Supplier verification for sustainability: what it is and how it works

If your client has asked for "supplier verification" in the context of sustainability, it sounds more daunting than it is. They're not asking for a formal audit. They're asking for structured, documented evidence that your business meets a baseline of environmental and social standards.

The reason: large European companies are legally required under the CSRD to report their scope 3 emissions and sustainability risks — and up to 80% of those risks sit in their supply chains. Your data is what makes their report complete. Without it, they're estimating. With it, they have primary data — the highest quality classification under ESRS E1.

What "verified" means in this context

Supplier verification in the CSRD context does not mean an external auditor comes to your premises. It means your data is self-reported but structured — collected according to a recognised standard, not a bespoke questionnaire. It is documented — you can show where each number came from (invoice, HR system, meter reading). And it is consistent — reported using the same methodology year over year, so trends are meaningful.

The European Commission formalised this in July 2025 by officially recommending the VSME (Voluntary Sustainability Reporting Standard for SMEs) as the framework for exactly this purpose. Since 3 July 2026 that recommendation has been superseded by the VS Standard, which became EU law as Delegated Regulation (EU) C(2026) 5011 (see also: what the VS Standard replaces and what has changed). A completed VS profile is therefore the recognised form of supplier verification under EU regulation.

Supplier verification versus a supplier audit

An audit is an independent on-site investigation. An auditor visits the supplier, inspects processes, speaks to staff, and establishes whether reality matches the claims. That costs €2,000 to €10,000 per supplier and several weeks of preparation.

Supplier verification is the standardised collection and checking of self-declarations. The supplier enters its data in a prescribed format. The buyer receives that data and can compare it, archive it and report on it. No site visit, no high costs.

For CSRD scope 3 reporting, verification is sufficient in most cases. An audit is only needed where there is a specific risk, or where a certification body explicitly requires one.

The practical difference lies in what gets recorded. An audit produces a third-party judgement; verification produces traceable data. For the accountant auditing your client, the second matters most: can every figure be traced back to an invoice, a meter reading or a payroll system, and is the emission factor used recorded with its source and year? That is exactly what a VS profile documents.

What data your client needs from you

The VSME basic module covers seven areas. These are the data points your client can legitimately request: B1 — company basics (name, legal form, sector by NACE code, number of employees, locations). B2 — environmental and social risks: a short qualitative description of your main risks and how you manage them. B3 — energy and emissions: total energy consumption in MWh, split between electricity and gas, plus scope 1 and scope 2 CO₂ emissions in tonnes. B4 — water: total water consumption in m³. B5 — waste: total waste in tonnes and your recycling rate. B6 — workforce: FTE count, absence rate, training hours per employee, workplace incidents. B7 — policies: whether you have a code of conduct, an anti-corruption policy and a complaints channel.

Most of this data already exists in your business: your energy invoices, your payroll system, your waste contractor's annual report. The challenge isn't collecting it — it's organising it into a format your client can use.

What you're legally entitled to refuse

Under the EU Omnibus rules (Recommendation EU 2025/1710), suppliers with fewer than 1,000 employees have a legal right to refuse data requests that go beyond the VSME standard. This is the value chain cap.

If your client asks for a full life cycle analysis (LCA), detailed scope 3 calculations from your own suppliers, or proprietary production data not covered by the VSME, you can politely decline. Reference the EU recommendation in writing if needed.

How to make verification easy for future requests

The inefficiency isn't the first questionnaire — it's the fifth, from five different clients, each with a different format. The solution is a single verified profile that you build once and share with anyone who requests it.

verified.supply builds your VSME profile once, stores your data with a full audit trail, and automatically delivers it to any client who sends a request. Sign up for early access at verified.supply.

Are you a buyer? Here's how to request structured supplier data

As a buyer or sustainability manager at a CSRD-reporting company, you're probably looking for a way to assess your suppliers in a structured way — and actually use that data in your ESRS E1 disclosure.

The problem with custom forms and Excel templates is twofold: the data you receive back is inconsistent (everyone fills in something different), and you have no audit trail your auditor can accept.

verified.supply solves this from the other side. Your suppliers build their VSME profile once on the platform. You invite them via a request link and receive standardised, primary data — complete with calculation documentation and a verification code — directly importable into your own CSRD reporting tool.

Sign up for early access as an enterprise buyer at verified.supply.