The regulation isn’t coming. It’s here.

There’s a comfortable story that a lot of businesses have been telling themselves for the past few years. It goes something like this: “Sustainability regulation is coming, but it won’t really affect us yet. We’re too small. We’re not in scope. We’ll deal with it when we need to.”

That story expired.

The Corporate Sustainability Reporting Directive (CSRD) is live. The Carbon Border Adjustment Mechanism (CBAM) is in its transitional phase. The Corporate Sustainability Due Diligence Directive (CSDDD) is working through implementation. These aren’t proposals anymore. They’re law.

And if you think they don’t apply to you because you’re not a large publicly listed company — you’re right, technically. And also completely wrong, practically.

Regulation rolls downhill

Here’s how it works.

The regulation targets large companies. Those companies now have legal obligations to report on their environmental impact — not just their own operations, but their entire value chain. Scope 3. Upstream and downstream.

Which means they need data from their suppliers. Which means you.

It doesn’t matter that the regulation doesn’t name your business. It matters that your biggest customer is now legally required to report data that they can only get from you. And if you can’t provide it, someone else will.

This isn’t about whether you need to comply. It’s about whether your customers can afford to work with someone who can’t help them comply.

The questionnaire isn’t the regulation. But it’s what the regulation produces.

If you’ve already received a sustainability questionnaire from a buyer — the kind that asks about energy consumption, waste management, carbon emissions, water usage, and governance — this is where it came from.

The regulation didn’t tell your buyer to send you a questionnaire. The regulation told your buyer they need to report on their value chain. The questionnaire is their attempt to get the data.

Now: can you answer it?

Not “can you fill in something.” Can you answer it accurately, with real numbers, backed by actual records? Can you tell them how much energy you used per unit of output last year? Can you break down your waste streams? Can you document what you’ve done to reduce your impacts?

If you can, you’re already ahead. That data doesn’t just satisfy the questionnaire — it gives you operational visibility that most of your competitors don’t have.

If you can’t, the question is: how long before that becomes a problem?

The ones who aren’t scrambling

The businesses that have their data in order aren’t panicking about CSRD. They aren’t panicking about CBAM. They aren’t hiring compliance consultants or buying reporting software in a rush.

They’re answering the questions, moving on, and getting back to work.

Why? Because the data they need for compliance is the same data they already collect for operational reasons. They know their energy use because it helps them manage costs. They know their waste streams because it helps them recover margin. They know their supply chain impacts because it helps them manage risk.

Compliance is a byproduct. The work was already worth doing. The regulation just made it mandatory for everyone else.

This is the asymmetry that makes the current moment so significant: the businesses that optimized early are now structurally advantaged. They spent the time building their baseline when it was optional. Now it’s required, and they’re already there. Their competitors are starting from zero — under pressure, with deadlines.

What CBAM means if you export to the EU

The Carbon Border Adjustment Mechanism deserves a specific mention because its implications are concrete and immediate.

CBAM applies a carbon cost to certain imports into the EU — currently covering cement, iron and steel, aluminum, fertilizers, electricity, and hydrogen. If you produce any of these, or use them as significant inputs, the cost structure of selling into the EU just changed.

During the transitional phase (which we’re in now), importers need to report the embedded emissions in their goods. By 2026, they’ll need to buy certificates matching those emissions.

If you’re a supplier, this means your EU customers need to know the carbon intensity of what you sell them. If you can’t provide that data, you’re either going to be estimated (unfavorably) or replaced.

If you can provide it — and especially if your numbers are good — you’re suddenly more competitive, not less. Low-carbon production becomes a price advantage, because your customer pays fewer CBAM certificates.

The regulation just turned operational efficiency into a sales argument.

The smart move

The regulation isn’t going away. The reporting requirements aren’t going to get simpler. The questionnaires aren’t going to stop arriving.

The question is whether you build the data infrastructure now — on your own timeline, at your own pace, for your own operational benefit — or whether you build it later, under deadline pressure, at a premium, for someone else’s compliance requirement.

Same work either way. Very different experience.

Start with what you can measure today. Energy bills. Waste invoices. Water meters. Transport logs. Material purchasing records. Most businesses have this data scattered across accounts, spreadsheets, and filing cabinets. The work isn’t generating new data — it’s organizing what you already have into something useful.

Useful to you first. Useful for compliance second.

The window

Every quarter you wait is a quarter of data you don’t have when someone asks for it. It’s a quarter of operational visibility you’ve missed. It’s a quarter of decisions you’ve made without the numbers.

The regulation is here. The requirements are live. Your customers are already figuring out who can help them comply and who’s going to be a problem.

Don’t be a problem. Be the supplier who already has the answers.