Article
Supply chain management in 2026: a strategic guide to sustainability and compliance
Supply chain management is no longer just about logistics. In 2026, with the CSRD applying in its definitive form following the February 2025 Omnibus package and the April 2025 «stop-the-clock» directive, supplier data has become central to sustainability reporting for every company required to report. And even if your company is not directly within the CSRD's scope, Scope 3 — representing between 70 and 90 per cent of the total carbon footprint in most sectors — runs through suppliers, not your own facilities. This guide explains what has changed in 2026, what needs doing and where the costly mistakes lie.
Key points Supply chain management in 2026 incorporates a third flow: ESG data. Without it, companies can neither report under the CSRD nor answer major customers' questionnaires. Following the Omnibus package, fewer companies are subject to the CSRD, but pressure on the value chain remains. Major customers required to report pass requirements on to their suppliers, whether or not those suppliers fall directly within CSRD scope. Scope 3 remains the heart of reporting. And Scope 3 is, in practice, the supply chain. ESRS E1 (climate change) and S2 (workers in the value chain) are the two standards with the greatest impact on procurement departments. Spreadsheets stop working beyond 50 significant suppliers. The costly mistake is not calculation, but documentary traceability. Table of contents
- Beyond logistics: what the supply chain means today
- The regulatory framework in 2026: CSRD and Scope 3 traceability
- Double materiality applied to suppliers
- Digitalisation and audit: from available data to defensible data
- Implementation roadmap
- How Voombu fits into this process
- From compliance to competitive advantage
- Frequently asked questions
1. Beyond logistics: what the supply chain means today
The historical definition of the supply chain covered two flows: physical products and money. In 2026 there is a third, equally critical flow: ESG information. Without it, a company subject to the CSRD cannot consolidate its report. And a company not required to report but selling to major corporate customers loses tenders, because supplier questionnaires screen for documented performance.
This changes the procurement department's role. Five years ago, procurement was assessed on price, quality, delivery time and service. In 2026, those four criteria remain, but a fifth sits alongside them: the supplier's ability to deliver defensible ESG data. This fifth dimension increasingly influences supplier approval decisions.
What no longer works Three practices still persist in the Spanish mid-market and should be left behind:
Selecting suppliers solely on unit cost. Today, a cheap supplier with an opaque footprint or working conditions can expose the parent company to reputational risk and, in some sectors, a regulatory penalty exceeding the initial saving. Treating suppliers as isolated transactions. Stability and documentary traceability are built through medium-term relationships, not one-off purchases. Treating ethical and labour compliance as a contract appendix. The CSDDD for the largest groups and ESRS S2/S3 for everyone reporting under the CSRD have turned supplier due diligence into an auditable obligation.
2. The regulatory framework in 2026: CSRD and Scope 3 traceability
Three regulatory components dominate the supply chain landscape in 2026.
CSRD and ESRS after Omnibus The Corporate Sustainability Reporting Directive was approved in 2022. The February 2025 Omnibus package simplified its content and raised the thresholds: companies with more than 1,000 employees and more than €450 million in turnover or more than €25 million on the balance sheet. The April 2025 «stop-the-clock» directive postponed the entry of the second and third waves by two years.
Two ESRS standards directly affect the supply chain: ESRS E1 (climate change), requiring Scope 3 reporting when material, and ESRS S2 (workers in the value chain), requiring assessment of working conditions and human rights among suppliers and subcontractors.
CSDDD: human rights and environmental due diligence The Corporate Sustainability Due Diligence Directive applies to the largest companies (more than 1,000 employees and 450 million in global turnover in its post-Omnibus form). Their obligation is to identify, prevent, mitigate and address adverse environmental and social impacts in the value chain. Suppliers are not directly obliged, but receive questionnaires, audits and, in some cases, contractual requirements to improve.
The reality of Scope 3 Scope 3 under the GHG Protocol covers fifteen categories of indirect emissions, eight upstream (purchased goods, transport, travel, waste, leased assets…) and seven downstream (product use, end of life, investments…). For a typical industrial company, categories 1 (purchased goods and services), 4 (upstream transportation) and 11 (use of sold products) account for most of the footprint.
More than 70 per cent of the total footprint. In sectors such as retail, consumer goods or financial services, it exceeds 90 per cent. Ignoring Scope 3 is not an option; measuring it badly is not either. The technical challenge is moving from spend-based calculations (multiplying euros spent by an average sector factor) to activity-based calculations (using actual supplier data in kilograms, kilometres or kilowatts). That transition does not happen in a quarter. It happens in layers, year after year, focusing on significant categories and suppliers.
3. Double materiality applied to suppliers
Double materiality is the methodology that determines what to report under the CSRD. It requires assessing each ESG topic on two levels: the impact the company's activity has on people and the environment (impact materiality), and the financial effect that topic may have on the company itself (financial materiality). A topic is material if it exceeds the threshold on either level.
Applied to the supply chain, this dual perspective produces two different but connected questions.
Impact materiality among suppliers What impacts do suppliers generate that your activity enables? Work in hazardous conditions in certain geographies. Deforestation associated with particular materials (timber, palm oil, soy, extensive livestock farming). Water consumption in water-stressed areas. Production emissions that your company does not generate, but your demand sustains. This perspective is not voluntary: it is what ESRS requires companies to document when the topic is material.
Financial materiality of suppliers What financial risks reach your balance sheet through suppliers? Price volatility resulting from changes in climate regulation (carbon pricing, CBAM at the European border). Operational disruption risk from physical climate events in concentrated areas of the chain. Reputational risk associated with supply chain findings becoming public. These risks can be monetised, and COSO ERM methodology, applied to the internal-control system, integrates them alongside financial and operational risks.
The common mistake: treating double materiality as a one-off consulting exercise, receiving the matrix as a PDF and filing it away. The auditor arriving three months later asks for traceability of stakeholder consultations and the criteria applied. Without that traceability, the report rests on weak foundations.
4. Digitalisation and audit: from available data to defensible data
In the supply chain, the problem is almost never a lack of data. The problem is fragmentation and traceability. An average company has energy data in invoices, supplier data in procurement, social data in human resources and transport data in operations. The data exists. What is missing is a system connecting it, validating it and leaving an auditable trail.
What breaks first When the supply chain has more than fifty significant suppliers, spreadsheets stop working. What breaks is not the calculation itself: it is governance. Different versions of the same data circulate by email, emission factors are updated in one tab but not others, and changes to the consolidation boundary are not reflected retrospectively. When the auditor asks where a figure comes from, the chain of custody has already been lost.
What the auditor asks for The limited assurance required from the first CSRD reporting year examines five things concerning the value chain:
A documented supplier policy approved by the board or management. A chain materiality analysis with an explicit methodology. Traceability of every supplier data point: origin, factor applied, upload date, responsible person. Internal controls over ESG information, ideally integrated into the COSO ERM framework rather than built as a separate system. Reconciliation between the reported value chain boundary and the financial consolidation boundary.
What distinguishes a platform from a spreadsheet What sets a serious platform apart from a spreadsheet is not visual sophistication, but three concrete things: native integration with ERP and operational systems (SAP, Oracle, Microsoft Dynamics, Sage), centralised maintenance of annually updated emission factors (DEFRA, ADEME, IEA, MITECO, ecoinvent), and a native audit trail in which every data point automatically records its provenance, owner and modification date. These three components are what the verifier requests and what the spreadsheet does not deliver.
5. Implementation roadmap
For a mid-market company starting in 2026, the following timelines are reasonable.
Phase 1 — Materiality assessment and supplier mapping (4-8 weeks) Identify spending categories and significant suppliers. Apply double materiality analysis to prioritise critical links. The deliverable is a shortlist of suppliers and categories on which detailed data capture work will focus.
Phase 2 — Inventory of existing data (4-6 weeks) Map the information already available in systems: energy bills, supplier contracts, procurement platforms and quality management systems where they exist. The first step is centralising what is already there before requesting what is missing.
Phase 3 — Calculation model design (4-6 weeks) Decide which methodology applies to each category (spend-based as the baseline, activity-based for significant categories and suppliers), which emission-factor database to use and how to handle suppliers providing primary data versus those calculated using averages.
Phase 4 — Technical implementation and integration (6-10 weeks) Connect ERP and procurement systems, load historical data, configure calculation rules, and define roles and permissions.
Phase 5 — Reporting and audit (4-6 weeks) Generate the report aligned with ESRS E1 and S2, an evidence dossier for the auditor, and a narrative connecting the figures to the transition plan.
6. How Voombu fits into this process
Voombu is an artificial intelligence-powered ESG management system. For the supply chain, the proposition is not to sell another platform; it is to provide the component connecting operational procurement data with regulatory reporting and the risk system.
The platform is structured around four integrated pillars: Automated reporting. Loads data from ERP, procurement and suppliers. Calculates mandatory ESRS E1 datapoints (including Scope 3 using both spend-based and activity-based methods) and ESRS S2 datapoints. Generates a draft report aligned with ESEF and XBRL.
ESG risk management under COSO ERM. A 5×3 matrix integrating supply chain risks (climate, social, regulatory) with the rest of the internal-control system. Findings involving significant suppliers trigger alerts in the risk module.
Dynamic ESG Score. A weighted indicator (Environmental 40 per cent, Social 35 per cent, Governance 25 per cent) evolving in real time with supply chain data. Can be linked to SLLs and financing terms.
Executive dashboard. A single view for management and the board, with drill-down to individual supplier data.
For consultancies specialising in supply chains or supplier sustainability, a multi-licence (MLC) option allows multiple clients to be managed from common infrastructure while maintaining data separation and visual customisation.
7. From compliance to competitive advantage
The usual response to supply chain regulation is complaint: more questionnaires, more reports, more cost without a return. That response is understandable but misses the point. Companies organising their chains with ESG discipline start gaining on three fronts:
Better-informed purchasing decisions. A company that knows each supplier's actual footprint can decide whether to pay more for a lower-emission alternative, require a reduction plan from the current supplier, or reorganise the chain. Without data, the decision is blind. Differentiated financial terms. Sustainability-linked loans (SLLs) offer margin improvements or penalties of around 5 to 15 basis points depending on KPI achievement. For a mid-market company, that differential on a multi-million-euro transaction more than offsets the cost of a serious management system. Supply chain screening. Major corporate customers are prioritising suppliers with structured ESG data. An SME that can answer a questionnaire within fifteen days wins tenders that an SME improvising its response loses. ESG is not compliance. ESG is commercial and financial strategy. The supply chain is where that strategy becomes reality or remains rhetoric.
8. Frequently asked questions
What is supply chain management in 2026? It is the strategic coordination of three flows across the value network: physical products, money and ESG information. The third flow has emerged over the past five years and has changed the procurement department's role the most. Without ESG data management, companies can neither report under the CSRD nor answer major corporate customers' questionnaires.
Is my company subject to the CSRD if it falls below the new thresholds? Under the Omnibus package, companies with fewer than 1,000 employees or turnover below 450 million fall outside the CSRD's direct scope. But that exclusion does not protect you from requirements imposed by customers obliged to report, who need your supply chain data to consolidate their own reporting.
How does the CSRD affect my suppliers? Your suppliers become information nodes needed to consolidate your report. If your corporate customer is subject to the CSRD, it will request data on footprints, working conditions and governance practices. You, in turn, will need to request it from your suppliers. The chain becomes transparent through commercial pressure, not direct regulatory penalties.
What is the difference between Scopes 1, 2 and 3 in the supply chain? Scope 1 covers direct emissions from your own fuels (fleet, boilers). Scope 2 covers indirect emissions from purchased energy (mainly electricity). Scope 3 covers all other indirect emissions, and is where the supply chain sits: purchased goods (category 1), upstream transportation (4), use of sold products (11), end-of-life treatment (12). For most companies, Scope 3 accounts for between 70 and 90 per cent of the total footprint.
How is a supplier's carbon footprint calculated? There are two approaches. Spend-based: monetary spending is multiplied by an average sector factor (kg CO₂ per euro). Fast and covers 100 per cent of the boundary from day one, but less precise. Activity-based: the physical quantity consumed (kg of material, kWh, kilometres) is multiplied by a specific factor. More precise, but requires primary supplier data. The usual practice is hybrid: spend-based across the full boundary, activity-based for significant suppliers and categories.
What is double materiality applied to the supply chain? It assesses which ESG topics are material on two simultaneous levels: the impact the company's activity, through suppliers, has on people and the environment; and the financial effect those topics may have on the company's balance sheet. Double materiality guides where to concentrate data capture and reporting efforts, preventing companies from trying to scrutinise every tiny detail of their supply chains.
Is auditing supply chain data mandatory? Yes, indirectly. The CSRD requires limited assurance of the sustainability report from the first reporting year. That report includes value chain data when material. Supply chain data therefore falls within the verification scope. More demanding reasonable assurance is under consideration for later stages, potentially from 2028-2030.
Is it worth investing in a dedicated platform or waiting? For a company with fewer than fifty significant suppliers and operations in one country, a well-structured spreadsheet can support the first reporting year. Beyond that threshold, the platform pays for itself: recovered finance-team time, a native audit trail reducing auditor hours, and the ability to answer customer questionnaires on time. A company organising its data in 2026 gains an advantage over one leaving it until 2027.
Next steps The supply chain is where ESG management stops being narrative and becomes operational. For a Spanish mid-market company in 2026, the sensible approach is to spend the first half of the year building the system — assessment, integration, first report — rather than spending the second half firefighting. Voombu supports mid-market companies and specialist consultancies in building that system. A 30-minute demo is usually enough to establish the starting point and outline a realistic 6-12-month plan.