In this article (6 sections)
- Why are supply chain due diligence questionnaires from European customers getting longer?
- Laws have been postponed, so why are customers still asking for supplier data?
- The five most common reasons customers send supplier data back
- Which supply chain due diligence requests can you decline, and which can’t you?
- Where to start: build supplier data you can reuse
- FAQ
Key takeaways
- CBAM, the PPWR, the EUDR, the Battery Regulation and several other EU laws all depend on data from upstream suppliers. That is why questionnaires from European customers keep getting longer.
- What customers care about is whether the data is usable: is there evidence, which product does it cover, and when was it last updated?
- Some data requests can be declined; others, by law, cannot. Sort them first, then build one set of product data you can reuse.
A European customer sends you a supplier questionnaire. It asks for country of origin, material composition, factory emissions and a list of your upstream suppliers, and it ends with: “If we do not receive your response before next quarter, we will be unable to keep you on our approved supplier list.” When we help Taiwanese companies with supply chain due diligence requests, many cases start with an email like this.
The real difficulty is usually not whether to provide the data, but whether the customer can use what you send. This article explains why European customers want this data, the most common reasons it gets sent back, and where your company can start.
Why are supply chain due diligence questionnaires from European customers getting longer?
Most EU laws place the obligations on the European importer or brand owner, but the data they need sits with their suppliers in Taiwan. So every new law that takes effect adds another section to the questionnaire.
| Law | Data your customer will usually ask you for | When it applies |
|---|---|---|
| Carbon Border Adjustment Mechanism (CBAM) | Embedded emissions and production installation data for goods such as iron and steel, aluminium, cement, fertilisers and hydrogen | Definitive period from 1 January 2026 |
| Packaging and Packaging Waste Regulation (PPWR) | Documentation on packaging materials, substance restrictions, recyclability and similar | Applies from 12 August 2026 |
| EU Deforestation Regulation (EUDR) | Geolocation coordinates of the place of production and proof of legality for commodities such as wood, paper and rubber | Large and medium-sized companies 30 December 2026; micro and small enterprises 30 June 2027 |
| EU Battery Regulation (EUBR) | Battery passport data and due diligence information on raw materials | Battery passport 18 February 2027; due diligence obligations 18 August 2027 |
| Forced Labour Regulation | Production sites, upstream supply chain and working conditions | Applies from 14 December 2027 |
| Corporate Sustainability Due Diligence Directive (CSDDD) | Information on human rights and environmental risks | Member States must transpose by 26 July 2028; applies from 26 July 2029 |
The data these laws require overlaps heavily: what is in the product, where it comes from, who made it, how much it emits, and how you prove it. Customers are really asking for the same underlying data, just in a different format for each questionnaire. To follow the latest developments for each law, use the EU Regulatory Radar.
Laws have been postponed, so why are customers still asking for supplier data?
In 2026 the EU amended the CSDDD through the Omnibus simplification package (Directive (EU) 2026/470). The scope thresholds were raised to more than 5,000 employees and a worldwide turnover of more than EUR 1.5 billion, and application was pushed back to 2029. Many Taiwanese companies took this to mean they could put the issue aside.
In practice, CBAM is already in operation, the PPWR already applies and the EUDR will apply shortly. European customers build their purchasing processes once and apply them to all suppliers; they do not drop a questionnaire because one law has been postponed. Banks and large buyers also make supplier data a condition of doing business.
Note: A postponement changes when your customer’s own obligations apply. It does not necessarily change your customer’s purchasing conditions for you. Whether to respond, and how far to go, should depend on your contract with the customer and the actual legal obligations.
The five most common reasons customers send supplier data back
| Problem | What the customer sees | A better approach |
|---|---|---|
| Declarations without evidence | A stamped declaration with no test report or source documents | Link every declaration to evidence you can produce |
| Unclear scope | No way to tell whether the data covers the whole company, one product or one part number | Organise data by product or part number |
| Outdated data | Test reports or emissions figures that are several years old | State the period the data covers and when it will next be updated |
| Inconsistencies | Figures given to different customers do not match | Maintain a single version internally |
| Broken upstream chain | Data from tier 2 and tier 3 suppliers cannot be obtained | Write data requirements into your purchasing specifications for upstream suppliers |
Take packaging as an example: customers want more than a declaration; they want the technical documentation behind it. See our article on what a PPWR declaration of conformity and technical documentation must contain.
Which supply chain due diligence requests can you decline, and which can’t you?
We are an SME. Can we simply not respond?
It depends on why the customer wants the data. The amended Corporate Sustainability Reporting Directive (CSRD) contains a safeguard: where a customer asks for data to prepare its sustainability report, value chain companies with an average of no more than 1,000 employees may decline requests for information that goes beyond the voluntary reporting standard.
That protection applies only to sustainability reporting. If the customer needs the data to meet its obligations under product legislation, the position is different. Under Article 16 of the PPWR, for example, suppliers of packaging must provide the manufacturer with the information and documentation needed to demonstrate that the packaging complies, and the European Commission’s PPWR FAQ states clearly that suppliers cannot refuse. If customers cannot obtain the data they need under CBAM and the EUDR, they cannot complete their declarations or due diligence statements either.
| Purpose of the request | Can you decline? |
|---|---|
| Your customer is preparing its CSRD sustainability report (your company averages 1,000 employees or fewer) | You may decline anything beyond the voluntary standard |
| Your customer is meeting product law obligations under the PPWR, CBAM, EUDR, Battery Regulation and similar | In principle you need to provide it; otherwise the customer cannot lawfully import or sell |
| Your customer’s own purchasing conditions or scoring | Not legally required, but it affects whether the business relationship continues |
Does commercially sensitive information have to be disclosed in full?
No. Supply chain transparency does not mean making everything public; it means the right party gets the data it needs. First establish the legal basis for the customer’s request, provide only what that law requires, and protect sensitive information with confidentiality clauses.
Where to start: build supplier data you can reuse
1. Map who is asking for what
Gather all your customer questionnaires in one place, note the legal basis behind each question, and sort the questions into two groups: required by law, and the customer’s own requirements.
2. Prioritise by product and market
Start with products that account for a large share of revenue, or that are already covered by laws with set application dates. For example, deal with CBAM first for products with steel or aluminium parts, and with the PPWR and EUDR first for cardboard packaging.
3. Build a data sheet for each part number
For each part number, record the materials, origin, upstream suppliers, supporting evidence and date of last update. Do this once, and you can answer questionnaires from different customers under different laws.
4. Extend data requirements upstream
Much of the data you need actually sits with your own suppliers. Write the data items, evidence requirements and update frequency into your purchasing specifications and supplier contracts, so the next time a customer asks, you do not have to start from scratch.
The PPWR is a good place to start. Almost every exporter deals with packaging, and the PPWR already applies. Setting up your data process for packaging first and then extending it to other laws is the approach we often recommend. For the full picture, see The PPWR explained; for emissions data, see CBAM definitive period 2026.
FAQ
What is supply chain due diligence?
Supply chain due diligence is the process by which a company identifies, prevents, mitigates and accounts for human rights and environmental risks in its own operations and its supply chain, usually following the OECD due diligence framework. For Taiwanese suppliers it most often takes the form of supplier questionnaires and data requests from European customers: what is in the product, where it comes from, who made it, what its emissions are, and what evidence backs each claim.
Do Taiwanese suppliers have to comply with the CSDDD?
Most Taiwanese suppliers are not directly subject to the CSDDD. Since the Omnibus simplification (Directive (EU) 2026/470), the CSDDD applies to EU companies with more than 5,000 employees and more than EUR 1.5 billion in worldwide turnover; for non-EU companies, what counts is turnover generated in the EU. Application has also been pushed back to 2029. Large European customers still write due diligence requirements into purchasing conditions and contracts, so suppliers are affected indirectly through questionnaires.
Do we have to answer a European customer’s supplier questionnaire?
It depends on why the customer needs the data. If it is to meet obligations under product laws such as the PPWR, CBAM, the EUDR or the Battery Regulation, you will in principle need to provide it; Article 16 of the PPWR, for example, requires packaging suppliers to provide the information and documents needed to demonstrate conformity. If the data is for the customer’s CSRD sustainability report, companies with an average of up to 1,000 employees may decline requests that go beyond the voluntary reporting standard. A customer’s own purchasing or scoring criteria are not legally mandatory, but they will affect the business relationship.
What supplier data should we prepare?
The data the different laws ask for overlaps heavily: materials and composition, country of origin, upstream suppliers, emissions data, and the evidence behind each claim. Organise it by part number, and record for each item the product it covers, the period it refers to and when it will next be updated. One data set can then answer questionnaires from different customers and under different laws.
When does the EU Forced Labour Regulation apply, and does it affect Taiwanese suppliers?
The EU Forced Labour Regulation (Regulation (EU) 2024/3015) applies from 14 December 2027. It prohibits placing or making available on the EU market, or exporting, products made with forced labour, wherever they were produced. European customers will therefore ask suppliers for information on production sites, the upstream supply chain and working conditions.
How ZC can help with supply chain due diligence
ZC is a Taiwanese-founded consultancy headquartered in Amsterdam, the Netherlands, with a service office in Taipei, helping Taiwanese companies respond to EU regulations. We can help you break down customer questionnaires, map each question to its legal basis and build product-level compliance data. We can also act as your regular point of contact for regulatory questions from European customers.
If you want your own team to handle this, choose in-house training; if you want a professional team to do it with you, choose a compliance project.
Make your supplier data stand up to scrutiny from European customers
Supply chain due diligence in-house training →
Supply chain due diligence compliance projects →
Not sure where to start? Book a 30-minute online consultation or email [email protected].
This article is general information and does not constitute legal advice for any specific case. Actual obligations depend on the product, the packaging, the trade terms and the countries of sale.
Next step: have you considered these three options?
Sources · Directive (EU) 2026/470 (Omnibus I, amending the CSRD and CSDDD) · Regulation (EU) 2023/956 (CBAM) · Regulation (EU) 2025/40 (PPWR), Article 16 · Regulation (EU) 2023/1115 (EUDR), as amended by Regulation (EU) 2025/2650 · Regulation (EU) 2023/1542 (Battery Regulation) · Regulation (EU) 2024/3015 (Forced Labour Regulation). This article is general information and not legal advice for any specific case. Obligations are defined by the Official Journal of the EU.
supply chain due diligencesupplier questionnaireCSDDDCSRDCBAMPPWREUDRBattery RegulationForced Labour Regulation
