Responsible procurement: the ISO 20400 standard and the RFAR label for SMEs

Quick answer. Responsible procurement rests on two distinct references: the ISO 20400 standard, guidance published in 2017 (non-certifiable) that brings social responsibility into the purchasing function, and the RFAR label (Responsible Supplier Relations and Procurement), awarded by the Médiateur des entreprises and the National Procurement Council, valid for 3 years and now adapted to small and mid-sized companies.

Procurement often represents more than half of a company's costs and most of its environmental and social footprint, concentrated in the supplier chain. Making purchasing reliable and greener has become a management topic, not just a procurement-department one. Two references structure this approach: an international standard, ISO 20400, and a French public label, the RFAR. They are often confused, sometimes to the point of talking about an ISO 20400 certification, which does not exist. This article clarifies what each covers, who they are aimed at, and how an SME can take them up without building a bureaucratic machine.

Responsible procurement integrates, beyond price and quality, environmental, social and ethical criteria throughout the supplier relationship: working conditions, carbon impact, fair practices, payment terms, economic dependence. It is not about paying more on principle, but about measuring and reducing the risks carried by the supply chain, while securing continuity of deliveries.

For an SME, the stake is twofold: meeting the growing demands of its large clients, who require CSR commitments from their suppliers, and limiting its own legal and reputation risks. Structuring these purchases is as much a matter of strategy as of tracking commitments, an area where CSR support brings method.

ISO 20400, published in 2017 under the title "Sustainable procurement: guidance", is the international reference standard on the subject. A key, often misunderstood point: it is a guidance document, not a set of auditable requirements. You therefore cannot be "certified ISO 20400". The standard recommends, it does not impose, and it is not designed to lead to a certification.

Concretely, ISO 20400 extends the ISO 26000 social responsibility standard by transposing its seven core subjects (governance, human rights, working conditions, environment, fair operating practices, consumers, communities) into the purchasing function. It is aimed at management (responsible procurement policy and strategy) and at operational buyers (integrating criteria into the process, from defining the need to evaluating suppliers).

The absence of certification does not reduce its usefulness: ISO 20400 serves as a recognised methodological framework. It is indeed on this reference that the RFAR label relies to evaluate organisations.

The Responsible Supplier Relations and Procurement (RFAR) label is the first and only label awarded by the public authorities in this field. It is jointly run by the Médiateur des entreprises (attached to the Ministry of the Economy) and the National Procurement Council. Where ISO 20400 provides a framework, the RFAR publicly attests to an organisation's maturity in its supplier relations.

Charter, evaluation and duration#

The approach starts with signing the charter, free but binding, which covers ten commitments (financial fairness, reduced payment terms, total cost of ownership, etc.). The label then validates, through an external evaluation, that these commitments are actually met.

Long reserved for large companies and public buyers, whose heavily document-based evaluation method was burdensome for a small structure, the RFAR label has been adapted to small and mid-sized companies. After a pilot phase with a few modest-sized companies, the evaluation method was lightened: reduced cost, and an assessment focused more on concrete results and the impact on subcontractors than on the formalisation of procedures.

For an SME, this is a game changer: recognition of a responsible procurement approach is no longer the preserve of large groups. It can become a differentiating argument in tenders, especially against clients who are themselves committed. The exact date of the operational opening of this SME version varies across sources: let us keep the principle, access is now open to small structures.

Beyond voluntary approaches, several texts govern procurement, but a distinction must be drawn between the obligations on companies and those aimed at public buyers.

• The duty of vigilance (law of 27 March 2017) requires a vigilance plan covering suppliers and subcontractors for companies with at least 5,000 employees in France, or 10,000 employees including abroad. The vast majority of SMEs are not directly concerned.
• The CSRD directive and the European duty of vigilance (CS3D) extend reporting and vigilance obligations over the value chain, but their scope was narrowed by the "Omnibus" simplification package adopted in early 2026: they now target very large companies.
• For public buyers, the Climate and Resilience law requires, by 22 August 2026 at the latest, at least one environmental consideration in every public contract, and a responsible procurement promotion scheme (SPASER) above 50 million euros of annual purchases. The AGEC law also imposes quotas of reused or recycled products.

For a private SME, these texts mainly play indirectly: its large clients, who are subject to them, pass their requirements on to their suppliers. It is this knock-on mechanism that makes a responsible procurement approach worthwhile, even without a direct obligation.

The trap, for an SME, is to aim for the label before structuring the approach, or conversely to believe that a costly "certification" is needed to be credible. Our advice: start with the fundamentals that ISO 20400 highlights and the label rewards, namely the quality of the supplier relationship and respect for payment terms. These are concrete, measurable commitments that also improve cash flow and the robustness of the supply chain.

The label comes next, as recognition of an already established practice, not as a starting point. Aligning these commitments with financial management and extra-financial reporting avoids working in silos.

An industrial SME with around fifty employees wants to bid on a tender from a large client that requires CSR commitments from its suppliers. Rather than aiming straight for the label, it sequences its approach over 12 months.

The first 3 months serve to map purchases and identify critical suppliers. Over the next 3 months, the company signs the Responsible Supplier Relations Charter and formalises a procurement policy integrating environmental and social criteria. Over the last 6 months, it reduces its supplier payment terms, sets up a simple evaluation of its main partners and documents its results. After these 12 months, it has a solid file, useful both for responding to tenders and, when the time comes, for aiming at the RFAR label. The cost of the approach stays contained, because it relies on operational commitments rather than a heavy audit.