EU Omnibus I Trims CSRD and CSDDD Scope as New ESRS Take Effect

The Analysis

Omnibus I is now law. It became Directive (EU) 2026/470 and has been in force since 18 March 2026. Two of its provisions are the ones that matter to a supply chain, and they are provisions about scope, not about substance. From financial year 2027, the Corporate Sustainability Reporting Directive reaches EU companies with more than 1,000 employees and net turnover above 450 million euros, and by design that leaves most of the firms that were previously captured outside the mandatory perimeter; listed small and medium-sized undertakings drop out of scope entirely. The Corporate Sustainability Due Diligence Directive applies from 26 July 2029 to companies with more than 5,000 employees and net worldwide turnover above 1.5 billion euros, with administrative fines capped at 3 percent of worldwide net turnover. Separately, the revised European Sustainability Reporting Standards took effect on 10 November 2026 and cut the mandatory datapoints by more than 60 percent.

Read that list of numbers the way a compliance officer has to read it, and the temptation is to conclude that the burden has lifted. For a great many companies it has, on paper. But the question I am asked most often in weeks like this is not "am I still in scope" — that one is answerable in an afternoon with an employee headcount and a turnover figure. The question that actually decides what a company does over the next two years is a different one, and it is the one this article is about.

If you fall outside the mandatory perimeter, are you exempt from the requirement, or are you merely exempt from the obligation to report it yourself? Those are not the same thing, and conflating them is the most expensive mistake available in the current European rules. Strictly speaking, a directive's scope provision tells you who must comply with the directive. It does not tell you who must satisfy your customers, and in a supply chain those are two different populations, measured on two different rulers, moving on two different clocks.

Begin where a lawyer would begin, with the boundary, because everything else follows from where the line is drawn.

Omnibus I moved two lines, and they moved in different directions and on different clocks. The CSRD line moved up: the threshold is now more than 1,000 employees and net turnover above 450 million euros, effective from financial year 2027. The effect on a large population of mid-sized companies is that they leave the mandatory perimeter. The listed SME carve-out is the sharpest expression of that, because listed SMEs were a category with reporting duties and now they are not. The CSDDD line moved up and also moved out in time: it now bites from 26 July 2029 and only above 5,000 employees and 1.5 billion euros of worldwide net turnover, with the fine ceiling set at 3 percent. The revised ESRS, effective 10 November 2026, reduced the number of mandatory datapoints by more than 60 percent. Taken together, the package is a deliberate narrowing. It is a political decision to reduce the reported population, and it should be described as exactly that, not as a repeal.

Now the part that does not change, and this is where the analysis has to be careful rather than comforting. The CSRD is a reporting directive. It governs what a company that is in scope must disclose, and where. The CSDDD is a due diligence directive. It governs what a company that is in scope must do about its value chain, and it attaches liability and fines to the failure to do it. Neither of them is the source of most of the sustainability information that flows through a supply chain. The source of most of that information is the buyer.

A large company that remains in scope under the CSRD still has to report on its value chain, and the data behind that report comes, in substantial part, from its suppliers. A large company that remains in scope under the CSDDD still has to conduct due diligence across its chain of activities, and the cooperation it needs comes from the same suppliers. The directive sets the obligation on the in-scope company. The in-scope company sets the request on the supplier. Nothing in Omnibus I changes that chain of transmission.

This is the point I would put in bold if the format allowed it, and it is the point the current coverage tends to skip. A supplier that has been removed from the mandatory perimeter has not been removed from the information flow. It has been removed from the obligation to publish that information on its own account. Whether it is asked for the same information anyway depends on who its customers are and what those customers need to comply with. A mid-sized component maker selling to a listed European manufacturer that is still in scope under CSRD will be asked for emissions data, for the physical risks in its operations, and for the social indicators in its workforce, because the buyer needs those numbers to file. The supplier's own legal position may have simplified. Its customer interaction has not, and the interaction, not the statute, is what fills its compliance calendar.

Now the distinction that decides how much work a company should expect, because "in scope" and "asked for data" are two different questions with two different answers. If a company is in scope, it faces a fixed obligation defined by the directive and the standards, with a defined set of datapoints and a defined assurance trajectory. If a company is out of scope but sells into an in-scope buyer, it faces an obligation defined by a contract, a questionnaire or a supplier code, which is variable, negotiable at the margin, and set by the customer's own compliance needs rather than by a legislature. The first kind of obligation is uniform and predictable. The second kind is bespoke, and bespoke obligations in practice tend to be both broader and less forgiving, because a buyer asking for a number it needs will ask for it in the form that suits the buyer, on the buyer's deadline, with the buyer's definition of the scope.

Consider who specifically absorbs the change and who does not. A listed SME dropped from the CSRD perimeter stops filing its own sustainability statement. If that same SME is a supplier to a large listed group, the group's reporting duty is unchanged, and the group will still need value-chain data. The reporting duty has not disappeared from the chain; it has moved up the chain and become a procurement requirement instead of a disclosure requirement. For the SME, the practical change is often that the obligation becomes less formal and less documented but not obviously lighter, because a customer request for data can be more demanding than a standard, precisely because it is not constrained by a published datapoint list. The standard protects the reporter by defining what is enough. A customer questionnaire does not, and it never did.

There is a second effect, subtler and more insidious, and it is the one I have not seen discussed in the commentary on the Omnibus package. For years, a large share of companies satisfied sustainability expectations by following the crowd. They disclosed roughly what their peers disclosed, reported roughly the metrics their industry reported, and relied on the fact that everyone was in the same boat and therefore no one was exposed as an outlier. The ESRS datapoint list was the reference point that made this possible; it was the common denominator everyone could aim at. Omnibus I moved a large population of companies out of that common framework, and reduced the mandatory datapoints for those still in it.

The consequence is that the reference sample is shrinking. A company that used to be able to say "we report what comparable firms report" is increasingly unable to point to comparable firms, because a substantial part of the peer group no longer reports anything mandatory. Benchmarking against the market becomes benchmarking against a smaller and less representative set, and the gap between what a company discloses and what a customer wants becomes more visible, not less.

Put the dates in order, because the timing itself is a substantive point and not a detail. The revised ESRS took effect on 10 November 2026. The CSRD scope change applies from financial year 2027. The CSDDD obligations do not begin until 26 July 2029. These are three different clocks, and a company that treats them as one deadline will mis-plan. A firm that is in scope for CSRD must be ready for the 2027 financial year under the revised standards, which is a nearer date than much of the current commentary implies. A firm that is out of CSRD scope but expects to be in CSDDD scope in 2029 has a longer runway but a heavier obligation at the end of it, because the CSDDD is about conduct and liability, not merely about publishing numbers. A firm that is out of both but supplies an in-scope buyer is on the buyer's clock, which is set by the buyer's own compliance calendar and which may be the earliest of all.

Now the boundary conditions, because this is where a conclusion can flip and a company that has planned on one reading can find itself exposed. The first boundary is the customer's scope. A supplier that assumes it is out of scope is correct only about its own obligation. If its customer is in scope, the supplier is in a data relationship with an in-scope entity, and that relationship is where the practical requirement lives. The second boundary is the nature of the product. Where a good carries an embedded emissions profile, a due diligence exposure or a forced-labour risk, the buyer's need for the underlying data does not depend on the supplier's size.

A small supplier of a high-risk input is asked for the same information as a large one, on the same timeline. The third boundary is the standards' revision cycle. The revised ESRS cut mandatory datapoints by more than 60 percent as of 10 November 2026, and any company that had built its data model to the old list should check whether the data it is collecting still maps to a requirement or has become voluntary. A datapoint that is no longer mandatory is not necessarily a datapoint the customer has stopped asking for.

I want to be precise about one thing that is easy to overstate and just as easy to understate. Omnibus I is a real reduction. The mandatory reporting population is smaller, the CSDDD threshold is higher, the fine cap is fixed at 3 percent, and the datapoint burden is materially lower. That is not spin; it is the text. But the reduction is a reduction of the statutory layer, and the statutory layer was never the whole of the requirement for an entity embedded in a supply chain. For a tier-one supplier to a large European buyer, the statutory layer was, in practice, the smaller part of the burden. The larger part was always the customer relationship, and that part is untouched by the directive. A company that reads Omnibus I as a signal to stand down its sustainability data collection is reading a scope provision as if it were a projection of its commercial future, and those are different documents.

There is also a structural asymmetry worth naming, because it explains why the squeeze lands where it does. The in-scope buyer is not a single buyer with a single request. It is a buyer with a reporting obligation, a diligence obligation, a procurement policy, a financing condition and a reputation to protect, and these do not all sit on the same threshold. A company removed from the CSRD perimeter may still be inside a bank's lending condition based on sustainability-linked terms, inside a large customer's supplier code, and inside the scope of a disclosure that a stock exchange or an investor expects. The directive scope is one line among several. A planning process that tracks only the directive line will miss the others, and the others are frequently the binding ones because they are contractual and enforceable between private parties in a way a public reporting requirement is not, in the same immediate sense.

There is a practical negotiation consequence, and it is the part a supplier can actually use. When the legal obligation sat with the directive, a supplier responding to a customer's questionnaire had no leverage to define the scope of the request; the standard did that. With the directive narrowed, the customer's request is a contractual ask rather than a statutory one, and a contractual ask is negotiable at the margin. A supplier that understands this can push back on a datapoint it cannot produce economically, propose an alternative that satisfies the buyer's actual filing need, and agree a reasonable deadline rather than absorbing an arbitrary one.

That is a genuine improvement for a mid-sized firm, and it exists precisely because the request is now commercial rather than regulated. The risk in the same situation is complacency: a supplier that assumes the customer's request will also narrow because the directive did will be surprised when the questionnaire arrives unchanged, and it will be negotiating from a weaker position than it would have had if it had mapped the relationship in advance.

Let me put the whole thing into a single formulation, because the point deserves to be sharp. The Omnibus package changed who must report. It did not change who must supply. A company's mandatory obligation is a function of the directive thresholds, and those moved. A company's practical obligation is a function of its commercial relationships, and those did not move, because the relationships were never defined by the directive in the first place. The two are related but not identical, and the error is to treat the first as a proxy for the second.

When the thresholds move, the gap between them widens, and it is in that widening gap that companies get caught, not by the directive but by the customer who still needs the number and no longer has a statute to point to as the reason. A supplier that planned its whole compliance programme around the directive threshold, and nothing else, will find that the one document it trusted has become a smaller part of what it is actually asked to prove.

Now the closing instruction, which is the same one I give whenever a scope question is answered by a threshold. Establish your own position first, precisely and in writing: in scope or out, under which instrument, from which date, on which facts. Then establish your customers' positions, because your practical requirement is their obligation transmitted to you. Then, and only then, decide what to keep collecting. The answer for a company that sells only to non-European buyers with no sustainability-linked conditions may genuinely be to stop reporting, and that company should stop without regret. The answer for a company in a value chain that ends at an in-scope European buyer will be that the data request arrives regardless of the directive, and that company should be prepared on the buyer's timeline rather than comforted by the directive's. It depends, as it always does on a question like this, and it depends on facts the company can and should verify for itself rather than assume from a headline about the perimeter.

↑ Back to the key points

— By Dr. Ingrid Voss