Insights/ESG

The CSRD and ESRS Omnibus Package: What Changed, Who Is in Scope, and When

After more than a year of proposals, negotiation and political wrangling, the European Union has settled the shape of its sustainability reporting regime for the rest of the decade. The Omnibus I directive, adopted by the Council on 24 February 2026 and published in the Official Journal two days later, substantially narrows the Corporate Sustainability Reporting Directive (CSRD), pushes back deadlines and thins out the underlying European Sustainability Reporting Standards (ESRS). For finance and reporting teams, the practical question is no longer whether to prepare but on what basis, from which financial year, and against how much detail.

The headline is a smaller, later and lighter regime. Yet the core architecture that made the CSRD demanding, double materiality, mandatory limited assurance and value-chain reporting, survives in a trimmed form. This article sets out what actually changed, who is now in scope and when, how the delays interact with the double materiality principle, and how both EU and non-EU groups should respond.

What the CSRD omnibus simplification package actually changed

The package traces back to the European Commission's 26 February 2025 proposal to simplify EU sustainability and due diligence rules in the name of competitiveness. It moved in two parts. A fast-tracked "stop-the-clock" directive, adopted in 2025, bought time by postponing reporting deadlines. The substantive Omnibus I directive then followed the standard legislative route: the European Parliament endorsed a negotiated text on 16 December 2025 and the Council gave final approval on 24 February 2026. The directive entered into force twenty days after publication, and member states have twelve months to transpose the CSRD-related provisions into national law. The changes reduce the number of companies caught, delay first reporting, drop sector-specific standards, and instruct the Commission to issue a materially simplified set of ESRS by delegated act.

New scope thresholds: who is now in and who is out

The most consequential change is the scope test. Reporting under ESRS and the EU Taxonomy is now confined to large EU undertakings with more than 1,000 employees and a net turnover above €450 million. Both conditions must be met, which lifts the great majority of previously captured mid-sized companies and listed small and medium-sized enterprises out of mandatory reporting. Estimates cited during the negotiations put the reduction in scope at roughly 80 per cent of the companies that the original CSRD would have covered. Firms below the threshold are not left without a framework: a voluntary standard for smaller companies, based on EFRAG's VSME, becomes the reference point for those that still wish to, or are asked to, report.

The stop-the-clock delays and the revised reporting timeline

Timing has shifted as decisively as scope. The stop-the-clock directive deferred the reporting obligations of the second and third waves, large non-listed companies and listed SMEs, by two years. Omnibus I then confirmed that the new scope test applies for financial years beginning on or after 1 January 2027, meaning first reports in 2028. So-called wave-one companies, which were already reporting for financial year 2024, benefit from a transition arrangement: those that now fall outside the raised thresholds are relieved of the obligation for the 2025 and 2026 financial years, rather than being made to continue and then stop. In practice, many first-wave reporters can pause while the simplified standards are finalised.

The regime is smaller, later and lighter, but double materiality, limited assurance and value-chain reporting survive in trimmed form.

Simpler ESRS and fewer data points, but double materiality stays

The technical detail is being rewritten in parallel. At the Commission's request, EFRAG delivered amended ESRS in late November 2025 that cut mandatory data points by around 61 per cent, removed all voluntary data points, and reduced the total from roughly 1,073 to about 320 where material, close to a 70 per cent reduction overall. The Commission published its "ESRS 2.0" draft for public consultation in the second quarter of 2026 and is expected to adopt the delegated act around mid-2026, within six months of the directive's entry into force. Companies reporting for financial year 2026 may apply the simplified standards early on a voluntary basis. Sector-specific standards have been dropped as binding requirements and will survive only as non-binding guidance, and the planned move from limited to reasonable assurance has been shelved indefinitely, so limited assurance remains the standard. Crucially, double materiality has not been abandoned. Companies in scope must still perform a double materiality assessment covering both impact materiality and financial materiality; what has changed is that the assessment process is more principles-based and less prescriptive, and narrative disclosures are lighter.

What non-EU and third-country groups need to know

Groups headquartered outside the EU should not assume the reforms remove their exposure. The third-country reporting regime continues to apply where a non-EU parent generates net turnover above €450 million in the EU and has either a large EU subsidiary or an EU branch whose turnover exceeds €200 million. Those obligations sit on a later timeline than the main EU waves, but the underlying data and governance work is comparable. The value-chain provisions matter here too. The directive introduces a cap that restricts in-scope companies from demanding sustainability data beyond the simplified voluntary standard from smaller counterparties, giving those suppliers a de facto right to refuse over-broad requests. Non-EU suppliers to European customers should expect information demands to become more standardised, though not to disappear.

How affected groups should respond in 2026

The sensible response is neither to declare the CSRD dead nor to carry on as though nothing has changed. Start by re-testing scope against the 1,000-employee and €450 million turnover thresholds at the correct legal entity or group level, and confirm the financial year from which any obligation now bites. Where a group falls out of scope, redirect effort towards the information that investors, lenders and customers continue to demand, and towards the voluntary standard that increasingly frames those requests. Where a group remains in scope, focus on a robust double materiality assessment and the reduced core data set, rather than rebuilding disclosures that the simplified ESRS will no longer require. Transposition timing will vary between member states, so groups operating across several jurisdictions should track national implementation closely. The direction of travel is clear: less volume, but the same expectation of credible, assured and decision-useful sustainability information. Firms that treat the pause as a chance to build reliable data foundations, rather than to disengage, will be best placed when the simplified regime takes full effect.

Key takeaways

  • Mandatory CSRD reporting is now confined to large EU companies with more than 1,000 employees and net turnover above €450 million, cutting scope by an estimated 80 per cent.
  • The new scope test applies for financial years beginning on or after 1 January 2027, with stop-the-clock delaying waves two and three by two years and a transition relief for wave-one reporters in 2025 and 2026.
  • Double materiality is retained: in-scope companies must still assess both impact and financial materiality, though the process is more principles-based.
  • EFRAG's amended ESRS cut mandatory data points by roughly 61 per cent and removed all voluntary ones, taking the total from about 1,073 to around 320 where material.
  • Sector-specific standards are dropped to non-binding guidance and the shift to reasonable assurance is shelved indefinitely, leaving limited assurance as the standard.
  • Non-EU parent groups stay in scope where EU turnover exceeds €450 million with a large EU subsidiary or a branch above €200 million, and a value-chain cap curbs data demands on smaller suppliers.
Keep reading

More from Finspera 21 Insights

Get in touch

Discuss what this means for you.

Speak directly with the specialist who would lead the work, no obligation.