Capline ESG questionnaires, answered once. For smaller businesses serving large customers.
Reference · sources verified 13 August 2026

Every framework that reaches a smaller UK business.

There is no single ESG rulebook for UK SMEs. There are a dozen, they arrive from different directions, and they carry very different consequences — from losing a tender on a technicality to a request you are entitled to refuse.

Grouped below by how hard the obligation bites. The underlying data barely changes: energy, fuel, waste, fleet, headcount. What changes is the wrapper, the threshold and the deadline.

Bidding for public contracts

Hard obligation

The sharpest end, and the one smaller suppliers most often underestimate. These are not scored preferences — several are pass/fail gates applied before anyone reads your pricing. Public procurement is also fully transparent, so the requirement is visible in the notice before you bid.

PPN 006 — Carbon Reduction Plans

Formerly PPN 06/21 · renamed 24 February 2025 under the Procurement Act 2023
In force
Who it hits
Central government departments, their executive agencies and non-departmental public bodies must apply it when awarding contracts with an estimated value above £5 million per year including VAT, averaged over the life of the contract. It applies to procurements advertised on or after 24 February 2025. Separately, the NHS applies a Carbon Reduction Plan requirement to all new procurements regardless of value.
What it asks
A published Carbon Reduction Plan in the prescribed format: Scope 1, Scope 2 and specified Scope 3 categories, a baseline year and current year footprint, a commitment to net zero by 2050, and named carbon reduction projects. Signed off at board or equivalent level and hosted on your website.
Consequence
Applied as a condition of participation when assessing technical ability — effectively pass/fail. A missing or non-compliant plan removes the bid from consideration before anyone reads your pricing.
Cadence
Refreshed at least annually. This is a recurring obligation, not a one-off document.

NHS Evergreen Sustainable Supplier Assessment

NHS England's supplier sustainability reporting platform
Since 6 Apr 2026
Who it hits
Suppliers bidding for NHS Supply Chain frameworks, and suppliers bidding for NHS England Medicines Value and Access tenders. Any supplier to NHS England, an integrated care board or an NHS trust in England can complete it, and other NHS suppliers are encouraged to.
Level 1
The entry level, and the one that matters commercially. It requires a published Carbon Reduction Plan aligned to PPN requirements, a UK net zero commitment with a target year of 2050 or earlier, and reporting of Scope 1, Scope 2 and a subset of Scope 3 on a UK boundary, following the GHG Protocol, signed off at board level, and published within 12 months of your assessment submission.
Levels 2 to 4
Level 2 moves you to a global boundary covering all relevant Scope 3, aligning with the April 2027 roadmap milestone. Level 3 requires a 2045 target that is independently validated, plus the Modern Slavery Assessment Tool and a public modern slavery statement. Level 4 adds the global parent company and requires recognition as a high performer through CDP, EcoVadis or B Corp.
Consequence
Since 6 April 2026, suppliers submitting NHS Supply Chain tenders must have achieved Level 1 at the point of tender close — a shift from the previous position, where any submission level was accepted. It is a requirement to bid rather than something scored in evaluation.
Worth knowing
Evergreen is one of NHS Supply Chain's Five Supplier Asks, alongside a Carbon Reduction Plan, social value, horizon scanning and modern slavery prevention. Reaching Level 1 does not replace any of the others. The maturity criteria were updated in April 2026, the assessment is hosted on Atamis, and your score is valid for 12 months.

NHS Net Zero Supplier Roadmap

Statutory guidance · milestone update published 9 June 2026
2027 · 2028 · 2030
Who it hits
Any supplier of goods, services or works to the NHS. The NHS has committed to net zero by 2040 for the emissions it controls directly and 2045 for those it influences through what it buys — which is why the requirements land on suppliers. The 2027 milestone is applied proportionately; legal commentary on the guidance indicates it applies to new procurements above £5m a year including VAT and to new framework contracts where proportionate, which is worth confirming against the guidance for your own contracts.
Already in force
Since April 2023, new contracts above £5m a year require a published Carbon Reduction Plan covering UK Scope 1 and 2 and a subset of Scope 3. Since April 2024 that requirement has been proportionately extended to cover all new procurements. Since April 2022, all NHS procurements have carried a minimum 10% weighting for net zero and social value combined.
April 2027
Suppliers must publicly report targets and emissions, and publish a Carbon Reduction Plan covering all relevant global Scope 1, 2 and 3 emissions. This is the biggest practical jump: the current tier requires only a defined subset of five Scope 3 categories, and that subset is removed. The boundary also widens from UK operations to global operations.
April 2028
New requirements are expected covering carbon footprinting of individual products supplied to the NHS, with scope and methodology to be determined with suppliers and regulators.
From 2030
Suppliers will only be able to qualify for NHS contracts if they can demonstrate progress through published progress reports and continued emissions reporting.

PPN 002 — Social Value

Published February 2025, replacing PPN 06/20
In force
Who it hits
Central government departments, their executive agencies and non-departmental public bodies. It does not apply to below-threshold contracts, private utilities contracts, or Ministry of Defence security and defence contracts. In-scope bodies have had to apply it to procurements commenced on or after 1 October 2025, following a transition window that opened on 24 February 2025.
What it asks
Specific, measurable and time-bound social value commitments selected from the PPN 002 Social Value Model — local employment, skills and training, support for smaller businesses in your own supply chain, environmental benefit and community outcomes. Commitments are written into the contract as terms or KPIs and reported on during delivery.
Consequence
Scored rather than pass/fail, but material: in-scope organisations must apply a minimum 10% weighting of the total score to social value. Many buyers go higher.
Worth knowing
The NHS applies its own long-standing minimum 10% weighting covering net zero and social value together, in place since April 2022. The two are related but not the same requirement.

Modern Slavery Assessment Tool (MSAT)

Government-provided supplier assessment
Increasingly required
Who it hits
Public sector suppliers, and NHS suppliers seeking Evergreen Level 3 and above, where MSAT completion is a stated criterion.
What it asks
An assessment of your policies, due diligence, training and remediation arrangements for modern slavery risk in your own operations and supply chain.
Worth knowing
Separate from the Modern Slavery Act statement obligation, which applies above a turnover threshold. Smaller suppliers are often asked for MSAT even where the statutory statement does not apply to them. Government policy on modern slavery in public supply chains sits in PPN 009.

Cascaded by large customers

Contractual obligation

No statute behind these — but a buyer who sets a minimum score and means it can cost you the account, not just one tender. They are also the most time-consuming to complete, because each platform wants your data in its own structure.

EcoVadis

Third-party sustainability rating used across global supply chains
Buyer-driven
Who it hits
Suppliers to automotive, pharmaceutical, chemicals, electronics and consumer goods companies. Common wherever a customer has European operations.
What it asks
A detailed assessment across environment, labour and human rights, ethics and sustainable procurement — supported by uploaded evidence documents rather than self-declaration alone. Produces a scorecard and, above thresholds, a medal.
Consequence
Buyers set minimum scores for new and existing suppliers, with remediation required below a floor. Reassessment is typically annual.
Where it bites
The evidence burden. The questions are answerable; assembling documentation that supports each answer is what consumes the time.

CDP Supply Chain

Climate and environmental disclosure requested by corporate buyers
Buyer-driven
Who it hits
Suppliers to large disclosing companies. CDP reports that around 45,000 suppliers were asked to disclose by 270 corporate buyers in 2025.
What it asks
Emissions data, climate governance, targets, risk assessment and reduction activity, submitted through CDP's questionnaire on the buyer's timetable.
Consequence
Contractual and relational. Buyers increasingly track supplier response rates and data quality as procurement metrics.
If you are small
CDP runs a shorter, climate-focused SME questionnaire for companies with 1,000 or fewer employees and annual revenue at or below US$250m. A supplier requested only by a Supply Chain member is not charged CDP's administration fee — the requesting buyer pays for membership.

Bespoke customer questionnaires

Main contractors, retailers, manufacturers — each with their own form
Ongoing
Who it hits
Almost every supplier to a large organisation, eventually. Usually issued through a procurement portal with a short deadline.
What it asks
Whatever that customer's own reporting team needs — normally a subset of the same energy, emissions, waste, workforce and governance data, in a format unique to them.
Where it bites
This is the case for capturing once. The tenth questionnaire asks substantially what the first one asked, in a different order, with different units.

UK statutory reporting

Scope-dependent

Mostly aimed above the SME threshold — which is exactly why they reach you. A company that must report its own value chain emissions has to get the numbers from its suppliers.

SECR — Streamlined Energy and Carbon Reporting

Energy and emissions disclosure in annual reports
If in scope
Who it hits
All UK quoted companies whatever their size, plus large unquoted companies and LLPs. 'Large' here means meeting at least two of three tests: turnover of £36m or more, balance sheet total of £18m or more, or 250 or more employees.
The trap worth knowing
Those thresholds sit inside the SECR regulations themselves and were not changed when the Companies Act size limits were uplifted in April 2025. A company that has just been reclassified from large to medium-sized for its accounts can still be in scope for SECR on the old test. If your auditor has told you that you are no longer large, that is not the same as being out of SECR.
What it asks
Within the directors' report: total energy use in kWh, Scope 1 and Scope 2 emissions, at least one intensity ratio, the methodology used, prior-year comparatives, and a narrative on energy efficiency measures taken.
Why it reaches you
Customers who are in scope need supply chain data to complete their own disclosures, so for most smaller suppliers the requirement arrives as a questionnaire rather than as a legal duty. Organisations using 40,000 kWh or less a year can make a simplified low-energy-user disclosure.

ESOS — Energy Savings Opportunity Scheme

Mandatory energy assessment on phased compliance periods
If in scope
Who it hits
An organisation qualifies if, on the qualification date, it employs 250 or more people in the UK, or has both an annual turnover above £44m and a balance sheet total above £38m. Group aggregation applies: if any UK entity in the corporate group qualifies, the whole UK group is in scope. That last rule catches smaller companies inside larger groups more often than people expect.
The date that matters
Phase 4 qualification is assessed on 31 December 2026, with the compliance notification deadline on 5 December 2027. Your size on the qualification date determines four years of obligation, and nothing you do afterwards changes it.
Note the difference
The ESOS test is not the SECR test. ESOS is employees or both financial thresholds, at £44m and £38m. SECR is two of three, at £36m, £18m and 250 employees. A business can be caught by one and not the other, which is a common source of confusion.
Why it matters to you
The energy data ESOS requires overlaps heavily with what every other framework asks for — capture it once and it serves several purposes at the same time.

UK SRS S1 and S2

UK Sustainability Reporting Standards, published 25 February 2026
Voluntary for now
Status
Published by the Department for Business and Trade on 25 February 2026, endorsing the ISSB's IFRS S1 and S2 for UK use with six UK-specific amendments. Available now for any entity to adopt voluntarily. No company is legally required to apply them today.
Direction of travel
The FCA consulted through CP26/5, published 30 January 2026 and closed on 20 March 2026, proposing to replace its existing TCFD-aligned listing rules with UK SRS requirements for in-scope listed companies. The FCA aims to publish a Policy Statement in autumn 2026, with rules coming into force from 1 January 2027.
Who that catches
Roughly 500 UK-listed companies, identified by listing category rather than by any size test. Private companies are not in mandatory scope; the government has said it will consider extending reporting to large private companies as part of a wider review.
What to do now
Nothing urgent if you are a smaller supplier. Worth watching, because listed companies have suppliers — and this is the most likely route by which climate reporting becomes a normal condition of UK trade.

EU rules reaching UK suppliers

Shield and sword

Two very different things. One is a ceiling that protects you. The other is a due diligence obligation that lands on you directly if you export the wrong commodity.

The EU Voluntary Standard (formerly VSME)

The value chain cap on what CSRD reporters may demand
Your shield
What it does
Sets a ceiling. Entities reporting sustainability information under Articles 19a and 29a of Directive 2013/34/EU are prohibited from requiring information beyond the limits of this standard from undertakings in their value chain that do not exceed an average of 1,000 employees. The delegated act calls those businesses 'protected undertakings'.
How it got here
EFRAG delivered the VSME standard on 17 December 2024. The Commission adopted it as a non-binding Recommendation on 30 July 2025. Directive (EU) 2026/470 (Omnibus I) then gave it a second function as the value chain cap, and the Commission adopted the binding delegated act, C(2026) 5011 final, on 3 July 2026. This is why some advisers now call it the Voluntary Standard, or VS, rather than VSME.
What it contains
A Basic Module and a Comprehensive Module covering energy, emissions, pollution, water, waste, workforce and governance — roughly 140 datapoints in total, far fewer of which will apply to any individual business.
Where the cap does not help
It is not a blanket shield. Scope 3 emissions, climate transition plans and climate-risk disclosures sit in the Comprehensive Module rather than the Basic Module, so a CSRD-reporting customer may still be able to ask for them. The cap also says nothing about UK public procurement requirements or a private customer's contractual terms.
Check first
Delegated acts of this kind typically enter into force some months after adoption, and the timing matters if you intend to rely on the cap. Confirm the current position — and your own employee count against the threshold — before declining a specific customer request.

EU Deforestation Regulation (EUDR)

Due diligence on commodities placed on the EU market
Dec 2026 · Jun 2027
Who it hits
Businesses dealing in timber, wood products, paper, packaging, rubber, cattle, cocoa, coffee, soy and palm oil, or products derived from them, where those goods reach the EU market. It applies based on the product's destination, not the supplier's location — so UK exporters are caught.
Timing
Regulation (EU) 2025/2650, adopted in December 2025, set the application dates: 30 December 2026 for large and medium operators and traders, and 30 June 2027 for micro and small operators outside the timber sector. In May 2026 the Commission published a simplification package and confirmed there would be no further postponement.
What it asks
Traceability back to the plot of land, a risk assessment, and a due diligence statement. Simplified obligations apply to smaller operators and to downstream traders, who mainly need to collect and retain supplier details and due diligence statement references.
Check first
The revision introduced a new 'downstream operator' category with lighter obligations, and a draft delegated act on product scope was still in progress during 2026. Confirm your own role — operator or trader, upstream or downstream — and check whether your specific products are in scope before acting.
How to use this page

Written to be checked, not believed.

Every claim on this page was checked against the body that sets the requirement on 13 August 2026, and the sources are listed opposite. That does not make it advice, and it does not make it permanent: framework thresholds, dates and scope have all moved in the last eighteen months and will move again. Go to the source before you act — and particularly before declining anything a customer has asked for.

If you are unsure which of these apply to your business, that is usually answerable in a short conversation. It depends on who you sell to, whether you bid for public work, and whether anything you make reaches the EU.

Primary sources

  • PPN 006 and PPN 002, Cabinet Office, GOV.UK
  • NHS England — Greener NHS supplier roadmap and Evergreen maturity criteria
  • NHS Supply Chain — April 2026 Evergreen requirement
  • Directive (EU) 2026/470 and delegated act C(2026) 5011 final
  • Regulation (EU) 2023/1115, as amended by Regulation (EU) 2025/2650
  • SI 2018/1155 (SECR) and SI 2014/1643 (ESOS)
  • DBT UK SRS S1 and S2; FCA CP26/5
  • CDP Supply Chain programme documentation
Free guide

Start with the one that lets you say no.

The Value Chain Cap Checker covers the EU ceiling in plain English: what a CSRD-reporting customer can require from you, what falls outside it, and — honestly — where the cap gives you no protection at all.

Get the free guide ← Back to homepage