AI for customer ESG questionnaires and VSME reports: drafts from your own records

What an internal AI does with an ESG questionnaire

An internal AI drafts the answers to a customer's ESG questionnaire from your own records: energy invoices, waste disposal records, HR exports, the accident register and your written policies. For every figure it names the document it came from, and for every question without a source it says so instead of guessing. A person in your company checks the draft and sends it, and the approved answer goes into a library for the next customer.

This guide is for owners, managing directors, quality and environmental managers and office managers at suppliers that receive these ESG or supplier sustainability questionnaires from larger customers: component makers, contract manufacturers, logistics firms, engineering offices. ESG stands for environmental, social and governance; in practice the questions ask for energy use, emissions, water, waste, staff figures, accidents and policies on conduct and human rights. The hardware comes in one section near the end. Legal points are general information on EU law as of October 2026; national transposition can differ, and your legal counsel or tax adviser confirms what applies to your company.

The work sits next to two related tasks. AI questions in customer audits, where customers ask which AI tools touch their data, are covered in our guide to AI in customer audits and supplier questionnaires. Product compliance declarations under RoHS and REACH are in our guide to supplier declarations with AI. This page is about sustainability figures.

What changed in 2026: CSRD scope, the voluntary standard and the value chain cap

The Corporate Sustainability Reporting Directive (CSRD) amended the EU Accounting Directive, 2013/34/EU, and obliged large companies to publish sustainability reports. To write them, those companies ask their suppliers for figures. Two legal acts of 2026 change what they may ask of smaller suppliers.

Directive (EU) 2026/470, the first "Omnibus" simplification package, was adopted on 24 February 2026 and published on 26 February 2026. In the amended Article 19a of the Accounting Directive, the reporting duty applies only to undertakings that exceed both the net turnover threshold set in the directive and "an average number of 1 000 employees during the financial year". Smaller companies in the value chain become "protected undertakings": the directive says they "shall have the right to decline to provide information" beyond the voluntary standard, and that reporting undertakings "shall not require" more. Member States must bring these changes into national law by 19 March 2027.

Commission Delegated Regulation (EU) 2026/1560 of 3 July 2026 then set the voluntary standard itself. Its recitals state that it "is based on the standard adopted under Commission Recommendation (EU) 2025/1710", the VSME standard for small and medium-sized undertakings of 30 July 2025, and that the recommendation should be considered "as no longer producing any legal effects". Undertakings that apply the new standard "are not obliged to seek assurance" for what they report.

EUR-Lex: Directive (EU) 2026/470 (OJ L, 26 February 2026) and Commission Delegated Regulation (EU) 2026/1560 of 3 July 2026, read on 25 October 2026. National transposition of the directive can differ.

Two limits matter in practice. The cap covers information requested for the customer's own sustainability reporting; recital 4 of the regulation says it "should therefore not affect requests for information needed to comply with obligations" stemming from other Union or national law. And the standard is voluntary: a supplier may use it to prepare one report that answers the core of many customers' requests, but it does not have to. Whether to decline a question, and how to word it, is a decision for management with legal counsel.

The datapoints customers ask for, and where they sit in your company

Annex II of the regulation lists the disclosures covered by the value chain cap. Most of them are figures a supplier already has somewhere, spread over invoices, the payroll system and the safety officer's files. The table pairs the environmental and workforce datapoints with the records they usually come from.

Annex II, "List of disclosures covered by the value chain cap", and Annex I of Delegated Regulation (EU) 2026/1560, read on 25 October 2026; the records column is our summary. Annex II also lists general information under B1 and, from the comprehensive module, C1, C5, C6 and C7.

The standard's defined terms explain the two emission figures. Scope 1 means "direct GHG emissions from sources that are owned or controlled by the undertaking", such as its gas boilers and vehicles. Scope 2 covers indirect emissions from purchased electricity, steam and heat, and the location-based figure is calculated with a method that "allocates generator emissions to end-users". The standard asks for "estimated absolute gross greenhouse gas (GHG) emissions" in tonnes of CO2 equivalent. For undertakings with 10 employees or fewer, Annex I makes several of these datapoints voluntary, among them the energy, emission, water and waste figures.

An AI does not measure any of this. It reads the documents that contain the figures, finds the right one for each question and drafts the sentence around it. The emission factors are a choice your environmental manager or adviser makes and records once per year.

We supply the AI server for this work and set up the assistant on your documents; tell us which questionnaires you receive and how many a year, and our team replies with a proposal.

How the AI drafts an answer, step by step

The method behind the assistant is retrieval on company documents: the AI first searches your folders for the passages that answer a question, then writes its answer from those passages only, with a reference to each one. Our guide to RAG on company data explains the technique for the IT side. For the ESG work it runs in five steps.

1. Collect the records per reporting year. One folder per year with energy invoices, waste records, the HR export, the accident register, the policies and last year's report. Each item has an owner who confirms it is complete.
2. Calculate the figures outside the AI. Totals, unit conversions from kWh to MWh and emissions are calculated in a spreadsheet or the ERP, where the formula can be checked. A language model is good at reading and writing and unreliable at adding up forty invoices.
3. Keep a library of approved answers. Each answer carries its date, the figure, its source and the person who approved it. The first questionnaire takes the longest; later ones draw on the library.
4. Let the AI map and draft. For a new questionnaire, the assistant matches each question to an approved answer or to a datapoint of the standard, drafts the answer with its source, translates it into the customer's language where needed and marks questions it found no source for. It can also mark questions that go beyond the Annex II list, so management sees them before anyone answers.
5. A person checks and sends. The reviewer compares each figure with its source, decides on the marked questions and approves. The sent version returns to the library with the date.

Questionnaires arrive as spreadsheets, PDF forms or customer portals. The assistant reads spreadsheets and PDFs directly; for a portal, someone pastes the questions in and copies the approved answers back. Our guide to preparing company documents for an AI assistant covers the folder structure, naming and versions that make retrieval reliable.

Where drafts go wrong, and the checks that catch it

Three errors appear again and again in ESG answers, with or without AI. The first is the reporting period: a customer asks for the calendar year and the figure covers the financial year. The second is the boundary: the customer asks for the company and the figure covers one plant, or the reverse. The third is the unit: kWh where MWh is asked, litres where cubic metres are expected.

Each library answer therefore stores period, boundary and unit next to the figure, and the assistant is instructed to repeat them in every draft. When the customer's question names a different period or boundary, the draft says so and the reviewer decides. When the assistant finds no source, its answer is "no source found in the documents", and the reviewer fills the gap or declines the question. A plausible paragraph without a source is the failure that must not leave the company.

Why the figures stay on your own server

Energy use, waste volumes and headcount per site tell a reader a great deal about a supplier's capacity, cost structure and shift pattern. A supplier that answers ten customers holds all of that in one place: the answer library. These are business figures, and you decide which customer sees which of them.

On an own AI server, the documents, the library and the drafts stay on hardware you control. Access comes from your company directory, so the payroll export is visible only to the people allowed to see it, and a query log records who asked what. Our article on trade secrets, NDAs and AI tools explains how keeping sensitive data in-house supports its protection, and local AI and the GDPR covers the HR figures, which can contain personal data when a site is small.

Our Private AI/ML service sets up access control and the query log with the assistant; send us one questionnaire you received and the folders your figures live in, and our team will propose how to set up the library and the server.

The server: a modest model next to your other AI tasks

Drafting ESG answers is a light load. A supplier fills in a few questionnaires a month and prepares one report a year, so the task alone would leave a GPU server idle most of the time. It pays when it runs on the company AI server that also carries other work: quotations, order entry, tenders, safety data sheets and the general assistant for staff. Our guide to an own AI server for a company of 10 to 100 people shows that sharing.

The model needs to read documents and tables, including scanned invoices, and write careful text in several languages. Qwen3.8-27B, a vision-language model under the Apache 2.0 licence, does this, and its FP8 version is a 30.9 GB checkpoint. gpt-oss-120b, also Apache 2.0, serves as the general assistant.

Users-per-card rule (0.9 × driver-visible memory, less 3 GiB per card and less the weights): Qwen3.8-27B FP8 28.75 GiB with FP8 cache, 1.14 GiB per 32K conversation; gpt-oss-120b 60.8 GiB with 16-bit cache, 0.5625 GiB per 16K conversation. Checkpoint sizes from the Hugging Face file lists, read on 25 October 2026. Power by our estimate (cards, processors and 15 per cent for the rest), confirmed by a measurement on the delivered system.

A conversation here is one request being answered at the same moment. A person reviewing a questionnaire sends a request, reads the draft for several minutes and sends the next one, so 47 conversations in flight serve far more staff than 47. By our rule one card has 0.9 × 95.6 − 3 = 83.04 GiB for weights and cache; less 28.75 GiB of weights that leaves 54.29 GiB, and 54.29 ÷ 1.14 is 47. The derivation is in our guide to how many users one RTX PRO 6000 can serve.

The entry server has two NVIDIA RTX PRO 6000 Blackwell Server Edition cards, two AMD EPYC processors, 384 GB of DDR5 ECC memory and two NVMe drives, and runs from one ordinary 230 V 16 A feed in a server room. Its own electricity also enters your B3 energy figure; our guide to AI server electricity per year turns its power into kWh. A company without an IT department will find the division of tasks in our guide to an AI server without an IT department.

What we supply

You can buy this system from us: our team sizes the configuration to your workload and budget and replies within one business day. We build AI servers to order with two, four or eight cards, assembled and tested before delivery, delivered anywhere in the EU on one EU contract and invoice, with manufacturer warranty on every component handled through us; quantities and lead time are confirmed in writing with the quote. Our Private AI/ML service, with our engineering partner Vixen.UNO, sets up the models, the search on your documents, access control and the query log. We do not prepare sustainability reports or give legal or tax advice; the figures and their approval stay with your company and its advisers.

FAQ