Supplier data management is one of the most critical — and most often neglected — areas of business. Yet in most companies, information about suppliers is scattered across email threads, outdated Excel files and people’s heads — or it’s missing altogether.
The reason isn’t indifference. The reason is that the necessary information is rarely public. A supplier’s emissions, subcontractor network, financial stability, certificates — you won’t find these in the trade register or on websites. They have to be asked for directly — and that’s easier said than done.
A supplier network can consist of dozens or even thousands of companies. Each one is different: a different size, a different industry, a different ability or willingness to answer surveys. At the same time, the buying company’s resources are limited — data collection competes with other operational work. The result can easily be a situation where the data is incomplete, outdated and of varying quality from one supplier to the next.
This isn’t just an operational problem. Incomplete supplier data is a business risk — and increasingly the basis for statutory requirements too.
Why is this topic critical right now?
Supplier data management isn’t new — but its importance has changed dramatically in recent years. It used to be enough for a supplier to deliver the agreed product at the agreed price within the agreed time. Now the questions are broader: How does the supplier treat its employees? What is its carbon footprint? Is its subcontractor chain transparent?
These are no longer just ethical questions. They are statutory requirements — and the range of requirements is growing fast.
CSRD — the sustainability reporting directive
The Corporate Sustainability Reporting Directive requires large European companies to report on their sustainability performance in detail and in an auditable way. A key part of the reporting is so-called Scope 3 emissions — the emissions that arise in the company’s value chain, including the supply chain. The ESRS’s S2 section also requires information on workers in the value chain. This information can’t be reported without data obtained from suppliers.
The CSRD applies directly to large companies, but the requirements inevitably trickle down. When a large customer has to report the emissions of its supply chain, it starts requiring information from its suppliers — SMEs included.
CSDDD — the due diligence obligation extends across the entire chain
The Corporate Sustainability Due Diligence Directive requires companies to identify, prevent and remedy adverse impacts on human rights and the environment across their entire value chain. In practice, this means being able to systematically assess suppliers’ practices, risks and subcontractors.
The directive has just undergone a significant change as part of the EU’s Omnibus I package. The application threshold was raised to 5,000 employees and €1.5 billion in turnover, and the obligations will take effect uniformly only in 2029. So the timelines shifted — but the direction didn’t change.
SMEs are not directly within the scope of the CSDDD, but the practical impact is still real. The large companies covered by the directive are starting to require additional information, standards and documented evidence from their suppliers — in purchasing terms, contracts and risk-based assessments. The requirement doesn’t come directly from the law — it comes from the customer.
The Finnish Public Procurement Act and the public sector
In public procurement, sustainability criteria are already commonplace. Bidders are increasingly required to provide documented evidence that environmental and social requirements are met. Assurances alone aren’t enough — there needs to be a system in place that produces reliable data repeatedly.
Customer pressure — a quiet but powerful driver
Alongside legislation, customer pressure is growing. Companies that are already well advanced in their sustainability work are starting to set requirements for their own suppliers. This doesn’t always come as an official survey — it may come as an attachment to a request for proposal, as a contract term or simply as a question: “Do you have data on this?”
A company that doesn’t have the answer loses its competitive edge.
Upcoming legislation and legislation in preparation
Regulation isn’t finished — on the contrary. Several regulatory initiatives are in preparation that will further increase the requirements placed on supply chains.
The EU Forced Labour Regulation prohibits the sale of products made with forced labour on the EU market — covering both products made in the EU and imported products, regardless of industry or company size. It will apply from 14 December 2027. In practice, this means companies must be able to demonstrate that their supply chain is clean in this respect as well.
The EU Deforestation Regulation (EUDR) enters its application phase at the end of 2026 for large and medium-sized companies. It requires traceability, risk assessment and documented measures for regulated commodities — such as wood, soy, palm oil, cocoa and coffee, as well as other commodities. Supply chain transparency is no longer optional.
The Carbon Border Adjustment Mechanism (CBAM) requires companies importing into the EU to declare the carbon emissions of the goods they import and to purchase the corresponding carbon certificates. Full application began at the start of 2026. However, following Omnibus I, the obligation applies only to importers whose annual CBAM imports exceed 50 tonnes — a large share of smaller importers are exempted from the obligations entirely. Responsibility for obtaining emissions data nevertheless remains with the importer, regardless of the length of the supply chain.
The Ecodesign for Sustainable Products Regulation (ESPR) will affect almost all product groups. It sets requirements for products’ energy efficiency, recyclability, repairability and environmental footprint across the entire lifecycle. Products will get a digital product passport that tracks the product’s entire lifecycle — and requires data from along the supply chain as well.
Taken as a whole, EU regulation is systematically building a system in which responsibility for supply chain impacts shifts ever more clearly to the buying company. The timelines may shift — the basic direction won’t.
What to collect from suppliers — and what not to
One of the most common mistakes in supplier data management is collecting too much — or collecting the wrong things. A long survey that tries to cover everything at once creates two problems: suppliers don’t bother to respond, and the answers are superficial.
The starting point should be the question: what information is actually needed to support decision-making?
In practice, supplier data falls into four categories, each with its own purpose.
1.Basic information and financial stability
Before anything else, you need to know who you’re dealing with. Business ID, ownership structure, turnover, headcount — these form the foundation on which everything else is built. Financial stability indicates delivery reliability: a supplier in financial difficulty is a supply chain risk, no matter how good its product is.
2.Quality and certificates
Does the supplier have relevant certificates — ISO 9001, ISO 14001, industry-specific standards? Certificates aren’t an end in themselves, but they show whether quality management is systematic or rests on promises alone. It’s also important to know the validity periods — an expired certificate is the same as no certificate.
3. Sustainability and environmental data
This is the category whose importance is growing fastest. A supplier’s carbon footprint, emission reduction targets, energy sources and subcontractor chain transparency — this information is directly linked to the regulations mentioned in the previous section. With the CSDDD, human rights practices, working conditions and codes of ethics also fall into this category.
4.Governance and risk management
Does the supplier have a documented risk management process? A business continuity plan? Information security practices? These questions feel bureaucratic — until the supplier goes under, falls victim to a cyberattack or one of its subcontractors turns out to be in a high-risk country.
Prioritisation is key
There’s no point asking everyone for everything. From critical suppliers — those that account for a large share of purchases or would be difficult to replace — a more extensive information package is collected. For smaller and lower-risk suppliers, a more limited set of basic information is enough. This isn’t a shortcut, but a sensible allocation of resources.
The need for supplier information also changes over time. Information collected once becomes outdated — certificates expire, ownership changes, the financial situation shifts. Data collection isn’t a project, it’s a process.
Two perspectives on supplier data management
Supplier data management is often discussed in only one direction — what you collect from your suppliers. But an equally important question is: what are you yourself being asked?
A company that is itself in someone else’s supply chain will sooner or later receive a survey from its customer. It may come as an attachment to a request for proposal, as part of a contracting process or as a separate sustainability survey. It often comes unexpectedly and on a tight schedule.
These two perspectives are worth keeping in mind side by side.
When you collect information from your suppliers
A supplier survey is an effective way to collect structured data — but only if it’s well designed. A survey that is too long wears out the respondent. Questions that are too open-ended produce answers that can’t be compared. A survey sent by email without a reminder system goes completely unanswered in half of cases.
A well-built survey is concise, structured and targeted. It asks exactly what is needed — not everything possible. It’s sent to the right person, at the right time, with the right message. And behind it is a clear idea of what will be done with the collected data — otherwise the survey is just an administrative exercise.
It’s worth thinking about the desired answer format in advance. Data from open answers is harder to use than data from structured answers. So favour multiple-choice or single-choice questions over open text fields.
The most common mistakes are easy to recognise: asking too much at once, collecting data but leaving it unused, storing information somewhere it can no longer be found six months later, and not maintaining the data on a regular basis.
When a customer asks you
This perspective is often overlooked — until the survey arrives. That’s when you notice that answering takes a surprising amount of time, information has to be dug up from many different places, and some of the questions can’t be answered at all.
It pays to manage your own data proactively — not just because the law requires it, but because it makes everyday work easier. Certificates, emissions calculations, energy consumption data, subcontractor lists, codes of ethics — this is information that is being asked for more and more often. A company that has it in order and readily available answers surveys smoothly and credibly. A company that doesn’t loses credibility — or the deal.
A good rule of thumb: if you can’t answer your own supplier survey in under an hour, you have the same problem as your suppliers. So build a ready-made database from which the answers you need can easily be pulled for different purposes.
Supplier data is a competitive advantage — if it’s in order
Supplier data management isn’t just an administrative necessity. It’s a strategic issue that affects risk management, reporting capability and how credible the company is in the eyes of its customers.
Regulation is tightening, customer expectations are rising and supply chain transparency requirements are increasing. Companies that get their supplier data management in order now will meet these requirements smoothly. Companies that wait will respond in a rush and incompletely.
A good starting point is simple: do you know right now what information you have about your suppliers — and where it is?
Would you like to assess your own situation?
We help you find out what shape your supplier data is in right now and what you should do next. Get in touch — the conversation costs nothing.
One response to “Supplier data management – why missing data is a business risk”
[…] practice, this means things like risk mapping, supplier assessments, contract terms, training and, where necessary, ending business relationships if a supplier fails […]