How to Respond to a European Buyer's Supply Chain Due Diligence Questionnaire

Your German coffee buyer just sent a 14-page supply chain due diligence questionnaire. It asks for Scope 1 and 2 emissions data, geolocation coordinates for every production plot, labour rights documentation, anti-corruption policies, and a grievance mechanism you have never built. The deadline is 30 days. You have no dedicated sustainability team, no centralised data system, and no template for this kind of request. If you cannot respond, the buyer will find a supplier who can.

This is not a hypothetical scenario. It is happening right now to SME exporters across Tanzania, Uganda, Rwanda, and Ethiopia. European buyers are legally required, under the Corporate Sustainability Due Diligence Directive (CSDDD) and the Corporate Sustainability Reporting Directive (CSRD), to collect structured environmental, social, and governance data from every supplier in their value chain. The obligation is binding, the enforcement carries penalties up to 3% of global turnover, and the timelines are already running.

This article walks you through a five-step process for building a structured response capability from scratch, so that the next questionnaire that arrives is answered in days, not weeks, and your buyer relationship is strengthened rather than lost.

Why acting now protects your contracts

The pressure behind these questionnaires is not voluntary corporate responsibility. It is law. CSDDD (Directive (EU) 2024/1760), as amended by the Omnibus I Directive, requires EU companies with more than 5,000 employees and EUR 1.5 billion in turnover to conduct human rights and environmental due diligence across their entire chain of activities, including non-EU suppliers. Transposition is required by July 2028, with obligations applying from July 2029.

CSRD already requires approximately 4,000 to 6,000 EU companies to report under European Sustainability Reporting Standards (ESRS), including Scope 3 emissions and value chain worker conditions. Those reports need supplier data. That data request lands on your desk as a questionnaire.

For East African exporters, the commercial exposure is direct. EU imports from Tanzania, Uganda, Ethiopia, and Rwanda totalled approximately EUR 2.8 billion in 2024. Coffee alone accounts for 22% of Uganda's total exports, with at least 60% consumed in the EU. If you are in a European buyer's supply chain, their compliance obligation has effectively become yours.

What you need before starting

Before working through the five steps below, gather the following:

• 12 months of operational data: electricity bills, fuel purchase records, water utility statements, and waste disposal receipts. These do not need to be in any particular format yet, but they must exist.
• Employment records: headcount by gender, contract types, wage records relative to national minimums, occupational health and safety incident logs.
• Business registration and environmental permits: your operating licence, any environmental impact assessment documentation, and tax compliance certificates.
• Your buyer's questionnaire itself: read it before doing anything else. Most questionnaires follow a standard structure aligned with EcoVadis, Sedex SMETA, or CDP Supply Chain formats. Identifying which platform your buyer uses determines what format your response must take.

Realistic timeline: a first-time response will take 4 to 8 weeks. Subsequent responses, built on structured data, should take days.

Step 1: Map what your buyer is actually asking for

European supply chain questionnaires look different depending on the platform, but the underlying data categories are remarkably consistent. When JDE Peet's, Neumann Kaffee Gruppe, Tesco, or Albert Heijn send their requirements, they are asking for data across four domains.

Environmental data covers greenhouse gas emissions (Scope 1 from fuel and fleet, Scope 2 from purchased electricity), energy consumption, water withdrawal, waste generated, and, for agricultural commodities, deforestation-free assurance with geolocation data. Under EUDR (Regulation (EU) 2023/1115), coffee and cocoa exporters must provide GPS coordinates for production plots, with polygon mapping required for farms larger than four hectares.

Social data covers workforce composition, wages relative to local benchmarks, working hours, freedom of association, health and safety metrics (total recordable incident rate), and, critically under ESRS S2, documentation of how worker rights are protected for employees in the supplier's operations.

Governance data covers anti-corruption policies, business ethics codes, whistleblower and grievance mechanisms, and data protection practices. ESRS G1 requires buyers to describe their supplier codes of conduct and anti-corruption enforcement along the value chain.

Traceability and chain of custody is a fourth category emerging specifically from EUDR. For coffee, cocoa, and timber exporters, this means farm-level identification, deforestation risk assessment, and documentary evidence of legal production.

What to do now: take your buyer's questionnaire and mark each question against these four domains. Identify which data you already have (even in scattered form), which data exists but is not compiled, and which data does not exist at all. This gap map is your action plan.

Step 2: Build your environmental data foundation

Start with Scope 1 and Scope 2 emissions, because this is the data point that appears in every questionnaire, every framework, and every buyer platform.

Scope 1 covers direct emissions from sources you own or control: fuel burned in generators, vehicles, and production equipment. Collect 12 months of fuel purchase records (litres of diesel, petrol, LPG) and apply standard emission factors. The GHG Protocol provides freely available factors by fuel type.

Scope 2 covers indirect emissions from purchased electricity. Collect 12 months of electricity bills (kWh consumed). Multiply by your national grid emission factor. Tanzania's grid factor is approximately 0.3 to 0.5 kg CO2/kWh depending on the generation mix; Uganda's and Rwanda's are lower due to higher hydroelectric shares; Ethiopia's is among the lowest in Africa due to its hydropower-dominated grid.

Energy consumption should be recorded as total MWh from all sources, with the renewable percentage noted separately.

Water and waste require simpler tracking: monthly water utility records (cubic metres withdrawn) and waste disposal records (tonnes generated, disposal method, any recycling or diversion).

For agricultural exporters specifically, begin GPS mapping of production plots if you have not already. Uganda's coffee sector is already registering farmers and testing satellite-based assessment through Enveritas, but EUDR still requires farm-level geolocation and physical traceability. The ITC MARKUP programme has published a detailed handbook for Ugandan coffee exporters covering these requirements step by step.

Common mistake: waiting for perfect data before reporting anything. Buyers and platforms accept estimated data clearly labelled as such. A structured response with clearly noted estimation methodologies is far better than no response.

Step 3: Compile your social and governance documentation

Social data is where many East African SME suppliers underestimate the requirement, and where CSDDD adds the sharpest new obligations.

Labour documentation should include: total workforce headcount disaggregated by gender and contract type (permanent, temporary, seasonal), evidence that wages meet or exceed national minimum wage, overtime records, and freedom of association policy. If you employ seasonal workers during harvest, document the terms and conditions of their engagement.

Health and safety records should include: a log of workplace incidents (injuries, fatalities, near-misses), your total recordable incident rate (TRIR), evidence of safety training, and provision of personal protective equipment. Sedex's SMETA audit methodology, used by over 100,000 businesses globally, places particular emphasis on health and safety documentation.

Governance documentation should include: a written anti-corruption policy (even a one-page statement is better than nothing), a code of business conduct, and a grievance mechanism through which workers or community members can raise complaints. Under CSDDD, your European buyer is required to demonstrate that a functioning grievance process exists at the supplier level. If you do not have one, they cannot complete their own compliance.

What to do now: create a single document folder, physical or digital, labelled "Supplier ESG Disclosure Package." Place all labour records, safety logs, policies, and permits in this folder. This is the package you will submit. If a policy does not exist, write it. A clear, honest two-page anti-corruption policy that your management has signed is more credible than no policy at all.

Step 4: Structure your response for the buyer's platform

Your buyer is almost certainly using one of three major platforms: EcoVadis (over 175,000 rated suppliers, used by more than 1,400 procurement leaders managing EUR 2 trillion in spend), Sedex (100,000 businesses, 120,000 registered worksites, over 450,000 SMETA audits conducted), or CDP Supply Chain (approximately 270 large corporate buyers requesting disclosure from 45,000 suppliers).

Each platform has a different interface but asks for the same core data. Your job is to translate the raw data from Steps 2 and 3 into the format your buyer's platform requires.

If your buyer uses EcoVadis: you will complete an online self-assessment questionnaire covering environment, labour practices, ethics, and sustainable procurement. Upload supporting documents (policies, certifications, emissions calculations). EcoVadis scores suppliers on a 0 to 100 scale. Africa and the Middle East showed the fastest growth in rated companies, with a 42% increase in a recent period.

If your buyer uses Sedex: register on the Sedex platform, complete the Self-Assessment Questionnaire (60% of Sedex SAQs are completed in under a day), and share your profile with your buyer. If your buyer requires a SMETA audit, plan for a third-party audit covering labour standards, health and safety, environment, and business ethics. Approximately 30% of SMETA audits occur at indirect supplier sites, and 24% at sites with fewer than 30 workers, so the audit process is designed for SME scale.

If your buyer uses CDP Supply Chain: you will receive a disclosure request through CDP's online system, covering climate change, water security, and forests. The questionnaire is standardised and aligned with IFRS S2.

What to do now: ask your buyer which platform they use. Register on that platform before you have all data ready. The registration process itself is often the longest administrative step.

Step 5: Build the infrastructure for recurring responses

The first questionnaire response is the hardest. Every subsequent response should be faster, cheaper, and more complete, but only if you build the right infrastructure now.

Assign internal ownership. One person in your organisation must own ESG data collection. This does not require hiring a sustainability manager. In most East African SMEs, the operations lead or finance manager can add ESG data compilation to their quarterly workflow. The IFC provides sector-specific ESMS Implementation Handbooks for crop production, food and beverage, textiles and apparel, and construction that can serve as operational templates.

Establish a quarterly data collection cycle. Collect environmental data (energy, water, waste, fuel) monthly or quarterly. Update social data (headcount, incidents, training) quarterly. Review governance documentation annually. This rhythm means that when the next questionnaire arrives, you are updating a file rather than building one from scratch.

Pursue relevant certifications strategically. Fairtrade, Rainforest Alliance, GlobalG.A.P., and LEAF Marque certifications can strengthen your response and demonstrate commitment to buyers. However, certification alone is not sufficient for CSDDD or EUDR compliance. An IISD analysis of Voluntary Sustainability Standards in East Africa confirms that these schemes improve farm-level practices but do not automatically satisfy mandatory due diligence laws, which require company-level risk assessment, grievance mechanisms, and governance structures beyond certification. Use certifications as evidence within your broader disclosure package, not as a substitute for it.

Track your response time. The commercial advantage of structured data is speed. When a buyer sends a questionnaire to five suppliers and one responds with verified data in 48 hours while the others take three weeks, the fast responder signals lower risk and higher reliability. That signal translates directly into contract retention and, increasingly, preferential pricing.

The old way vs. the new reality

The old way. A Tanzanian coffee cooperative receives a Scope 3 questionnaire from a German roaster. The operations manager spends two weeks calling individual farms for production data, manually entering figures into a spreadsheet, and guessing at emission factors. The numbers do not reconcile. The response arrives nine days past the deadline. The roaster flags the supplier as "high risk, incomplete data" and begins conversations with a Kenyan competitor that responded in four days with a clean, platform-verified dataset.

The new reality. The same cooperative maintains a quarterly-updated environmental data file. GPS coordinates for production plots are already registered. Labour records are compiled in a standard format. When the questionnaire arrives, the operations manager exports the relevant data, uploads it to the buyer's platform, and submits within 48 hours. The roaster categorises the supplier as "low risk, data-verified." The contract renews with a longer tenure and a discussion about sustainability-linked pricing.

The difference is not resources. It is infrastructure.

What this changes for SMEs in East Africa

If you are an operations lead at an agribusiness SME in Uganda or Ethiopia exporting coffee to the EU

• EUDR enforcement for large and medium operators begins December 2025, with micro and small enterprises covered from June 2026. Your buyer needs geolocation data and deforestation-free assurance now, not when you feel ready.
• JDE Peet's has signed MOUs with Rwanda, Ethiopia, Tanzania, and Uganda specifically to secure EUDR-compliant supply chains. Neumann Kaffee Gruppe's NKG Verified initiative and Volcafe's Sustainability Strategy are driving similar data requirements to your operations.
• Buyers increasingly tie ESG performance to contractual and financial terms. CDP data shows that suppliers receiving training and financial incentives from buyers are significantly more likely to set science-based targets, meaning the relationship deepens for those who engage.

If you are a supply chain manager at a manufacturing or textiles SME in Tanzania or Ethiopia

• CSDDD will require your European buyer to document human rights and environmental due diligence at the supplier level. They will need your labour data, safety records, and governance documentation on a recurring basis.
• UNIDO and GIZ are working on improving ESG standards in Ethiopian textile industrial parks, including Hawassa. Aligning with these programmes now builds the documentation that your buyer will request later.

In the next 12 to 24 months

Expect EUDR enforcement to become operational, CSDDD transposition to accelerate across key EU member states (Germany, France, Netherlands, Belgium), and the number of buyer questionnaires arriving at East African suppliers to increase as CSRD reporting cycles require supplier data. The suppliers who build structured response capability in 2026 retain contracts. Those who wait until 2028 compete against suppliers who have two years of verified data history.

What you should do now: complete Steps 1 and 2 within the next 30 days. Register on your buyer's preferred platform. Assign internal ownership for ESG data. The investment is measured in hours of staff time, not in capital expenditure. The return is measured in contracts retained.

The bottom line

European supply chain due diligence is not a trend that might reverse. It is embedded in binding EU law, enforced through supervisory authorities with penalty powers, and operationalised through procurement platforms that 175,000 suppliers are already using. The question for East African SME exporters is not whether this affects your business. It is whether you respond with structured data or lose the contract to a competitor who does.

The five steps in this guide require no specialist consultants, no enterprise software, and no sustainability team. They require operational discipline, structured data collection, and a willingness to treat buyer questionnaires as a commercial priority rather than an administrative burden.