The Rules Keep Changing. Your Data, Process, and Ownership Gaps Don't Wait for Them.

Scope depends on recent EU relaxations to size and sector thresholds, a readiness assessment starts by confirming your current status, since the threshold changes have shifted enough companies in and out of mandatory scope that assumptions based on last year's rules are no longer reliable. Confirming status is a quick first step, but it's a necessary one before any further planning makes sense.

Thresholds have shifted, moving some companies outside mandatory scope, but customer and financier questions often continue regardless of what the legislator has decided, since large customers and lenders frequently ask for sustainability data independent of anyone's legal reporting obligation. Falling outside mandatory scope doesn't necessarily mean the underlying commercial pressure to report also disappears.

Depends on your confirmed scope and size category, determined in the assessment's scope-confirmation step, since the applicable timeline varies significantly based on exactly where a company falls relative to the current thresholds. There's no single answer that applies across the board; it has to be worked out for each company's specific circumstances first.

A voluntary, lighter EU standard for companies under 1,000 employees, with two modules and twenty disclosures, not mandatory, but useful when customers keep asking for sustainability information despite a company not falling under mandatory reporting rules. It gives smaller companies a recognised, standardised way to respond rather than answering every customer's bespoke questionnaire from scratch each time.

Use VSME as a standard answer, a large customer can't legally demand more from you than what VSME defines as necessary, which makes it a useful reference point when a customer's request seems to go beyond what's reasonable for a company outside mandatory scope. Pointing to the standard also saves the back-and-forth of negotiating what counts as a reasonable ask each time.

Capped at what VSME defines as necessary, this is precisely the ceiling the standard was built to enforce, protecting smaller suppliers from being asked to produce reporting-grade sustainability data disproportionate to their size and resources. Knowing this ceiling in advance also makes it easier to push back on requests that exceed it without appearing uncooperative.

An evaluation combining a gap analysis of what's missing with an assessment of internal capacity and barriers to closing those gaps, giving a company both a list of what needs to change and a realistic view of whether it can actually make those changes in the available time. Either piece alone gives an incomplete picture of where a company actually stands.

Break the standard into individual disclosure requirements and score each one empty, partial, complete, complete-with-limitations, or gapped, with an owner assigned to every disclosure rather than a single overall completeness score for the whole standard. This level of granularity is what makes the resulting action plan specific enough to actually assign and track, rather than a vague sense of general progress.

A gap analysis lists what's missing; a readiness assessment adds whether the organisation actually has the capacity to close those gaps on a realistic timeline, which is a materially different and often more sobering question. A company can have a short gap list and still be unready if it lacks the internal capacity to close even those few gaps within the time available.

Start with Phase 1, a kick-off and masterclass, to align understanding across the organisation, then run the gap and readiness assessment once everyone shares a common baseline of what's actually being asked for. Skipping this alignment step tends to surface disagreements about basic scope and terminology partway through the gap analysis, which slows the whole process down considerably.

Assigned per disclosure requirement during the gap analysis, ownership should never default to 'sustainability team handles everything,' since most disclosures actually depend on information and processes that sit in finance, HR, procurement, or operations rather than with sustainability alone. A single team can coordinate the reporting, but it can rarely own every underlying data point itself.

Build the underlying datapoint register once so any questionnaire can be answered from the same source, rather than treating each incoming questionnaire as a fresh research exercise that duplicates work already done for a previous customer. A well-maintained register turns what used to be days of scrambling into a much faster exercise of simply mapping the register onto whatever format a given questionnaire happens to use.

Start now on data, ownership, definitions, and materiality, those change little with the rules and take the most time to build, regardless of how the final reporting requirements eventually settle. Waiting for regulatory certainty before starting on the parts that won't actually change much with that certainty just delays the work that takes longest, for no real benefit.

Ensure every disclosure has a traceable source and owner from the start of the gap analysis, reconstructing this later is far more expensive, particularly once the assurance provider has already begun testing and finds gaps in the evidence trail. Traceability built in from the beginning is simply cheaper than traceability retrofitted under time pressure once an assurance engagement is already underway.

Yes, a collective variant runs multiple organisations through the same process together, cutting cost and adding peer learning, since companies facing similar reporting challenges often benefit from comparing notes and sharing the fixed costs of expert-led sessions. This tends to work particularly well for mid-market companies that individually lack the budget for a fully bespoke engagement.