No, a code of conduct is not a legal obligation for most SMEs. What often happens instead: a customer, bank or insurer asks in the sustainability questionnaire whether you have one, and then it is not a question of whether it is required, but what is precisely meant by it and how detailed your answer needs to be.
In the voluntary EU standard for unlisted SMEs (VSME), the subject appears under the governance theme. It asks whether you have policies, practices or agreements on matters such as integrity, bribery and respect for human rights within your own organisation. This is different from an extensive, externally audited document with its own name and a signature from management.
What a code of conduct means in practice
A code of conduct is essentially a record of behaviour expected within a company: how you treat customers, suppliers and colleagues, what you do not do (bribery, discrimination, conflicts of interest) and what you do if someone raises a concern. Large, listed companies often document this in a formal document approved by the board and imposed on the entire chain. For an SME, this is rarely the case, and the VSME standard does not expect it either.
Does the VSME standard require a formal document
The standard asks whether practices and procedures exist, not in what form they are documented. An employee handbook with a section on undesirable behaviour, an internal agreement on how to deal with suppliers, or a standard procedure for hiring staff can already be part of the answer. What matters is that you can explain what happens in practice and, where possible, support it with something in writing.
What you should be able to show
Useful examples include an employee handbook, a whistleblower procedure if you already need to have one due to the size of your company, a purchasing condition on integrity towards suppliers, or simply an internal note stating what rules apply within the company. You can read the precise location of what the standard says about this in the official text on EUR-Lex; the overview by topic sorted out shows under which theme this precisely falls and what is and is not included.
Why your customer is asking about this anyway
Large customers who are themselves subject to reporting obligations must say something in their own reporting about how they manage risks in their value chain. A supplier's code of conduct is one of the building blocks for this. The same applies to banks and insurers, who sometimes want to know how a company manages integrity risks when providing financing or coverage. This explains why the question comes up, even though your own company has no direct legal obligation to have a code of conduct.
If you do not yet have a code of conduct
The absence of a formal document is not a problem in itself: the question in the questionnaire is usually meant to be descriptive, not evaluative. An honest answer about the practice that does exist is worth more than a copied document that does not fit how the company operates. If you still want to put something on paper, a short, tailored document with the main agreements is often sufficient for most questionnaires you will receive.
Documenting it without making a project of it
Because the same question will likely come up in the next questionnaire, it's practical to document once what's already happening in your organisation, and reuse it next time. This saves you the effort of figuring out again what exactly was asked and how you answered it previously. With a few questions you see where you stand now, and on the page about where the information comes from you can read how such a file, once built up, is reused in a subsequent questionnaire.
This article is descriptive in nature and does not replace legal or sustainability advice regarding your specific situation. If you are unsure whether a requested document is mandatory or voluntary, consult the official text of the standard or a lawyer. For most other questions about what may and may not be asked, you will find answers on the frequently asked questions page.
Would you like to quickly know if this is relevant for your organisation and what other topics appear in your questionnaire? Take the free quick-scan or browse through the topics; both can be accessed without an account.