ESG without a reporting obligation. Why the market will still ask you for data – and what to prepare now

You will find out that ESG affects you not from the Journal of Laws, but from an email from your largest client: “Please complete the ESG questionnaire by Friday; this is a condition for renewing the contract”. And then it will turn out that the data is spread across four departments, the policies are buried in emails, and no one knows who is authorised to sign it.

The question “do we have to report on ESG?” is the wrong one to ask. Even if your company is not subject to the sustainability reporting obligation under the CSRD, a major business partner, bank, investor or corporate group will still request ESG data from you — for its own reporting, a tender or due diligence. And being unprepared means delayed responses, lost contracts, a lower valuation and chaos within the organisation.

In this article, I explain who is formally subject to the ESG reporting obligation in Poland, why companies outside its scope still need to prepare, what risks are associated with a lack of ESG data — and what to do step by step to avoid the trap of doing either too little or overinvesting in a reporting project your company does not need.

Key terms before you continue

Before we go into detail — here are a few terms that will appear throughout the article. I will explain them once so that you do not have to stop along the way.

Who is formally required to report on ESG in Poland

The sustainability reporting obligation does not apply to every company. To determine whether your company is directly subject to it, check two things: the size thresholds and its status on a regulated market.

“Large undertaking” thresholds under Polish law

The Polish act implementing the CSRD uses a 2-out-of-3 criteria test. If your company exceeds at least two of the following thresholds, it may be subject to the reporting obligation:

The obligation applies in three waves: first to entities that were already required to report non-financial information, then to other large entities and groups, and finally to SMEs listed on a regulated market (Source: Ministry of Finance).

Changes introduced by Omnibus I

The Omnibus I Directive narrowed the scope of the CSRD at EU level to entities employing more than 1000 employees and generating more than EUR 450 million in annual net revenue. Poland must implement these changes by 19 March 2027 — until then, the existing national thresholds remain in force.

What does this mean? If your company falls between the Polish thresholds and the new EU thresholds, its status is uncertain. The obligation may change once Omnibus I is implemented. But that is no reason to wait.

If you do not meet the thresholds — can you simply do nothing?

Formally, you are not subject to the reporting obligation. But that does not mean ESG does not affect you. Today, the real enforcer of these requirements is not a supervisory authority — it is your largest client, bank or investor.

Why the market requires ESG data from companies not subject to reporting obligations

Pressure to provide ESG data does not arise solely from legislation. It stems from the fact that companies subject to reporting obligations must disclose information about their value chain — which includes you if you are their supplier, subcontractor or business partner.

Four situations in which a lack of ESG data harms your business

Where do these requirements come from?

1. CSRD and ESRS — companies subject to reporting obligations must disclose data about their value chain, including suppliers and subcontractors.
2. CSDDD — large companies are building due diligence systems and requesting data from suppliers as part of their own procedures, even though the directive’s application date has been postponed to 26 July 2029 (Source: EUR-Lex).
3. Banks and financial institutions — they request ESG data for their own disclosures under the CSRD, the Taxonomy Regulation and the SFDR. This includes Scope 1–3 emissions, transition plans, taxonomy-related data, workforce metrics and supply-chain data (Source: Statistics Poland’s Statistical Review).
4. Market tools — platforms such as EcoVadis and CDP have become the standard for supplier assessments in many industries. They are not legislation, but their scores influence business partners’ purchasing decisions.

There is no single statutory ESG questionnaire — its scope depends on the purpose: credit, sustainability-linked financing, supplier assessment or portfolio reporting. Your company must therefore be prepared for different types of requests.

Contact us — we will help you determine which ESG requirements apply to your company and what to prepare first.

Risks associated with being unprepared

A lack of ESG data is not an abstract “regulatory risk”. It has tangible consequences that may affect your company in the coming months.

Financial and contractual risk

1. Loss of a contract — a major client makes continued cooperation conditional on completing an ESG questionnaire. No response or an inconsistent response closes the door.
2. Exclusion from a tender — the contracting authority requires environmental or supply-chain policies. The EU Committee of the Regions has confirmed that public procurement may be used to pursue sustainable development objectives under existing legislation.
3. Lower transaction valuation — ESG gaps identified during due diligence may become grounds for reducing the price or prolonging the transaction process.
4. Restricted access to financing — banks are requesting ESG data on an increasingly broad basis, and failure to provide it may affect lending terms.

Operational risk

1. No one owns the issue — ESG affects HR, procurement, sales, compliance, governance, communications, operations and finance. Without a designated person responsible, the issue “falls between departments”.
2. Documentation chaos — some policies exist, some are outdated, some “live in emails”, and some do not exist at all.
3. No centralised source of data — no one knows what data the company already collects, who updates it and who approves its external disclosure.

Reputational and personal risk

1. Greenwashing — a discrepancy between external communications and the procedures actually implemented. On 16 September 2026, UOKiK brought allegations against L’Oréal Polska concerning environmental communications. Allegations had previously been brought against Bolt, Tchibo and Zara. The maximum fine in UOKiK proceedings is 10% of turnover. The burden of proving that an environmental claim is truthful rests with the business.
2. Management board liability — Article 77(2) of the Accounting Act makes it an offence to allow a management report not to be prepared or to include unreliable data in it. The penalty is a fine, imprisonment for up to 2 years, or both. Since an ESG report forms part of the management report, this provision expressly covers sustainability reporting violations (Source: Ministry of Finance).

The opposite risk: overinvestment

Launching a months-long reporting project that the company does not need can be just as costly as taking no action. If you are not subject to the reporting obligation, you do not need to prepare a full ESG report under the ESRS. You do, however, need to have your data, policies and responsibilities in order — proportionately to the requirements of your business partners, banks and investors.

What to do step by step — a phased preparation plan

The plan below provides for three levels of involvement. Choose the one that reflects the size of your company and the pressure from its business environment.

Step 1: determine the company’s status

Answer the following question: are you subject to ESG reporting obligations directly, indirectly (through a corporate group or supply chain), or only to market expectations? Record this decision and the reasons for it — in writing, signed by the management board.

Step 2: review contracts and tender documentation

Review contracts with your largest clients for ESG clauses, supplier codes and disclosure obligations. List what you have already signed and the commitments you have made.

Step 3: build a responsibility map

Assign specific people to the following areas: HR, procurement, compliance, governance, data and communications. Appoint a single owner for the entire ESG area. Without one, every questionnaire will be a project built from scratch.

Step 4: take stock of your data

Determine what ESG data your company already collects, which system it is stored in, who updates it and who approves its external disclosure.

Step 5: review policies and procedures

Identify what exists and is up to date, what needs updating, what is missing, and what is unnecessary and unused.

Step 6: prepare an ESG questionnaire response pack

Create standard responses and a list of attachments, designate an approver and set a response deadline. The next questionnaire should not be a project built from scratch.

Step 7: verify the consistency of external communications

Compare the content on your website, in proposals and in sales materials with the procedures actually implemented. Remove any claims that you cannot substantiate with evidence — this is the fastest way to reduce the risk of greenwashing allegations.

Step 8: create a roadmap and establish a management cycle

Determine what you will implement in the current quarter, what you will implement in the next one, and what you are deliberately choosing not to do at this stage. Establish a quarterly ESG review at management board level.

Three levels of involvement

What you can require from your suppliers — and what they can require from you

This works both ways. If your business partners request ESG data from you, you can — and in some cases should — impose similar requirements on your suppliers.

The reference point is VSME — a voluntary ESG reporting standard for SMEs recommended by the European Commission. It is not mandatory, but defines a reasonable scope of data that a large company may expect from a smaller supplier.

The “value chain cap” concept in Omnibus I aims to limit data requests made by large entities to suppliers to the scope of the relevant simplified standard. Although a binding provision establishing a general prohibition on requesting data beyond the VSME has not yet been confirmed, the standard already provides a practical argument when negotiating the scope of questionnaires.

What this means for you:

1. If a business partner requests data that goes far beyond the VSME — you have grounds for negotiating the scope.
2. If you request data from suppliers yourself — the VSME sets a reasonable proportionality limit.
3. Preparing VSME-compliant responses makes it easier to handle multiple questionnaires in parallel — instead of building each response from scratch.

ESG, personal data protection and whistleblowers

Reporting ESG metrics — particularly social metrics — requires the processing of employee data. The GDPR does not contain a separate legal basis for “ESG”. Processing employee data for ESG metrics requires a legal basis under Article 6(1) of the GDPR and, for special categories of data, also under Article 9(2) of the GDPR.

The ESG reporting obligation may provide a legal basis under Article 6(1)(c) of the GDPR (legal obligation) only where the specific entity is subject to a specific legal obligation. If your company is not covered by the CSRD — you cannot rely on this legal basis.

Data from whistleblowing investigations may only be used for aggregated governance metrics — without disclosing anyone’s identity or case details. The Whistleblower Protection Act prohibits disclosing a whistleblower’s identity to unauthorised persons, while data from the reporting register must generally be retained for 3 years from the end of the calendar year in which the follow-up measures were completed (Source: UODO).

Conclusion: before you begin collecting employee data for ESG purposes, determine the legal basis for processing and a scope of data proportionate to the purpose. Particularly if you are not subject to the reporting obligation, collecting excessive data may itself constitute a GDPR violation.

How we can help you

ESG is not a reporting project. It is about organising data, responsibilities and documentation — proportionately to what the market requires from you.

We help technology, manufacturing and service companies navigate this process without overinvesting or leaving gaps. We combine corporate law, contract law and compliance into a single coherent model — tailored to the company’s stage of development and business environment.

Our support includes:

1. Assessment of obligation status — we determine whether your company is subject to the CSRD directly, indirectly or only through market pressure. We document the decision and the reasons for it.
2. Review of contracts and commitments — we check which ESG clauses you have already signed and what requirements your business environment imposes on you.
3. Responsibility and data map — we identify who in the company is responsible for each ESG area, where the data is stored and who approves it.
4. Review of policies and procedures — we identify what exists, what needs updating and what is missing.
5. ESG questionnaire response pack — we prepare standard responses, attachments and an approval procedure.
6. Communications review — we compare external claims with the procedures actually implemented and help eliminate the risk of greenwashing allegations.
7. Phased roadmap — we establish priorities: what you implement now, what you implement next quarter and what you deliberately choose not to do at this stage.

We work across three levels — from assessment and prioritisation, through a review of documents and responsibilities, to full protection with a complete set of policies and procedures and support in responding to business partners and investors.

ESG affects your company — even if you are not required to report

The ESG reporting obligation has clear thresholds and phases. But market requirements are not waiting for changes under the simplification package. Major business partners, banks, investors and corporate groups are requesting ESG data now — including from companies that are not formally subject to the CSRD.

Being unprepared means lost contracts, prolonged due diligence, a lower valuation and chaos within the organisation. Overinvestment means a months-long reporting project that the company does not need.

The solution lies in the middle: determine your status, appoint an owner, take stock of your data, organise your documents and prepare a response pack — proportionately to the scale of your organisation and the requirements of its business environment.

If you want to determine which ESG obligations apply to your company and what to prepare first — contact us. We will help you complete the assessment, organise your documentation and build a phased action plan tailored to your business.

Frequently asked questions

Does my company have to report on ESG if it does not meet the “large undertaking” thresholds?
If your company does not exceed at least 2 of the 3 thresholds (25 million zł in assets, 50 million zł in revenue, 250 employees) and is not listed on a regulated market — it is not formally subject to the sustainability reporting obligation. But this does not release you from the need to prepare ESG data if your business partners, banks or investors request it. Their reporting obligations cover the value chain — which includes you.

How should I respond to a major client that sends an ESG questionnaire with a one-week deadline?
You need a ready-made response pack: standard answers to typical questions, a list of attachments (policies, data, certificates), a designated approver and an agreed response deadline. Without this, every questionnaire becomes an emergency project involving HR, procurement, compliance and the management board. The VSME — the voluntary ESG reporting standard for SMEs — provides a reference point for the scope of the response.

Who should be responsible for ESG within the company?
One person should own the entire area — with a mandate from the management board. Depending on the company’s structure, this may be someone from compliance, finance or operations. Reporting to that person should be those responsible for individual areas (HR for employee data, procurement for the supply chain, compliance for policies and governance). Without a designated owner, the issue “falls between departments” and no one controls data consistency or deadlines.

Do changes and simplifications to EU legislation (Omnibus I) mean that the obligations will not apply to me?
Omnibus I narrowed the scope of the CSRD at EU level to companies employing more than 1000 employees and generating more than EUR 450 million in revenue. Poland must implement these changes by 19 March 2027 — until then, the existing national thresholds remain in force. Even after the changes, indirect obligations (business partner questionnaires, bank requirements and due diligence) will not disappear — they arise from your business partners’ reporting obligations, not your own.

What risks do I face as a management board member if ESG data or claims turn out to be false?
Article 77(2) of the Accounting Act provides for a fine, imprisonment for up to 2 years, or both, for allowing a management report not to be prepared or to include unreliable data. An ESG report forms part of the management report. Independently of this, UOKiK may impose a fine of up to 10% of turnover for misleading environmental claims — and the burden of proving that a claim is truthful rests with the business.

Do I need a full ESG report, or is an organised set of data and policies enough?
If you are not subject to the reporting obligation — you do not need to prepare a full ESG report under the ESRS. You do, however, need organised data, up-to-date policies, a responsibility map and a ready-made questionnaire response pack. The scope depends on pressure from business partners, banks and investors — as well as the company’s growth plans (a funding round, onboarding an enterprise client or expanding abroad).