ESRS S2 Workers in the Value Chain: A CSRD Guide

Your payroll shows the people you employ. ESRS S2 asks about the people you don't: the machine operators at a supplier, the drivers who deliver your goods, the cleaners and security staff on your own sites who work for someone else. If your business depends on them and could harm them, the CSRD wants you to say what you know and what you do about it.

This guide covers who counts as a value chain worker, what the five S2 disclosure requirements ask for, where the data comes from, and what the Omnibus changed. It sits beside the overview of the whole value chain, which treats S2 in a few lines.

What is ESRS S2?

ESRS S2 is the social standard for workers in the value chain. It looks at how your operations, products, services and business relationships affect them, and at the related risks and opportunities for you. It covers three areas: working conditions, equal treatment and opportunities, and other work-related rights such as child labour, forced labour, housing and privacy.

S2 is topical. It applies only where your double materiality assessment finds value chain workers material. If you conclude they are not, you explain why.

Who counts as a value chain worker

The line is drawn against ESRS S1. S1 covers your own workforce: employees, self-employed people and workers supplied by employment agencies. S2 covers everyone else who is or could be materially affected:

• Workers at suppliers, on the supplier's premises, and deeper in the chain where raw materials are extracted or grown.
• Workers at downstream businesses, such as distributors, franchisees and customers' sites.
• Workers in joint ventures.
• Workers on your own sites who are employed by a third party, such as outsourced catering, security or equipment maintenance staff.
• Groups the standard flags as especially vulnerable: migrant workers, home workers, women, young workers and trade union members.

The last bullet is where assurers push. A supplier list says who you buy from. It doesn't say who those suppliers employ or how.

The five disclosure requirements

Under the standard in force today, S2 has five disclosure requirements.

Requirement	What it asks
S2-1 Policies	Which policies cover value chain workers, whether they apply to specific groups or all, and how they align with international instruments such as the UN Guiding Principles on Business and Human Rights.
S2-2 Engagement	How you engage with value chain workers, or their representatives, about the impacts on them.
S2-3 Remediation and channels	How you remedy negative impacts you are connected with, and the channels workers can use to raise concerns.
S2-4 Action	What you are doing about material impacts, risks and opportunities, and whether it works. This includes saying whether severe human rights issues and incidents have been reported in your value chain and, where they have, disclosing them.
S2-5 Targets	The targets you set to manage material negative impacts, advance positive ones and manage risks and opportunities.

S2 has few mandated numbers compared with ESRS E1. Most of it is evidence of a process: policies, engagement, remediation, actions and targets. That makes it quieter to prepare than climate, but harder to fake.

Where the data comes from

The hard part is not writing S2-1. It's knowing enough about people you don't manage to say anything true. A workable order:

1. Map the chain by risk, not by spend. Start with the countries, sectors and categories where forced labour, child labour or unsafe work are most likely, then rank suppliers within them.
2. Use what you already have. Supplier codes of conduct, audit reports, certification schemes, complaints logs and procurement questionnaires are all inputs. Pull them into one place. A data collection gap analysis shows what is missing.
3. Ask suppliers only what you can use. Long questionnaires get long, empty answers. Ask a few questions tied to the risks you ranked.
4. Reach workers, not just management. S2-2 and S2-3 are about workers themselves, or their representatives. A grievance channel that only a supplier's HR team can see won't satisfy either.
5. Write down the gaps. Where your data is estimated or missing, say so. The standard rewards candour about method more than a confident number.

What the Omnibus changed

The Omnibus, Directive (EU) 2026/470, changes who reports and how far down the chain you have to reach. It doesn't remove S2.

• Fewer reporters. The scope is one cumulative test: more than 1,000 employees and more than €450M net turnover. Both must be exceeded. See the Omnibus guide and the timeline.
• A value chain cap. It protects undertakings with 1,000 employees or fewer, so large reporters can't be required to collect more than a set minimum from them. Small suppliers still sit inside the chain you assess. What the cap changes is how much you can ask of them. For a supplier that gets your questions anyway, VSME reporting is the proportionate way to answer.
• Limited assurance only. The step-up to reasonable assurance was dropped. See assurance requirements.
• No sector-specific ESRS. The power to adopt them was removed. A garment brand and a software firm use the same S2. Their materiality outcomes will differ.
• Revised ESRS are coming. The Commission committed to revise the first set by delegated act. EFRAG's technical advice proposes cutting S2 to four requirements, with engagement, channels and remedy merged into one. That is a proposal. Until the revised standards are adopted, the five requirements above are what your report is written against.

Where S2 meets other topics

S2 evidence rarely stays in S2. The same supplier work feeds business conduct reporting under G1, including payment practices. It also supports the minimum safeguards test in EU Taxonomy alignment. If you already run supplier due diligence for another reason, start from that file rather than a blank page.

Common mistakes

• Treating S2 as a Scope 3 sibling. It isn't a spend-based calculation. A supplier's carbon number says nothing about its workers.
• Stopping at tier one. Your highest risks are often further down, in raw materials and subcontracted labour.
• A policy with no channel. S2-1 on its own looks good. S2-3 is where it falls apart.
• Reading the cap as an exemption. It limits what you collect from small suppliers. It doesn't make their workers immaterial.
• Claiming no incidents without looking. "None reported" is a statement about your channels as much as your chain.

Where a consultant helps

S2 is where a reporter needs judgement, not software: ranking risk across a supplier base, designing a grievance route workers will use, and writing a gap statement an assurer will accept. Look for someone who has built supplier due diligence, not only reporting templates. Our guide to hiring a CSRD consultant covers how to check that, and the industry guide shows which sectors tend to find S2 material.

Are you a CSRD consultant? Get listed.