What European Buyers Ask Suppliers for ESG Compliance
European buyers now routinely ask suppliers for documented information on sourcing, traceability, environmental impact, and labour practices. Most of these requests trace back to three EU laws, the EU Deforestation Regulation, the Corporate Sustainability Due Diligence Directive, and the Corporate Sustainability Reporting Directive, which place the legal burden on the buyer rather than the supplier. Once you understand why the questions arrive and what they generally cover, they stop feeling random and start looking like a predictable pattern you can prepare for.
Why European buyers are asking now
The short answer is that European companies are now legally required to know, and prove, more about their own supply chains than they were five years ago. That obligation sits with the buyer, not with you. But a buyer based in Germany or France has no direct way to verify what happens at a supplier's site in Thailand or Vietnam, so the practical solution is to ask the supplier directly and put the answers on file.
This is a fairly recent shift. The three regulations behind it have come into force in stages since 2023, and many procurement teams are still building out their own internal processes for collecting supplier data. That's part of why the requests can look inconsistent from one buyer to the next, even though they're usually pointing at the same underlying requirement. A questionnaire from one client and a supplier code of conduct from another are often collecting the same facts in different packaging.
What buyers are asking for ESG data reflects what they now have to report or defend to their own regulators, not a change in what they personally care about. That distinction matters, because it tells you the requests aren't going away once this year's audit season ends.
The three regulations driving the requests
Three pieces of EU legislation account for most of what lands in a supplier's inbox. They overlap in places, but each pushes buyers to ask for something slightly different.
Corporate Sustainability Due Diligence Directive (CSDDD)
The Corporate Sustainability Due Diligence Directive requires large EU companies to identify, prevent, and address environmental and human rights risks across their own operations and their value chains, not just their first-tier suppliers. In practice that means supplier-level assessments, ongoing monitoring, and in some cases a formal process for suppliers to flag problems. If a buyer is asking you to complete a due diligence questionnaire or sign a supplier code of conduct, this directive is usually the reason.
Corporate Sustainability Reporting Directive (CSRD)
The Corporate Sustainability Reporting Directive requires covered companies to publish detailed, audited ESG disclosures, including information about their upstream supply chain where it's material to their business. A buyer can't publish figures on supply chain emissions or labour risk without collecting the underlying data first, which is why CSRD tends to show up as requests for energy use, emissions estimates, or working conditions data, usually on an annual cycle tied to the buyer's own reporting deadline.
EU Deforestation Regulation (EUDR)
The EU Deforestation Regulation is narrower but more exacting. For a defined list of commodities, including cocoa, coffee, rubber, palm oil, soy, cattle, and wood, companies placing goods on the EU market must prove the products are not linked to deforestation after December 2020. That proof has to include traceability to the plot of land where the commodity was produced, along with geolocation coordinates. There's no equivalent flexibility here: if your product falls under EUDR's scope, geolocation and origin data are non-negotiable.
What buyers generally ask for
Formats vary by company and by sector, but the requests tend to fall into a handful of recurring categories. This is the overview; if you're already fielding a specific type of request, the two articles linked below go into the practical detail.
Sourcing and origin information
Buyers increasingly want to know exactly where a product comes from, down to the country, the supplier, and in some cases the production plot. This used to be background knowledge a buyer rarely asked for directly. Now it's often a formal data field in an onboarding form, because the buyer has to be able to produce it on request from their own regulator.
Traceability and chain of custody
Buyers want a description of how materials move through your operations and how you'd be able to trace a given shipment back to its source if asked. The expectation usually isn't full tier-by-tier traceability on day one, but a system that's defined, applied consistently, and backed by records. This is one of the areas where suppliers most often get stuck, since it requires connecting information that's often scattered across procurement, warehouse, and production teams.
→ See: Traceability Requirements for Exporters: What You Need to Have in Place
ESG and due diligence questionnaires
Many buyers collect supplier data through a structured questionnaire, sometimes built in-house and sometimes run through a third-party platform such as EcoVadis or Sedex. These typically cover environmental performance, labour and working conditions, and business ethics. The questions differ in wording between buyers, but they're generally drawing on the same underlying frameworks, which is why suppliers often notice they're answering close variations of the same questions for different clients.
→ See: Supplier ESG Questionnaires: What Buyers Ask and How to Respond
Policies and supporting evidence
Buyers also want to see that written policies (codes of conduct, anti-corruption policies, human rights and environmental policies) actually get implemented, not just filed away. That usually means requests for evidence: training records, internal responsibility assignments, audit reports, and monitoring records. Under CSRD in particular, the information a buyer discloses has to be substantiated, so unsupported claims tend to generate a follow-up request rather than a signed-off answer.
How the pressure differs by sector
Regulatory pressure isn't evenly distributed across industries, though the direction is the same everywhere. In agriculture and commodities, EUDR has made origin and geolocation data close to mandatory for exporters shipping into the EU. In general manufacturing, CSDDD and CSRD drive most of the questionnaire and policy requests. In jewellery and gemstones, buyer expectations are frequently shaped by sector-specific frameworks that already build in OECD-aligned due diligence principles, so the underlying data requests look similar even when the paperwork carries a different name.
Whatever the sector, the underlying ask is consistent: a buyer needs to be able to show, on paper, that they know and manage the risk in their supply chain.
Why this matters commercially
These requests aren't a compliance formality that sits off to the side of the commercial relationship anymore. They've become part of standard procurement, and they show up at the points that decide whether a relationship continues: supplier onboarding, contract renewal, and access to the EU market at all. A buyer with a CSDDD due diligence obligation is, in practical terms, less able to keep working with a supplier who can't produce basic ESG documentation, regardless of price or quality.
Suppliers who can produce consistent, well-organized answers tend to move through onboarding and renewal faster, simply because they give the buyer's compliance team less work to do. That's usually the real difference between a supplier that gets flagged for extra scrutiny and one that doesn't.
Frequently asked questions
Why are European buyers suddenly asking suppliers for ESG data?
Because EU regulations, chiefly the CSDDD, CSRD, and EUDR, now require European companies to identify, manage, and in many cases publicly report on risks across their supply chains. Since buyers can't verify supplier operations firsthand, they collect the information directly from suppliers through questionnaires, policy requests, and origin data.
What's the difference between EUDR, CSDDD, and CSRD?
EUDR is a product-specific rule requiring proof that certain commodities aren't linked to deforestation, including geolocation data. CSDDD is a broader due diligence obligation covering environmental and human rights risks across a company's operations and value chain. CSRD is a disclosure rule requiring companies to publish detailed, audited ESG reports, including material information about their supply chain.
Do these regulations apply to my company if I'm not based in the EU?
The legal obligation generally falls on the EU company that imports or places goods on the EU market, not on the non-EU supplier directly. In practice, though, that EU buyer has to source the underlying data from somewhere, so a supplier outside the EU can still be asked to provide it as a condition of doing business, and in some cases (such as EUDR) non-EU producers are directly named in the regulation's traceability requirements.
What should I do first when a buyer sends an ESG or traceability request?
Start by working out which underlying regulation the request is likely tied to, since that tells you how much detail and what kind of evidence is expected. From there, centralize the sourcing, policy, and operational records you already hold rather than answering the request from scratch, since most companies already have the information, just spread across different teams and formats.