBAM)	Regulation (EU) 2023/956 as amended by Regulation (EU) 2025/2083	EU importers (iron and steel, aluminium, fertilisers, cement, electricity, hydrogen)	Embedded emissions in a specific consignment	NO — without your figures they apply default values, usually worse for you
Deforestation (EUDR)	Regulation (EU) 2023/1115 as amended by 2024/3234 and 2025/2650	The first operator placing goods on the EU market	Geolocation of every plot of land, production dates, supplier details	NO — missing data means the goods cannot enter the EU

The table reveals something counter-intuitive: the right that gets the most press coverage is the narrowest one. It exists only within the sustainability reporting mechanism. The other three — due diligence, carbon border, deforestation — grant nothing comparable, because they are not "collect data to write a report" regimes; they are conditions for goods to move at all.

For Vietnamese exporters the fourth mechanism deserves the closest attention. The EUDR covers seven commodity groups — cattle, cocoa, coffee, oil palm, rubber, soya and wood — of which coffee, rubber and wood are major Vietnamese exports to the EU. If you are in one of those sectors, what you receive is likely not a general ESG questionnaire but a demand for plot coordinates, and there is no way to decline other than losing the order. We cover this cluster of supply-chain obligations separately in our article on green supply chains for Vietnamese SMEs.

The information cap: EU law just gave SMEs a right to decline, and here is its boundary

Direct answer: if your company did not exceed an average of 1,000 employees in the preceding financial year, you are a "protected undertaking" under EU law and you have a statutory right to decline questions beyond the VSME standard — even where a signed contract says otherwise.

This is new, and far more concrete than earlier appeals to "be proportionate when asking SMEs". Directive (EU) 2026/470 inserts the definition directly into Article 19a(3) of Directive 2013/34/EU: "'protected undertaking' means an undertaking which: (i) does not exceed, on its balance sheet date, an average number of 1 000 employees during the preceding financial year; and (ii) is in the value chain of a reporting undertaking".

From that definition the law grants three things a Vietnamese supplier should know by heart:

• The right to decline. Verbatim: "Protected undertakings shall have the right to decline to provide information exceeding the information specified in the voluntary standards in response to a request made for the purpose of sustainability reporting as required by this Directive."
• Contract clauses to the contrary do not bind you. Verbatim: "any contractual provision contrary to point (a) shall not be binding, without however affecting the binding nature of the remaining provisions of the contract" — the rest of your contract stands; only that clause is void.
• The customer must tell you. When asking beyond the standard, the reporting undertaking must identify which information exceeds the standard and inform you of your statutory right to decline. A 180-row questionnaire with nothing flagged is a sign the customer has not updated its process.

One procedural detail strongly favours SMEs: you do not have to prove you are under 1,000 employees with audited records. The law lets the customer rely on your self-declaration and states they "shall not be required to take steps to verify the information contained in such a self-declaration". A signed, stamped headcount declaration is enough to trigger the protection.

But here is the boundary you must read carefully, because misreading it costs real money. The same provision continues that the cap "affects information requests for purposes other than the purpose of sustainability reporting as required by this Directive, including requests for the purpose of complying with Union requirements on undertakings to conduct a due diligence process" — meaning the cap does not touch requests serving other purposes, in particular due diligence. In practice:

• Customer asks for data to write their sustainability report → cap applies, you may decline the excess.
• Customer asks to run supply-chain due diligence under the CSDDD → cap does not apply.
• Customer asks to file CBAM or file EUDR → cap does not apply.
• Customer asks because of their internal procurement policy or to score suppliers → this law is silent; it is commercial, and declining may cost the order.

So the practical advice is not "just refuse". It is: read what the customer's email invokes, split the questionnaire into two columns — inside VSME and outside VSME — and answer the first column completely first. That first column is what you should have ready regardless of which customer asks.

There is a weaker relief layer for the CSDDD too. Directive (EU) 2026/470 raises the due-diligence threshold to more than 5,000 employees and more than EUR 1.5 billion in worldwide turnover, and records in its recitals that for business partners with fewer than 5,000 employees companies "should request information only where the information cannot reasonably be obtained by other means such as from information they have or other sources". This is a standard of conduct, not a right to refuse, but it is legitimate grounds to ask your customer to use sector data rather than make you measure separately.

The 20-item VSME dossier: what you already have, what you must measure

Direct answer: VSME has 11 disclosures in the Basic Module and 9 additional ones in the Comprehensive Module. Of the 11 basic items, most can be answered from paperwork a Vietnamese factory already must hold under domestic law — only the energy and emissions group genuinely requires new measurement.

VSME is the voluntary sustainability reporting standard for non-listed SMEs, drafted by EFRAG and issued by the European Commission with Recommendation (EU) 2025/1710. Its structure is described verbatim as: "This Standard has two modules that the undertaking can use to prepare its sustainability report: (a) Basic Module: Disclosures B1 and B2 and Basic Metrics (B3 to B11)… and (b) Comprehensive Module: this module sets datapoints in addition to disclosures B1-B11, which are likely to be requested by banks, investors and corporate clients of the undertaking on top of the Basic Module."

What matters for a Vietnamese company is the mapping below. The right-hand column shows you are not starting from zero — you are starting from your existing files.

Table 2 — The 11 VSME Basic Module disclosures mapped to paperwork a Vietnamese manufacturer typically already holds. The "data source in Vietnam" column is a practical mapping produced by GROW, not an EFRAG requirement.

Code	Disclosure	Data source in Vietnam	Already held or must measure?
B1	Basis for preparation	Business registration, legal-entity chart, site list	Already held
B2	Practices, policies and future initiatives for a sustainable transition	Internal rules and policies; often must be drafted	Usually must be drafted
B3	Energy and greenhouse gas emissions	Electricity bills, fuel purchase records, boiler consumption norms	Must be measured and calculated
B4	Pollution of air, water and soil	Environmental permit, periodic monitoring results	Already held
B5	Biodiversity	Site location relative to protected areas; EIA file	Already held (mostly)
B6	Water	Water bills, water abstraction licence, wastewater records	Already held
B7	Resource use, circular economy and waste management	Waste transfer manifests, waste tracking log	Already held
B8	Workforce — general characteristics	Payroll, employment contracts, social insurance records	Already held
B9	Workforce — health and safety	OSH records, accident log, training records	Already held
B10	Remuneration, collective bargaining and training	Payroll, training records, registered internal labour rules; collective labour agreement if one exists	Already held
B11	Convictions and fines for corruption and bribery	Legal-affairs records; usually a "none" disclosure	Already held

The crucial point is that most of the "already held" items above are not dormant paperwork — they are periodic reports you already file with the authorities every year. The data has been collected, internally reviewed and signed off. What remains is reformatting it, not finding it:

• Annual environmental protection report — due before 15 January, covering 1 January to 31 December (Circular 02/2022/TT-BTNMT, consolidated 55/VBHN-BNNMT, Article 66(2)). ⚠️ The recipient changed: since 29 January 2026 it is the provincial Department of Agriculture and Environment and the commune-level People's Committee — no longer the Department of Natural Resources and Environment or the district level. This feeds B4, B6 and B7.
• Facility GHG inventory report — if your site appears on the list issued with Decision 13/2024/QD-TTg (in force 1 October 2024, replacing Decision 01/2022/QD-TTg), you already have to inventory every two years and file with the provincial People's Committee before 31 March, from 2025 onwards, under Decree 06/2022/ND-CP as amended by Decree 119/2025/ND-CP (in force 1 August 2025). This is B3 — if you are on that list, the hardest VSME item is already done.
• Annual occupational safety and health report — due before 10 January; labour-change reports — before 5 June and 5 December. ⚠️ The recipient is now the Department of Home Affairs, since labour functions moved from the Ministry of Labour, Invalids and Social Affairs to the Ministry of Home Affairs, even though the older circulars still name the labour department in their text; we were able to confirm this against Ho Chi Minh City's guidance, so check your own province. Together with periodic health checks (at least annually, and six-monthly for arduous or hazardous work, workers with disabilities, minors and older workers) and safety cards for jobs with strict requirements under Law 84/2015/QH13 on Occupational Safety and Health, this feeds B8, B9 and B10.
• Key energy-using facilities (from 1,000 TOE per year for industrial, agricultural and transport operations; 500 TOE for buildings) additionally report energy consumption annually and undergo an energy audit every three years. ⚠️ The legal basis just changed: amending Law 77/2025/QH15 took effect on 1 January 2026, and Decree 30/2026/ND-CP of 21 January 2026 replaced Decree 21/2011/ND-CP. The list of key facilities is now issued by each provincial People's Committee before 31 March annually, no longer by the Prime Minister.

B11 carries a point many companies misread to their own disadvantage. The Law on Anti-Corruption sets two different levels of obligation: Article 79 requires every enterprise to adopt a code of conduct and internal control mechanism — self-regulatory, with no approving authority; whereas the stricter mandatory regime in Article 80 applies only to public companies, credit institutions, and certain social organisations that raise public contributions for charitable purposes. An ordinary manufacturing SME is not in that group. So for B11 what you need is an adopted internal code of conduct — not the heavy compliance dossier many questionnaires imply. Citation note: use the consolidated text 65/VBHN-VPQH of 23 March 2026, since the 2018 law has been amended three times, most recently by Law 132/2025/QH15 effective 1 July 2026.

The nine Comprehensive Module disclosures — C1 strategy and business model, C2 description of transition policies, C3 GHG reduction targets and climate transition, C4 climate risks, C5 additional workforce characteristics, C6 human-rights policies and processes, C7 severe negative human-rights incidents, C8 revenues from certain activities excluded from EU reference benchmarks, and C9 gender diversity in the governance body — are considerably heavier, because most are policies and targets rather than operating data. This is the group you can legitimately negotiate down if the customer is only collecting for their own sustainability report.

B3 is the only group that genuinely requires calculation capability, and the one EU customers probe hardest. We set out the Scope 1–2–3 method and boundaries separately in GHG inventory Scope 1-2-3 for SMEs; for this article, the point is that its inputs are twelve months of electricity bills, fuel purchase records, and transport data — all of which live in accounting, not engineering.

A technical detail worth real money: EU law pins specific versions of the emissions accounting standard. ESRS E1 — issued with Commission Delegated Regulation (EU) 2023/2772, Annex I — requires undertakings to "consider the principles, requirements and guidance provided by the GHG Protocol Corporate Standard (version 2004)" at AR 39, to use the Scope 2 Guidance version 2015 at AR 45, and the Scope 3 Standard version 2011 at AR 46. Build your inventory on exactly that trio and your figures slot straight into what your EU customer is obliged to use, sparing you a round of rework.

Two version warnings come with it. First, ISO 14064-1:2018 is not a substitute: AR 39 itself states that where an undertaking already applies the ISO 14064-1:2018 accounting methodology, "it shall nevertheless comply with the requirements of this standard (e.g., regarding reporting boundaries and the disclosure of market-based Scope 2 GHG emissions)". Do not let anyone tell you an ISO 14064-1 certificate closes the matter. Second, ISO 14064-1:2006 was withdrawn on 19 December 2018; the current edition is the 2018 one, and even that has been placed by ISO in the "to be revised" category. Consulting material still citing the 2006 edition is nearly eight years out of date.

The most commonly misunderstood point is that the Scope 2 definition in the 2004 edition is methodologically obsolete — the location-based versus market-based distinction only appears in the 2015 Scope 2 Guidance. Answering an ESRS-driven questionnaire using only the 2004 definition will almost certainly miss the market-based disclosure.

Which tool your customer scores you with: EcoVadis, CDP, SMETA

Direct answer: most EU customers do not read your answers themselves. They push you onto a third-party assessment platform, and the score there is what feeds the purchasing decision. Knowing in advance which platform scores what saves you an entire round of rework.

The three you are most likely to meet, and how they differ:

• EcoVadis — scores four themes: environment, labour and human rights, ethics, and sustainable procurement. The scale is 0–100 across five bands, from Insufficient (0–24) to Outstanding (85–100). Medals are awarded by percentile against all companies rated in the preceding 12 months — Bronze top 35%, Silver top 15%, Gold top 5%, Platinum top 1% — and a medal requires at least 30 points in all four themes, so you cannot carry a weak theme. One sentence from EcoVadis' own material deserves close reading: a medal or badge "is not a certification or product label", and results are valid for 12 months. Do not print it on your packaging.
• CDP — since 2024 it has merged its climate, forests and water questionnaires into a single integrated questionnaire of 13 modules. The climate content applies to every discloser; forests and water appear only where requested or self-selected. Mechanically, the buyer builds a request list on the CDP portal and you receive an email — identity is matched by DUNS number, so if your company does not have one, register early. Per CDP's statement of 8 January 2026, in the 2025 cycle "almost 45,000 suppliers were requested to disclose by 270 leading global corporate buyers".
• SMETA — weighted towards on-site audit rather than an online questionnaire, and the dominant standard in textiles, footwear and electronics. Sedex describes its scope as "comprehensive oversight across four key pillars: labour standards, health and safety, environment, and business ethics" (Sedex).

The exploitable commonality: all three draw on the same underlying dataset and merely package it differently. If you have built the 11 VSME Basic Module items, you have the raw material for all three. Conversely, treating each platform as a separate deadline sprint means paying three times for the same work — and usually producing three sets of numbers that do not reconcile, which is precisely the failure mode described below.

We have deliberately omitted EcoVadis' scale figures from this article. The reason is transparent: the figures for how many companies have been assessed differ between pages on their own website and none of them states an as-of date, which does not meet our citation bar.

Who owns which item: a split so it does not all land on one person

Direct answer: the most common organisational failure is handing the whole questionnaire to one person — usually the export-sales staffer, because they received the email. That is the surest route to a late, inconsistent submission, because the data sits across at least five departments.

An ESG questionnaire is not one department's job. It is cross-functional collection, and the person who received the email should act as coordinator, not author. The split below is what we use when deploying for manufacturing clients.

Table 3 — Ownership split by VSME disclosure group. This is GROW's organisational recommendation based on where the data actually originates, not a requirement of the standard.

Disclosure group	Lead department	Supporting	Why it sits there
B1 — Basis for preparation	Legal / Admin	Management board	Needs an accurate entity map and site list
B2 — Policies and initiatives	Management board	HR, Production	A company-level commitment; cannot be delegated down
B3 — Energy and emissions	Accounting	Engineering / Utilities	Source data is invoices and purchase records, not meters
B4, B6 — Pollution and water	HSE	Engineering	Overlaps the environmental permit file already maintained
B5 — Biodiversity	HSE	Admin	Mainly locating sites and checking against zoning
B7 — Waste and circularity	HSE	Warehouse, Purchasing	Waste transfer manifests are already retained by law
B8, B9, B10 — Labour	HR	Trade union, HSE	The largest volume, and it sits entirely in HR
B11 — Corruption and bribery	Legal	Management board	Requires reviewing penalty records and signing off
All — coordination, review, submission	Email recipient (Export/Sales)	Everyone	Holds coordination and the customer-facing dialogue

The most notable line is that B3 belongs in accounting, not engineering — which runs against most companies' instinct. The reason is simple: emissions accounting uses activity data — kWh purchased, litres of fuel purchased, tonnes shipped — and those exist as auditable accounting documents, not as operational notes. Assigning it to engineering typically leads to weeks of meter-reading that produces a number which does not reconcile to the invoices and cannot be assured.

Sequence: four steps, and why reordering means doing it twice

Direct answer: done in the right order, each piece of data is collected once and serves every customer. Done in the wrong order — filling in the questionnaire first, defining scope afterwards — every new customer becomes a fresh measurement exercise.

The four steps below have a mandatory order, and each reason is practical rather than formal.

• Step 1 — Classify the request and self-declare your size. Establish which mechanism in Table 1 the questionnaire belongs to, then issue a headcount self-declaration if you are below the 1,000 threshold. Do this first because it determines how much of the questionnaire you actually owe. Skipping it means volunteering for more than your obligation.
• Step 2 — Fix the organisational boundary and reporting period. Which legal entity, which sites, which period. This must precede data collection, because changing the boundary afterwards means recollecting everything. Choose a period matching your financial year so you can reuse accounting documents.
• Step 3 — Harvest what exists before measuring what does not. Pull out every "already held" row from Table 2 first. This usually fills most of the questionnaire and shows you exactly what is missing, instead of measuring indiscriminately.
• Step 4 — Calculate emissions and draft the policy items. Only now tackle B3 and draft B2. They go last because they are the most effort-intensive and their scope depends on the outcome of the three steps above.

There is a financial consequence hidden in Step 2. If you align the reporting period to your financial year and the boundary to your legal entity, the same dataset can be reused for green credit applications and for other customers' requests without redoing the work. Misalign them and each purpose needs its own set of numbers. We discuss choosing a reporting framework in ESG reporting with GRI and ISSB for SMEs.

Which variables drive the timeline, and why nobody can quote you a number of days

Direct answer: anyone quoting you a fixed number of days without seeing your files is guessing. The duration of this work depends barely at all on the difficulty of the questionnaire — it depends almost entirely on the state of your existing data.

We publish no day count here, because no organisation publishes a verifiable benchmark for this kind of work and an invented figure would make you plan badly. What helps more is the list of variables — score your own company against the five below and you will estimate more accurately than any average could.

Table 4 — Five variables that drive preparation time. This table deliberately gives no day counts; it ranks influence so a company can estimate for itself.

Variable	Easy case	Hard case	Influence on timeline
Twelve months of electricity and fuel invoices	Complete, in digital form	Months missing, paper only, must request from the utility	Highest — usually the critical path
Number of sites and legal entities	One plant, one entity	Several plants, outsourced processing	High
Environmental files	Valid permit, complete monitoring	Permit expired or never obtained	High — may require fixing compliance first
Named owner	Someone formally assigned	Part-time role with no authority to demand data	Medium to high
Scope the customer requests	Basic Module only	Comprehensive plus third-party verification	Medium

Of the five, the first is almost always the critical path, for a mundane reason: many Vietnamese plants do not store electricity bills centrally, some periods survive only on paper, and requesting historical consumption data from the utility takes time outside your control. If you do only one thing after reading this article, go and assemble twelve months of electricity bills and fuel purchase records — before you even know what the customer will ask.

Five mistakes that get a submission sent back

Direct answer: submissions are rarely rejected for bad numbers. They are rejected for numbers that cannot be reconciled, that carry no stated scope, or that contradict each other across sections.

• No reporting period stated. An emissions or consumption figure without its period is meaningless to an assessor. Every number must state the exact dates it covers.
• Different boundaries per item. Energy covers both plants, labour covers one. This is the most frequently caught error under cross-review.
• Presenting a collective labour agreement as an obligation. The Labour Code does not require an enterprise to conclude one — it is the outcome of collective bargaining, and only once signed does a duty arise to file a copy within 10 days. The correct answer here is "voluntary, none currently in place" if you have not signed one, rather than declaring yourself non-compliant.
• Answering "not applicable" without explanation. For a disclosure like B5 biodiversity, the correct answer states the site location and the basis for irrelevance — not a blank.
• Commitments with no plan behind them. Writing "working towards carbon neutrality" with no date, scope or measurement method invites the next question — and in the EU carries legal risk around environmental claims.
• Answering beyond what you know. Entering a rough Scope 3 figure for completeness instead of stating that it has not been calculated. A wrong number is worse than a blank, because it undermines the credibility of the whole file.

Staying the right side of greenwashing when you answer

Direct answer: every environmental statement in a file sent to an EU customer is a statement with consequences. The safe rule is to claim only what you measure, and always state the scope.

Three rules you can apply immediately:

• Avoid absolute words. "Environmentally friendly", "green" and "sustainable" standing alone are unverifiable. Replace them with a figure and a scope: reduced by how much, against which period, measured how.
• Separate "done" from "planned". These belong in different sections. Mixing them is the fastest way for a future commitment to be read as an achieved result.
• State the scope and validity of every certificate. A certificate covering one production line is not a certificate for the whole plant. We analyse how to read and use these labels in green labels and anti-greenwashing for SMEs.

In-house or consultant: four questions to decide for yourself

Direct answer: most of the Basic Module is work a company should do itself and retain the capability for, because the data is yours and it must be refreshed annually. External help pays off most clearly in two places: the first emissions calculation, and reading the scope of your legal obligations correctly.

Four questions you can answer without any consultant:

• Have you formally assigned an owner? If not, assign one before hiring anyone. Without an internal focal point, a consultant cannot extract the data either.
• Has the customer set a deadline, and how far away is it? A tight deadline with unprepared data is the clearest case for outside help.
• Is this your first such request, or your third? By the second or third, doing it manually from scratch each time is a process problem, not a headcount problem.
• Are you in a CBAM or EUDR sector? If so, that part is a condition of market access rather than an optional question, and errors there cost considerably more.

GROW approaches this through the GROW Green Pathway methodology — four phases covering materiality, baseline data, roadmap, then reporting and improvement — with the explicit aim of building internal capability so the company can run it alone afterwards rather than depending on a consultant indefinitely. Scope and service packages are set out on the Green Transition Advisory page, and CBAM and EUDR compliance files on the Markets & Exports page. If you have just received a questionnaire and cannot tell which mechanism in Table 1 it belongs to, send the details to the GROW team — classifying the request is the shortest step and the one that determines how much work remains.

Which deadlines are live, and which are dead

Direct answer: this is a field where old material is more dangerous than no material. In the past twelve months alone, all three major EU regimes were amended, and most Vietnamese-language articles in circulation still cite superseded dates.

Table 5 — Live versus superseded thresholds and dates, as at 5 August 2026. Checking currency before citing is mandatory.

Item	LIVE threshold / date	DEAD threshold / date	Superseding instrument
Threshold for EU sustainability reporting	>EUR 450m and >1,000 employees	Lower thresholds under the 2022 CSRD	Directive (EU) 2026/470, in force on the 20th day after publication on 26/02/2026
Threshold for EU supply-chain due diligence	>5,000 employees and >EUR 1.5bn	>1,000 employees and >EUR 450m	Directive (EU) 2026/470, Article 4
EUDR — large and medium operators	30/12/2026	30/12/2025	Regulation (EU) 2025/2650, in force 26/12/2025
EUDR — micro, small and individuals	30/6/2027	30/6/2026	Regulation (EU) 2025/2650 (replaced all of Article 38)
EUDR — cut-off for micro/small status	Established before 31/12/2024	Established before 31/12/2020	Regulation (EU) 2025/2650
CBAM — certificate sales begin	01/02/2027	01/01/2026	Regulation (EU) 2025/2083
CBAM — first certificate surrender (for 2026)	30/9/2027	—	Regulation (EU) 2025/2083
CBAM — exemption threshold	50 tonnes cumulative per year	EUR 150 per consignment	Regulation (EU) 2025/2083, Article 2a and Annex VII
Vietnam annual environmental report deadline	Before 15/01 of the following year	Before 05/01	Circular 07/2025/TT-BTNMT of 28/02/2025

CBAM carries one misconception common enough to isolate. The definitive period starting on 1 January 2026 does not mean certificates must be surrendered during 2026. What begins then is the EU importer's obligation to obtain declarant status and track emissions; certificates only go on sale from 1 February 2027, and the first declaration and surrender are both due 30 September 2027 for the 2026 year. For a Vietnamese supplier the practical consequence is: you have until Q3 2027 to finalise emissions data, but your customer will ask you during 2026, because they must track from now. Without your figures they apply default values — usually worse than your real ones.

A further note on the nature of the 50-tonne threshold: it is dynamic by design. Article 2a(3) obliges the Commission to review it before 30 April each year and adjust it by delegated act where it deviates by more than 15 tonnes from the level required. As at 5 August 2026 no adjusting act has been made, so 50 tonnes stands — but do not embed it in internal procedures as a permanent constant.

Finally, something that is not yet law, and be wary of anyone who says otherwise: the proposal to extend CBAM to downstream goods (COM(2025) 989, procedure 2025/0419(COD)) is still only a proposal. The Council agreed its position on 12 June 2026; the European Parliament has not voted. Any circulating figures on downstream product counts or application dates carry no legal force. We cover CBAM in more depth in CBAM explained and a compliance guide for Vietnamese SMEs exporting to the EU.

An ESG questionnaire from an EU customer is not a test of how green your company is — it is a test of how well organised your existing records are; and since March 2026 a Vietnamese supplier with fewer than 1,000 employees holds a statutory right to decline questions beyond the VSME standard when those questions serve the customer's sustainability reporting, but holds no such right when they serve supply-chain due diligence, a CBAM filing or an EUDR filing.