You have spent two years preparing for CSRD. And the first environmental data request that broke your calendar did not come from a regulator. It came from a cosmetics group with 90,000 employees.
This is the shift we have been seeing for months: the pressure no longer flows from Brussels to your finance team. It flows from your most important customer to your sustainability lead, with a one-week deadline and a template you have never seen before.
And unlike regulation, customer ESG data requests cannot be postponed.
The conversation already happening
This week, in a meeting that started like any other, an ESG director told us:
“We are signing a lot of commercial contracts with a cosmetics group of 90,000 employees, a tech platform of 220,000 employees and a global retailer of 2 million employees, and they ask us for everything: environmental KPIs, our footprint, CDP reporting. And this is where we realised we say we do many things, but then we have no control over our data and we have to start from zero every time we need to answer with the KPIs they ask for.”
That sentence captures the change. The new ESG regulator is not the SEC, ESMA or the CNMV. It is the procurement team of your largest customer.
You are inside their perimeter, whether you know it or not
The large companies that report under CSRD have to measure Scope 3, the emissions of their value chain. And their value chain is you.
This happens with or without Omnibus. Directive 2026/470 raised the threshold to 1,000 employees and 450 million euros, so fewer companies report directly. But the ones that still report, the ones moving the big contracts, still need data from their suppliers. Your data.
On top of that, in Spain RD 214/2025 already forces companies to calculate and register their carbon footprint from this year. Suppliers to obligated companies must hand over the number, not just say they are working on ESG. Similar pressure is building under Germany’s LkSG and the EU Corporate Sustainability Due Diligence Directive (CSDDD).
The problem is not what you have, it is how you have it
You probably already have pieces in place:
- An SBTi commitment.
- A CDP questionnaire filled in last year.
- An EcoVadis rating.
- An annual ESG report on your website.
When the concrete request lands (“I need the electricity consumption of your Burgos plant in kWh, with the emission factor you used and its source”) you discover that you do not have it in one place. You have it in an operations email, in a PDF from the energy provider, in a spreadsheet that was last updated four months ago, and in another one that nobody remembers maintaining.
That is the difference between declaring and controlling. Most companies declare. Very few control. And when your customer asks about traceability, the declaration does not cut it.
| What you already have | What the customer actually needs to see |
|---|---|
| SBTi membership | kWh consumption per facility, with source invoice |
| CDP filing 2024 | Emission factor used and its origin |
| EcoVadis score | Scope 1 and 2 split, location based and market based |
| Annual ESG report | % renewable energy contracted, with certificates |
Declare vs control: a declaration says "we are working on it." Control means you can hand over the number, the source invoice, the conversion factor and the date it was last updated, in less than an hour.
What they ask today, and what is coming next
This is what shows up today on supplier forms:
- Energy consumption per site, in kWh.
- Emission factor used and its source.
- Scope 1 and Scope 2 split, with location based and market based methodologies.
- Percentage of renewable energy contracted, with certificates.
- Carbon intensity per unit produced or per euro of revenue.
This is what is starting to appear:
- Life Cycle Assessment (LCA) of the products you sell to that specific customer. A Head of ESG at an industrial multinational told us recently: “We make different products, some in metal, others in catalogue with many variants. Let’s start with my plant and I will then take it to the rest so each one prices their part.” That is not regulation. That is a customer preparing because they know that in 12 months, they will be the ones asked.
If you cannot answer this when the email arrives, you are already late.
See how Dcycle keeps Scope 3 supplier data audit-ready, without rebuilding the same Excel from scratch every year.
Book a demoWhy Excel stops working this year
Until now, the pattern was: one questionnaire per year, copy-paste, send and come back next year.
What is happening now is different:
- Every customer has its own template, and every template asks for the data in a different format.
- External verifiers ask for traceability: source invoice, conversion factor used, last update date. If you do not have it, the number does not count.
- The frequency has changed. Some customers now ask for quarterly updates.
- If in six months an external auditor asks you to reopen last year’s number, your Excel cannot remember which version it used.
Excel is not the villain. The villain is not having a single place where the data lives, updates and can be defended in front of an external verifier.
What you actually need
Not another report. The data itself.
When the data lives in a single source, with invoices connected, factors updated and traceability by default, what comes out the other side is whatever format each customer asks for. CDP, EcoVadis, the internal supplier form of a 90,000-employee cosmetics buyer, the SBTi update, the mandatory carbon footprint under RD 214/2025. They all drink from the same well.
This is exactly what we built Dcycle’s automated data collection and operational intelligence layer for. One source of truth, governed evidence, and a multi-framework export that does not require you to start over each time the inbox rings.
The side effect is what surprises teams the most when they see it for the first time: the same data you use to answer your customer also informs business decisions. Which site has the most upside, which raw material moves the LCA of a product, where you are paying for energy that is both expensive and carbon intensive.
That is no longer ESG. That is management information. As one customer put it after seeing this, “Dcycle stops being just a cost.”
The next email is already written
Your next important customer is going to ask for their Scope 3 data. It will arrive by email, without warning, with a new template and a one-week deadline.
The question is not whether it arrives. It is whether you arrive with the data, or with explanations.
Stop reopening the same wound every year. See how to set this up once and answer every customer with one source of truth.
Book a demoFAQ
Are we still in scope after Omnibus and Directive 2026/470?
Directly, perhaps not. The new threshold is 1,000 employees and 450 million euros in revenue, so many mid-sized companies will not report under CSRD anymore. But Scope 3 obligations on the companies that do report mean their suppliers, you, are still asked for the same data. The reporting boundary moved up; the data demand did not.
What is the difference between location-based and market-based Scope 2?
Location-based reflects the average emission intensity of the grid where you operate. Market-based reflects the actual contracts you have signed for renewable energy or guarantees of origin. CSRD and most large customers now ask for both, in parallel, because each tells a different story about your decarbonisation path.
Do we need to provide LCA data already?
For most suppliers, not yet on every product. But customers with material Scope 3 categories (cosmetics, automotive, retail, food) are starting to request product-level LCAs as part of supplier onboarding. Treat the first request as a signal and start with your highest-revenue product line.
How does this connect with RD 214/2025 in Spain?
RD 214/2025 makes calculating and registering your carbon footprint mandatory in Spain from this year for a wider set of companies. If you supply to a CSRD reporter, the footprint your customer needs and the footprint MITECO requires from you are essentially the same dataset. One source, two outputs.