Most of industry will be a Downstream User (DU) as this covers anyone buying in , handling or supplying chemicals that are already Registered. If you supplier has not covered your, the DU can prepare their own ES and can even prepare their own CSR using the Robust Summary from the Registrant. This sounds easy, but communication routes will be complex.
The only legal obligation of the DU is to inform the supplier of any adverse effects noted, such as health problems with workers exposed to the substance. The DU does not have to inform their supplier of the use patterns and can keep commercial applications secret. However, if using for a non-Registered use, the DU will need to inform ECHA if a new CSR is required.
It is recommended that DUs provide basic use information to suppliers, following guidance in Chapter r-12 of the technical guidance.