customer wants to see our supplier code of conduct, do we need one

No, having your own code of conduct is not mandatory to answer the question

No. The question of whether you have a supplier code of conduct is a yes/no question about an instrument you may have — not an obligation that stems from legislation or regulation. VSME contains no requirement that you must draw up such a document. You simply answer with what is factually the case: if you have a code of conduct for your own suppliers, the answer is yes and you provide the document; if you do not have one, the answer is no.

If you are uncertain whether you have something that "counts" as a code of conduct, look at what is actually in place: if your purchasing terms and conditions already contain provisions on working conditions, human rights or the environment for suppliers, that document itself may already be the answer, even if it is not called a "code of conduct". If such a document is completely absent, then no is the honest answer — fabricating a code of conduct when nothing exists will raise more questions at your customer's first spot check than it saves now. This question is part of a broader section on the supply chain; for the connections also look at whether there is a policy on human rights in the supply chain and at whether there is a fixed reporting channel for violations, as customers often ask these three together.

Where this comes from: VSME core module, not a CSRD obligation

The question about a supplier code of conduct comes from the core module of the EFRAG VSME standard, the voluntary standard for unlisted SMEs. VSME itself imposes no obligation to have a code of conduct; it is one of the data points by which a larger buyer — often itself subject to CSRD under Directive (EU) 2022/2464 — gains insight into the supply chain of its own suppliers. For you as a supplier, it is therefore a question to report what exists, not a standard to comply with.