Sustainability Report for SMEs: What It Is, Who Needs It and How to Start in 2026

A sustainability report is a structured document that describes, in a measurable and verifiable way, a company's environmental, social and governance impact, its objectives and the strategies to achieve them. With the entry into force of the Omnibus I Directive (EU 2026/470) on March 18, 2026, in Italy only companies with more than 1,000 employees and more than €450 million in net turnover are required to report — a pool estimated at around 1,400 companies according to Accountancy Europe. The vast majority of Italian SMEs are outside the direct obligation. That does not mean they can ignore the issue.

Three factors make the sustainability report a strategic choice even for non-obligated SMEs: banks have required it since January 2026 for credit assessment, large companies are requesting ESG data from their supply chain suppliers, and the market rewards companies with structured ESG data with a credit approval rate 11% above average (CRIF, H2 2023). Understanding how it works, what it contains and what it costs is the starting point.

Sustainability report and non-financial declaration: the differences

The non-financial declaration (NFD), introduced by Directive 2014/95/EU and transposed in Italy by Legislative Decree 254/2016, was limited to public interest entities with more than 500 employees. It had a flexible structure, no mandatory standard and less stringent verification. The CSRD supersedes it entirely, expanding the scope from around 11,000 to potentially 50,000 companies across Europe in its original version, later drastically reduced by the Omnibus I.

The sustainability report in the form required by the CSRD is no longer a separate document but a dedicated section of the management report, integrated into the financial statements and subject to independent review. It requires double materiality analysis and more than 1,100 data points organised across the 12 ESRS standards. The XHTML digital format is required from the start of the obligation, with the marking requirements to be defined by the Commission in the ESRS revision delegated act expected in September 2026.

The VSME is the simplified version of the sustainability report for SMEs. It is what most Italian SMEs can and should adopt today as a starting point, while the regulatory framework consolidates.

The regulatory framework updated to March 18, 2026

The regulatory framework is structured across three levels that have overlapped over the past two years.

The CSRD (Directive EU 2022/2464), transposed in Italy by Legislative Decree 125/2024, redesigned the sustainability reporting obligation by greatly expanding it compared to the old NFD. It introduced the ESRS standards (Delegated Regulation EU 2023/2772), double materiality and mandatory assurance.

The Stop the Clock Directive (EU 2025/794), transposed in Italy in the second half of 2025, postponed by two years the obligations for Wave 2 and Wave 3 companies, shifting the deadlines to 2027-2029.

The Omnibus I Directive (EU 2026/470), in force since March 18, 2026, radically rewrote the thresholds. Today only companies with more than 1,000 employees and more than €450 million in net revenues are required. Listed SMEs are excluded from the obligation. Non-EU companies are subject only if they exceed €450 million in EU revenues with subsidiaries or branches above €200 million.

Key operational deadlines: July 19, 2026 for the official adoption of the VSME standard by the European Commission; September 2026 for the ESRS revision simplifying around 25% of data points; March 19, 2027 for national transposition of CSRD amendments; January 1, 2027 for Wave 2 obligation with first report in 2028.

The concept of "protected undertaking" and the value chain cap

The most significant innovation of Omnibus I for SMEs is the concept of the protected undertaking. Every company with fewer than 1,000 employees that is part of the value chain of a reporting-obligated company has the legal right to refuse requests for ESG data that exceed what is provided for under the voluntary VSME standard. Contractual clauses to the contrary are void by law.

This matters because before Omnibus I, large companies tended to flood their suppliers with ESG questionnaires far more extensive than the minimum standard. The value chain cap formally limits this pressure. But there is a critical point: to exercise this right, the SME must have at least the VSME data ready. A company that has never measured its Scope 1 and Scope 2 emissions cannot credibly either respond to the questionnaires or invoke the regulatory protection.

The final VSME standard was submitted by EFRAG to the Commission on December 17, 2024. The Commission will officially adopt it by July 19, 2026. Until then, procurement managers at large companies tend to intensify their ESG questionnaires precisely because the protection is not yet fully operational.

The VSME report structure: what to measure in practice

The VSME standard is organised in two building-block modules, available for free download from the EFRAG website.

The Basic Module covers disclosures B1 to B11 and is the minimum requirement recommended for all SMEs. It covers general company information (B1), sustainability practices and policies already in place (B2), environmental metrics on energy and GHG (B3), pollution (B4), biodiversity (B5), water (B6), waste and circular economy (B7), and social metrics on workforce (B8), health and safety (B9), pay and training (B10), through to anti-corruption governance (B11).

Indicator B3 receives the most attention from banks and supply chain partners: it requires total energy consumption in MWh distinguishing between renewable and non-renewable, and gross GHG emissions in tCO2eq covering Scope 1 and location-based Scope 2, also expressed as intensity relative to turnover. For a manufacturing SME, this data is almost always already available in energy bills and fuel consumption records. The problem is not the absence of data but the absence of a system to collect and structure it.

The Comprehensive Module (C1-C9) adds an extended business model description, Scope 3 emissions, GHG reduction targets with a transition plan, physical and transition climate risks, and more detailed social indicators. It is voluntary and intended for those who want greater depth or are preparing for transitions to more demanding standards.

The real pressure on SMEs: banks and supply chains

The EBA Guidelines on ESG risk management (EBA/GL/2025/01), applicable from January 11, 2026, require Italian and European banks to integrate ESG factors into governance and credit assessment processes. Banks must evaluate carbon footprint, transition plans, climate governance and physical risk exposure of clients, with a forward-looking approach covering horizons of at least ten years.

The practical effect on SMEs is documented by CRIF data: companies with a high ESG score enjoy a credit approval rate 11% above average (H2 2023 data, reported by Deutsche Bank in October 2024), while those with a very low score record a 6% reduction in access to financing. According to the CRIF ESG Outlook 2025, companies with very high ESG adequacy record default rates up to 25.3% below the overall average, with peaks up to 34% for new loans in the highest score category. The greenium estimated by EFRAG is 5-25 basis points on ordinary bank loans and 10-30 basis points on subsidised loans.

On the supply chain side, a 2025 study of 431 SMEs in the Netherlands found that companies embedded in international value chains receive increasingly frequent and complex requests, with a primary focus on CO2 emissions and material traceability. In Italy the pattern is identical: large companies subject to CSRD must report on their entire value chain and inevitably transfer part of the documentation burden to their suppliers.

One document that deserves specific attention is the SME-Banks/VSME Interoperability Table, published by the Sustainable Finance Working Group coordinated by the MEF and Banca d'Italia. It classifies indicators into three categories: aligned between the SME-Banks document and the VSME, partially aligned, and specific to the banking dialogue. Completing the VSME Basic satisfies most banking requests without additional documentation.

What it costs and how long it takes: the EFRAG data

The Cost-Benefit Analysis published by EFRAG on December 17, 2024 provides the most reliable estimates available.

For a micro or small company with fewer than 20 employees, the total first-year cost for the Basic Module is between €3,500 and €4,500, including accountant or consultant fees (€1,000-2,000), software platform (€300-600) and around ten days of internal work. From the second year the cost falls to €2,000-2,300 as data collection processes are already structured.

For a small or medium-sized company with at least 20 employees, the first year requires between €7,500 and €12,800 with external consultancy (€5,000-10,000), software (€1,000-3,500) and around 40 days of total internal work (25 employee days plus 15 manager or senior professional days). Adding the Comprehensive Module brings the first-year cost to €17,500-22,800.

According to the EFRAG central scenario, the net impact is negative in the first year due to implementation costs, becomes neutral-to-positive from the second year and clearly positive from 2027, with net positive impacts at EU level estimated at €2.6 billion in 2028. The main driver is the reduction in recurring costs compared to the fragmented baseline of multiple questionnaires received from clients, banks and different partners.

The recommended operational path has five phases: initial assessment with gap analysis against VSME Basic (2-4 weeks, internal cost or €1,000-2,000 in consultancy), implementation of the data collection system for disclosures B1-B11 (4-8 weeks), drafting of the first VSME Basic report (2-4 weeks), parallel use of the data for the banking dialogue through the SME-Banks document, and evaluation of the Comprehensive Module from the second year.

The most common errors that compromise certifiability

The first error is fragmented data collection. Most SMEs already have the necessary data scattered across utility bills, operational records, waste registers and accounting systems. The problem is not the absence of data but the absence of a structured process to aggregate it, assign internal responsibilities and ensure consistency across sources. A report built on untraceable data will not withstand an external audit and will not satisfy bank requirements.

The second error is involuntary greenwashing, which occurs when communication exceeds what can be documented through concrete actions. The most common forms are generic claims unsupported by data ("green company", "sustainable production"), improper use of terms such as "carbon neutral" without certification, and emphasis on marginal individual actions that ignore the overall life cycle. Under Directive EU 2024/825, transposed in Italy by Legislative Decree 30/2026 and applicable from September 27, 2026, unverifiable environmental claims expose the company to concrete legal risks.

The third error concerns an insufficient audit trail. Every declared data point must have an identifiable source, a responsible person for collection and a supporting document. Inconsistency between financial statement data and the sustainability section, or between waste loading and unloading records (MUD, RENTRI) and data declared in the ESG report, is the most frequent issue that emerges in assurance processes.

The fourth error is treating the report as a one-off exercise. Data collection must become a continuous process integrated into company operations. A credible sustainability report requires updated data, quantified targets with a base year and reference year, and a periodic monitoring mechanism.

The next step

Most Italian SMEs have never carried out a structured measurement of their emissions. The starting point is not the most complete standard but the most useful one in the short term: the B3 disclosures of the VSME Basic (energy and GHG Scope 1 and Scope 2) already satisfy most banking and supply chain requests, and cost significantly less than the full report.

Carbon Sense, the Atlas Carbon Neutral Solutions platform, is designed for this: structured collection of primary data with an explicit distinction between measured data and estimates, a verifiable audit trail, and output in certifiable format according to ISO 14064-1 and the GHG Protocol. The guide to carbon neutral certification and the section on Scope 3 emissions calculation cover the next steps once the data foundation is in place.