EXECUTIVE SUMMARY
Reassess your reporting position under the revised CSRD before committing resources. Scope, transitional provisions and national implementation determine whether and when an organisation must report. For those remaining in scope, double materiality, reliable data, governance and assurance remain central. Review the applicable ESRS, adjust value-chain information requests and assign owners for the reporting process. Organisations outside mandatory scope should assess whether voluntary reporting meets business needs. Check company-specific obligations against the applicable legal text.
What Is the CSRD
The Corporate Sustainability Reporting Directive (CSRD) is the EU's framework for mandatory sustainability reporting. It replaced the Non-Financial Reporting Directive (NFRD) and requires companies to report detailed environmental, social, and governance information using the European Sustainability Reporting Standards (ESRS), with independent assurance and digital tagging when the applicable ESEF rules require it.
The CSRD was adopted in 2022 and began applying in stages from January 2024. It was designed to bring sustainability reporting to the same level of discipline and fidelity as financial reporting, embedding it in the management report, requiring assurance, and mandating a double materiality assessment that considers both the organisation's impact on sustainability matters and the financial risks and opportunities those matters create.
The Omnibus amendments changed the scope and requirements of that framework. On 26 February 2026, the Omnibus I Directive, officially Directive (EU) 2026/470, was published in the Official Journal of the European Union, fundamentally reshaping the scope, timeline, reporting standards, and several key obligations of the CSRD. The directive enters into force on 18 March 2026 and must be transposed by Member States by 19 March 2027.
The Omnibus Overhaul: What Changed
The Omnibus I Directive is the result of the European Commission's February 2025 simplification proposal, a provisional agreement reached in December 2025, European Parliament adoption on 16 December 2025, and final Council adoption on 24 February 2026. It was driven by competitiveness concerns articulated in the Draghi and Letta reports, and responds to industry feedback that the original CSRD scope and ESRS complexity were disproportionate for many companies.
The main changes are summarised below.
The revised thresholds narrow the reporting population.
Before Omnibus (Original CSRD)
- Scope: ~49,000 EU companies
- Thresholds: 250+ employees, €40M turnover, €20M assets (2 of 3)
- Listed SMEs in scope (Wave 3)
- Full ESRS Set 1
- Sector-specific ESRS planned
- Limited assurance transitioning to reasonable assurance
- Phased implementation: Waves 1–4 (FY 2024–2028)
After Omnibus (Directive 2026/470)
- Scope: significantly narrowed
- Thresholds: more than 1,000 employees on average during the financial year and annual net turnover exceeding €450 million
- Listed SMEs removed from scope
- EFRAG's December 2025 technical advice reported a 61% reduction in mandatory datapoints and a 71% reduction including voluntary datapoints.
- Sector-specific ESRS eliminated
- Limited assurance retained. The requirement to move to reasonable assurance has been removed.
- New timeline: Wave 2 reports in 2028 for FY 2027
The wave system has been replaced. The original phased approach (Waves 1–4) is effectively superseded by new unified thresholds that take full effect for financial years starting on or after 1 January 2027. The "Stop-the-Clock" Directive (adopted April 2025) had already postponed Wave 2 and Wave 3 deadlines by two years. The Omnibus I Directive now removes listed SMEs (Wave 3) from scope entirely and raises the thresholds so that many Wave 2 companies also fall outside the revised scope.
Who Is Now In Scope
From financial years starting on or after 1 January 2027, the CSRD applies to EU companies that meet both of the following criteria: more than 1,000 employees on average during the financial year and annual net turnover exceeding €450 million. These thresholds are assessed on a standalone or consolidated group basis.
EU large companies (revised scope)
Public and non-public companies with more than 1,000 employees on average during the financial year and annual net turnover exceeding €450 million. First report in 2028 for FY 2027 (if not already reporting). This is the revised scope from FY 2027 onwards.
Wave 1 companies (transitional)
Large public-interest entities already reporting for FY 2024. If they fall below the new thresholds, Member States may exempt them from reporting for FY 2025 and FY 2026. They remain subject to existing requirements until any exemption is transposed into national law. National transposition must be checked for each relevant jurisdiction.
Third-country undertakings
Non-EU parent companies with EU subsidiaries/branches must report from FY 2028 if the applicable tests are met. The third-country undertaking must generate EU net turnover exceeding €450 million in each of the last two consecutive financial years, assessed at group level or, where applicable, individually. The local-presence test requires an EU subsidiary with net turnover exceeding €200 million in the preceding financial year, or a branch exceeding that amount where there is no qualifying EU subsidiary.
Removed from scope
Listed SMEs (previously Wave 3) are no longer required to report. Certain financial holding undertakings may omit consolidated sustainability reporting where the statutory conditions are met. This is not a blanket exemption for their subsidiaries. Companies below the new thresholds may use the Voluntary Sustainability Standard (VSME) if they choose to report.
Transitional Consolidation Option for Non-EU Groups
Non-EU parent companies with multiple EU subsidiaries have access to a transitional relief measure. Until 6 January 2030, a non-EU parent may designate a single EU subsidiary to prepare a consolidated (technically a "combination") sustainability statement covering all EU subsidiaries of that non-EU group, provided the designated subsidiary generated the greatest EU turnover in at least one of the preceding five financial years. The statement must be prepared in accordance with the General ESRS and include EU Taxonomy disclosures.
Financial Holding Company Exemption
The Content Directive introduces a new exemption for parent undertakings that qualify as financial holding companies. A parent company may be exempt from consolidated sustainability reporting if it is neither directly nor indirectly involved in the management of its subsidiaries (without prejudice to its shareholder rights), and the subsidiaries’ business models and operations are independent of one another.
Financial holding exemption requires careful assessment
The criteria for this exemption involve a degree of judgement and will depend on national transposition for further precision. Critically, this exemption does not extend to in-scope EU subsidiaries: subsidiaries meeting the CSRD thresholds in their own right must still report. A financial holding company may choose to report on a consolidated basis voluntarily. If a parent exercises the option to exclude a subsidiary from the consolidated sustainability report, it must indicate any significant event that affected the subsidiary during the financial year and that has an effect on the group’s sustainability impacts, risks, or opportunities.
A review clause allows the European Commission to reassess the scope thresholds. Companies close to the thresholds should monitor that review. Decisions about voluntary reporting can also take account of current information needs and the cost of maintaining the reporting process.
Revised Reporting Timeline
The original four-wave implementation has been replaced by a simplified structure. The Stop-the-Clock Directive (April 2025) and the Omnibus I Directive together produce the following timeline.
Wave 2 companies: use the additional time wisely
Wave 2 entities that remain in scope should use the additional time created by the Stop-the-Clock delay to strengthen governance, controls, and data processes for preparing sustainability information. Early gap assessments against the adopted revised ESRS can reduce re-work in later reporting cycles.
Delegated Acts and Rolling Compliance Calendar
The Omnibus I Directive and the simplified ESRS framework depend on a cascade of secondary legislation. The following timeline summarises adopted measures and remaining deadlines that shape compliance obligations.
The Simplified ESRS: What Changes in Practice
EFRAG delivered its technical advice on the simplified ESRS to the European Commission on 3 December 2025. The simplified standards represent a substantial structural streamlining of the original ESRS Set 1, while preserving the core architecture of the CSRD reporting framework.
Key changes at a glance
- EFRAG's December 2025 technical advice reported a 61% reduction in mandatory datapoints and a 71% reduction including voluntary datapoints.
- Double materiality remains mandatory, but the assessment process is simplified with a new "top-down" option and reduced documentation requirements
- Fair presentation framework introduced as an overarching filter: companies must ensure their sustainability reporting fairly presents material information, rather than mechanically completing every disclosure requirement
- Sector-specific ESRS eliminated: the development of sector standards has been discontinued
- Limited assurance retained. The requirement to move to reasonable assurance has been removed.
- Enhanced interoperability with IFRS S1/S2, supporting multi-framework reporting for companies subject to both European and international requirements
- Narrative flexibility increased: policies, actions, and targets can be described in a more principles-based manner rather than prescriptive formats
- Value chain data pressure reduced: the preference for direct value chain data has been relaxed, allowing greater use of estimates, sector averages, and proxies where primary data is not available without undue cost or effort
The simplified ESRS retain the 12-standard structure (ESRS 1, ESRS 2, plus 10 topical standards across environmental, social, and governance domains). What changes is depth, not architecture. The standards are shorter, clearer, and more focused on material information. ESRS 2 (General Disclosures) is now fully subject to the materiality filter, whereas previously certain disclosures were mandatory regardless of materiality.
Our perspective
We suggest using the revised ESRS to review the reporting process as a whole. Start by checking which information remains necessary, who provides it and how it is checked. Some data requests can be reduced or removed. The remaining work needs clear ownership and reliable evidence. For companies reporting from FY 2027, the additional time is an opportunity to resolve gaps and simplify how teams work together.
Core Reporting Requirements That Remain
Double materiality assessment
The double materiality assessment remains the methodological backbone of CSRD reporting. Companies must assess both impact materiality (effects on environment and society) and financial materiality (risks and opportunities affecting enterprise value). The simplified ESRS clarify that the assessment functions as a filter: only material information must be reported. A new "top-down" approach is permitted, allowing companies to begin at the topic level rather than identifying individual impacts, risks, and opportunities from the bottom up. The DMA need not be repeated annually unless significant changes arise.
Management report integration
Sustainability information must be published within the management report, alongside financial statements. This structural requirement is unchanged. The sustainability statement is not a standalone document. It is part of the corporate reporting package and subject to the same governance, internal controls, and board oversight.
Assurance
Third-party assurance remains mandatory at the limited assurance level. The Omnibus I Directive removed the requirement to move to reasonable assurance. Limited assurance involves less extensive evidence-gathering, but companies still need to prepare reliable information and supporting documentation.
The Commission has set a deadline of 1 July 2027 for the adoption of an EU limited assurance standard via delegated act. While mandatory assurance remains at the limited level, companies may pursue voluntary reasonable assurance on specific KPIs or the full sustainability report under applicable assurance standards. ISSA 5000's effective date is 15 December 2026, for the periods and engagements specified by the standard, with early application permitted. EU and national adoption requirements must be assessed separately.
Digital tagging (XBRL)
The applicable ESEF rules determine when sustainability reporting must be marked up. Article 29d provides that undertakings are not required to mark up their sustainability reporting until the relevant rules are adopted. A draft taxonomy does not itself impose tagging.
EU Taxonomy alignment
Companies in scope of the CSRD must report on the proportion of their activities that are Taxonomy-aligned. Taxonomy simplifications are set out in Delegated Regulation (EU) 2026/73. It applies from 1 January 2026 and permits use of the previous rules for financial years starting in 2025. This is not a general option to keep the old templates for FY 2026.
The Value Chain Cap: Protection for Smaller Companies
One of the most consequential practical changes is the introduction of a value chain data cap. The value-chain cap in Annex II of Regulation (EU) 2026/1560 applies from financial years beginning on or after 1 January 2027 and protects value-chain undertakings with 1,000 employees or fewer.
Specifically, entities with 1,000 employees or fewer that are not themselves in scope of the CSRD are designated as "protected undertakings." For financial years beginning on or after 1 January 2027, these protected undertakings have the legal right to refuse information requests that go beyond the voluntary standards. The Voluntary Standard was adopted in Regulation (EU) 2026/1560 and entered into force on 24 September 2026. Its Basic Module contains disclosures B1 to B11 and its Comprehensive Module C1 to C9. There are three types of data points: mandatory, conditional, and voluntary. No double materiality assessment is required for VSME reporters. The adopted standard builds on the earlier Commission Recommendation (EU) 2025/1710, which is based on the EFRAG VSME standard published in December 2024.
For reporting companies, this means redesigning data collection strategies. The previous expectation (that CSRD-reporting companies would push detailed disclosure requirements down through their supply chains) has been explicitly curtailed. Companies should now adopt risk-based approaches to value chain data, using estimates, sector averages, and spend-based proxies where primary data cannot be obtained from protected undertakings.
Important: the value chain cap applies only to information gathering for sustainability reporting purposes. It does not restrict information requests for other regulatory purposes, such as due diligence obligations under the CSDDD. Additionally, a deemed-compliance mechanism provides practical relief: Deemed compliance requires the reporting undertaking to report the necessary value-chain information without reporting information from protected undertakings beyond the voluntary standards. A supplier's refusal alone is not sufficient. This shifts the compliance burden and incentivises focused, materiality-based data requests.
Potential ESRS misalignment to monitor
EFRAG proposed deleting the transitional provision for value chain information in the revised ESRS to avoid redundancy with the new value chain cap. However, the Content Directive maintains this transitional provision. This potential misalignment may create confusion about which value chain reliefs apply and when. Companies should assess the adopted revised ESRS and the value-chain cap together when determining the applicable reliefs.
Connections to Other EU Regulations
CSDDD (Corporate Sustainability Due Diligence Directive): The Omnibus I Directive also substantially restructured the CSDDD. Scope thresholds are raised to 5,000 employees and €1.5 billion turnover. The requirement to adopt climate transition plans has been removed. The transposition deadline is extended to July 2028, with application from July 2029. Companies in scope of both CSRD and CSDDD should map the interdependencies to avoid duplicating due diligence and reporting efforts.
EU Taxonomy: Reporting companies must disclose Taxonomy-eligible and Taxonomy-aligned activities. Further screening-criteria amendments have a separate legislative process. Verify the applicable adopted text before relying on them.
ISSB (IFRS S1/S2): The simplified ESRS are designed for enhanced interoperability with the ISSB's sustainability disclosure standards. Companies subject to both frameworks should find closer alignment, though differences remain in areas such as GHG boundary definitions and financial effect disclosures.
EU Batteries Regulation, EUDR, ESPR: Product-level sustainability regulations increasingly feed into or interact with CSRD reporting. Data collected for battery passports, deforestation due diligence, or ecodesign compliance can serve CSRD reporting requirements and vice versa.
Assess your reporting position under the new scope
Tell us what you are working on. We reply within two working days.
How to prepare
We recommend matching the reporting programme to the company’s obligations and the information its stakeholders need. For companies that remain in scope, the additional time can be used to test data collection, controls and assurance readiness. Companies outside the revised scope can assess which information investors, lenders or customers still request, and whether voluntary reporting offers enough value to justify the work.
Step 1: Reassess scope and thresholds
Check whether your organisation meets both revised thresholds: more than 1,000 employees on average during the financial year and annual net turnover exceeding €450 million. If it falls outside scope, consider voluntary reporting in light of specific investor, lender or customer requests. The VSME standard may provide a useful starting point, depending on the information needed and the cost of producing it.
Step 2: Update your double materiality assessment
If you have already conducted a DMA under the original ESRS, review it against the simplified framework. The top-down approach and fair presentation filter may allow you to streamline your assessment. If you have not yet started, use the simplified guidance to scope the exercise efficiently from the outset.
Step 3: Redesign value chain data collection
Segment your suppliers by size and sustainability risk. The value-chain cap in Annex II of Regulation (EU) 2026/1560 applies from financial years beginning on or after 1 January 2027 and protects value-chain undertakings with 1,000 employees or fewer. Limit relevant sustainability-reporting requests accordingly. For high-impact suppliers, maintain deeper engagement on a risk-proportionate basis.
Step 4: Prepare for simplified ESRS
The Commission adopted the revised ESRS on 3 July 2026. Regulation (EU) 2026/1563 was published on 21 September 2026, enters into force on 10 November 2026 and applies to financial years beginning on or after 1 January 2027. Identify which data points have been removed from your current reporting scope and adjust data collection, internal controls, and governance processes accordingly. Do not over-invest in data points that have been removed.
Step 5: Align governance and assurance readiness
Board oversight, internal controls, and structured ESG data management remain essential for audit-ready disclosures, even under limited assurance. Engage your auditor early to agree on methodology, documentation standards, and assurance scope. The reduced data point count does not reduce the need for rigorous process.
Frequently Asked Questions
Expanded Omission Provisions
The Omnibus I Directive significantly broadens the grounds on which companies can omit information from their sustainability reports. Four specific categories now permit omission, provided companies disclose that an omission has been invoked and reassess the need for omission at each reporting date.
- Commercial prejudice: Information whose disclosure would seriously prejudice the undertaking's commercial position, provided the omission does not prevent a fair and balanced understanding and disclosure is impossible without serious prejudice.
- Trade secrets and intellectual property: Information relating to intellectual capital, intellectual property, know-how, technological information, or innovation results that qualify as trade secrets under applicable law.
- Classified information: Information classified as defined by Regulation (EU) 2023/2418, including sensitive defence or security data.
- Privacy and security: Information protected from unauthorised access or disclosure by EU or national law, or necessary to safeguard the privacy or security of natural persons.
The revised framework gives companies a reason to revisit the scope and design of their reporting programmes. Those that remain in scope need to prepare for the applicable requirements. Those outside scope can decide what to retain, based on the information their business and stakeholders need.
With the revised ESRS and Voluntary Standard adopted, we suggest turning attention to the company’s reporting timetable, national implementation and the work needed to produce reliable information. Agree responsibilities across the teams involved, identify gaps and decide which activities can be simplified or stopped.
Disclaimer: This article is intended as a practical orientation guide, not legal advice. The original article reflects information available as of mid-March 2026, immediately following the publication of Directive (EU) 2026/470 on 26 February 2026. Selected factual corrections were applied on 1 November 2026. This is not a full update. The revised ESRS and Voluntary Standard have been adopted. National transposition and the applicable implementation dates still require assessment. Readers should verify all compliance-critical obligations against the authoritative legal text on EUR-Lex and seek qualified legal counsel before making compliance decisions.