Article

Sustainable procurement for mid-market companies: where to start

In brief

Expert insight — François Dequenne: the biggest mistake mid-market teams make is waiting until they have a perfect process. A documented, consistent starting point is worth more than a sophisticated system that does not exist yet.

The pressure to address supplier sustainability is no longer confined to large multinationals. Mid-market companies now receive sustainability requirements from their largest customers as a standard condition of doing business: RFPs include EcoVadis score thresholds, contracts reference supplier codes of conduct, Scope 3 questionnaires arrive from procurement teams upstream. These demands often arrive faster than a one-person sustainability function can respond. This framework sets out where to start, built for limited teams and real deadlines.

Why has sustainable procurement moved up the agenda?

Three forces are converging, regardless of sector.

Customer requirements. Large buyers are integrating ESG criteria into procurement at pace. The EcoVadis Sustainable Procurement Barometer 2026 found that 48% of buyers now have visibility of ESG practices for most of their Tier 1 suppliers — a major increase since 2024. That visibility is built through EcoVadis, supplier questionnaires and code-of-conduct compliance checks. Suppliers who cannot demonstrate their sustainability management risk losing tenders and preferred-supplier status.

Regulatory trickle-down. The EU Corporate Sustainability Due Diligence Directive (CSDDD, Directive 2024/1760) entered into force on 25 July 2024 and formally applies to large companies with more than 1,000 employees and more than €450 million in global turnover. Mid-market companies sit below that threshold — but the Directive requires those large companies to exercise due diligence across their value chains, so their compliance obligations flow directly to you as a supplier. Under the Omnibus simplification package (subject to formal adoption), transposition is proposed by 26 July 2027, with first application from 26 July 2028.

Scope 3 data demands. Customers pursuing science-based targets or CSRD compliance need emissions data from their supply chains. Currently, 30% of suppliers provide no carbon data whatsoever to their buyers. Companies that can provide reliable Scope 1, 2 and 3 data hold a measurable commercial advantage.

What do you need to understand before building anything?

The first step is understanding which sustainability risks and impacts are actually material to your supply chain. Selecting a tool or writing a policy before this step produces activity without direction. A manufacturing business buying raw materials, chemicals and logistics faces different risks from a software company buying IT infrastructure; sourcing from high-risk geographies carries different labour and human-rights exposure from buying entirely EU-based.

A basic materiality mapping — spend categories, suppliers' industries and geographies, and the risks associated with each — gives the foundation for a proportionate programme. It does not need to be complex: a spend analysis by category with a risk overlay using publicly available tools is enough to produce a working priority list.

Step 1: how do you map your supply base?

Pull your procurement data and segment suppliers by spend, category and geography. Identify the top 20% by spend — this tier typically accounts for 80% of your procurement risk and impact. For each segment, ask three questions: what sustainability risks are associated with this industry or geography? What is the potential impact if something goes wrong? How much influence does the business have over this supplier?

The intersection of high risk and high influence is where the programme starts. Mid-market companies rarely have the bandwidth to manage hundreds of supplier relationships with equal intensity: a tiered approach — deep engagement with the top 20%, lighter-touch requirements for the rest — is both realistic and defensible to customers and auditors.

Step 2: how do you set your baseline?

A supplier sustainability assessment builds a systematic picture across the four areas that matter most: environmental practices, labour and human rights, ethics and anti-corruption, and sustainable procurement. For companies already receiving EcoVadis requests from their own customers, this is the moment to assess suppliers using the same framework — EcoVadis evaluates over 21 criteria tailored to each supplier's industry, size and geography, and running your own buying programme through it gives verified data and the beginnings of a defensible programme record. For suppliers not yet on EcoVadis, a structured self-assessment questionnaire covering the same four themes is a workable starting point.

Step 3: which policies do you build?

Three policy documents form the minimum viable foundation:

A supplier code of conduct — minimum standards expected from all suppliers; clear, signed or acknowledged, and referenced in contracts.
A sustainable procurement policy — how the organisation approaches supplier selection, assessment and management with sustainability criteria included.
A supplier risk assessment process — how sustainability-related supplier risks are identified, prioritised and managed; the materiality mapping formalised into a repeatable annual process.

Together they satisfy the EcoVadis Sustainable Procurement theme requirements, demonstrate due diligence to customers, and create the paper trail that CSDDD and CSRD disclosures will eventually require.

Step 4: how do you engage, measure and improve?

Governance, communication and review cadence turn static documents into a working system. For priority suppliers: send the code of conduct, request acknowledgement or signature, initiate an assessment through EcoVadis or a comparable framework. For lower-priority suppliers, a simple declaration of compliance is a reasonable start.

Set a realistic year-one target: a completion rate across the top tier, a baseline score distribution, a list of suppliers needing corrective action. Review quarterly; report to leadership; connect the data to your own EcoVadis assessment under Sustainable Procurement — the theme where companies most commonly score below their potential. The supplier engagement data also feeds your Scope 3 Category 1 calculations: for companies also working on their carbon footprint, the investment delivers twice the value.

The organisations that start now — ahead of the next customer requirement, before the next tender includes a minimum EcoVadis threshold — build durable capability. Those that wait respond under pressure instead.

Key takeaways

Triple pressure: customer requirements, CSDDD trickle-down, Scope 3 data demands — all three accelerating.
Start with materiality: map spend categories against sustainability risks before choosing tools or writing policies.
Segment the supplier base: deep engagement with the top 20% by spend beats shallow coverage of everyone.
Three documents are the minimum viable policy foundation: supplier code of conduct, sustainable procurement policy, risk assessment process.
EcoVadis provides a standardised framework that satisfies customer requirements, supports your own Sustainable Procurement score, and produces the data trail disclosures increasingly require.

Frequently asked questions

How can we engage our suppliers, and how important is it?

Start proportionate: map your supply base, engage deeply with the top 20% by spend (typically 80% of your procurement risk), and set lighter-touch requirements for the rest. It matters commercially: buyers now build EcoVadis thresholds into RFPs, and Sustainable Procurement is the theme where companies most commonly score below their potential.

Which policy documents does a credible programme need?

Three: a supplier code of conduct (external, signed or acknowledged, referenced in contracts), a sustainable procurement policy (internal approach to selection and management), and a documented supplier risk assessment process. Together they satisfy the EcoVadis Sustainable Procurement theme and create the paper trail CSDDD and CSRD will require.

Does the CSDDD apply to mid-market companies?

Not directly — Directive 2024/1760 formally applies to companies with more than 1,000 employees and €450 million turnover. But those large customers must exercise due diligence across their value chains, so their obligations flow to you as a supplier. Under the Omnibus package, transposition is proposed by 26 July 2027, first application from 26 July 2028.