CSRD After the Omnibus: Who Still Has to Report, and When?

"Am I still in scope?" has been the most-asked question in European sustainability reporting since the EU began overhauling the Corporate Sustainability Reporting Directive (CSRD) in February 2025. The answer is now settled: far fewer companies report, the thresholds are much higher, the timeline has moved, and the standards themselves have been cut by more than two thirds. This guide sets out exactly who still reports, on what, and when, as of July 2026.

The goalposts moved three times before they stopped. Between the European Commission's Omnibus proposal in February 2025, the "stop-the-clock" delay that April, a trilogue deal in late 2025 and the final directive in February 2026, thousands of companies paused double materiality assessments mid-flight, or kept building for a regime that, for them, no longer exists.

The uncertainty is now largely over. The Omnibus I Directive, formally Directive (EU) 2026/470, was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026.1,2 On 3 July 2026 the Commission adopted the revised, radically slimmed-down European Sustainability Reporting Standards (ESRS).3

Key takeaways. CSRD now applies to EU companies with more than 1,000 employees and net turnover above €450 million, roughly 80–90% of previously in-scope companies have fallen out. Companies newly in scope report first on financial year 2027 (publishing in 2028), non-EU parent groups on FY2028 (publishing in 2029), and wave 1 companies still above the thresholds keep reporting without a break. The revised ESRS adopted on 3 July 2026 cut mandatory datapoints by more than 60% and total datapoints by more than 70%, while keeping the E1–E5, S1–S4, G1 structure. Double materiality survives, and so does mandatory limited assurance, though the planned escalation to reasonable assurance is gone. For everyone who fell out, the voluntary VSME standard is now both the ceiling on customer data demands and the sensible baseline to prepare.

Who does CSRD apply to now? The post-Omnibus scope test

The old test is gone. The original CSRD captured any company meeting two of three criteria, 250+ employees, €50 million turnover, €25 million balance sheet, an estimated 50,000 companies worldwide. The Omnibus replaces that with a single, much higher bar. From transposition, CSRD applies to:

  • EU undertakings and parent groups with more than 1,000 employees (annual average) and net turnover above €450 million;1,4 and
  • non-EU parent groups generating more than €450 million net turnover in the EU (for two consecutive financial years) with an EU subsidiary or branch whose net turnover exceeds €200 million.5

Both limbs of the EU test must be met. A 5,000-person company turning over €300 million is out; a €600 million company with 800 employees is out. Financial holding undertakings whose sole purpose is holding shares, without involvement in management, are exempt.5 Listed SMEs, the former "wave 3", have no mandatory CSRD obligation left, because listing is no longer a route into scope.

Applied to an EU manufacturer and a UK group with large EU sales:

1,350 employees>1,000and€612m turnover>€450m=in scope, first report FY2027
€480m EU turnover>€450mand€230m EU subsidiary>€200m=in scope, first report FY2028

Line one is the EU test (group level, both limbs required); line two the non-EU route, €450m of EU net turnover for two consecutive financial years plus an EU subsidiary or branch above €200m.

The practical effect is dramatic: analysis for company directors estimates that roughly 90% of previously in-scope companies, around 42,000, fall out, leaving approximately 8,000 in scope worldwide.6

The one-line takeaway: if either number sits below the line at the right consolidation level, mandatory CSRD is off your desk.

What is the CSRD timeline now? Stop-the-clock, then the reset

Two separate instruments changed the calendar; keep them apart when reading older commentary.

First came the delay. The "stop-the-clock" directive (Directive (EU) 2025/794, adopted 14 April 2025) postponed wave 2 reporting by two years to FY2027 and wave 3 to FY2028.7

Then came the substance. The Omnibus I Directive removed most delayed companies from scope entirely; those that remain, because they clear 1,000 employees and €450 million, report first on financial years beginning on or after 1 January 2027, publishing in 2028.8 Member states must transpose the amendments by 19 March 2027.5

Cohort Original first report Position after Omnibus I (2026) First reporting year now
Wave 1, large listed companies / PIEs >500 employees FY2024 (published 2025) Mandatory if still above 1,000 employees / €450m; member states may exempt de-scoped wave 1 companies for FY2025–265 Already reporting (FY2024 onwards)
Wave 2, other large companies (250+ employee test) FY2025 (pre-delay) Mandatory only if >1,000 employees and >€450m turnover; otherwise out FY2027, published 2028
Wave 3, listed SMEs FY2026 (pre-delay) Voluntary, out of mandatory scope; VSME reporting instead N/A (voluntary)
Non-EU parent groups FY2028 (€150m EU-turnover test) Mandatory if >€450m EU turnover plus an EU subsidiary or branch >€200m FY2028, published 20299

Wave 1 companies that stay above the new thresholds never stopped. They reported on FY2024 and FY2025 and simply continue. Wave 1 companies that fall below the thresholds are in an odd interim position: the directive lets member states exempt them from FY2025 and FY2026 reporting, but the exemption is discretionary and depends on national transposition, check your member state before switching anything off.6

Figure 1. The revised CSRD timeline: after stop-the-clock and Omnibus I, newly scoped EU companies report on FY2027 and non-EU parent groups on FY2028.
You are here, July 2026 2024 2025 2026 2027 2028 2029 FY2024: wave 1 first reporting year 26 Feb 2026: Omnibus I in the OJ (in force 18 Mar; 1,000 emp / €450m) FY2027: first year for newly scoped EU companies FY2028: first year for non-EU parents (reports published 2029) 14 Apr 2025: stop-the-clock delays waves 2–3 by two years 19 Mar 2027: member-state transposition deadline 3 Jul 2026: revised ESRS adopted (mandatory datapoints −60%) Assumes calendar-aligned financial years. The revised ESRS remain in the Parliament–Council scrutiny period as of July 2026.

Does CSRD apply to non-EU companies, including UK groups?

Yes, and for UK-headquartered groups this is now the main route into scope. A third-country parent is caught where the group's net turnover generated in the EU exceeds €450 million for two consecutive financial years and it has either an EU subsidiary or an EU branch with net turnover above €200 million.5 That is a threefold increase on the original €150 million EU-turnover test, but large UK, US and Swiss groups with substantial EU sales remain squarely in scope.

Caught groups report at consolidated global level against separate third-country standards, with first reports covering FY2028, published in 2029; those non-EU standards are not expected before late 2027.9 Separately, large EU subsidiaries of non-EU parents can be in scope in their own right if the subsidiary itself clears the 1,000-employee/€450m test.

Two UK-specific notes. First, the UK has now published its own final UK Sustainability Reporting Standards (UK SRS S1 and S2), based on the ISSB standards, a different, investor-focused regime that may run in parallel for larger UK companies.10 Second, even UK companies with no EU legal presence are increasingly asked for VSME-shaped data by EU customers under the value-chain rules discussed below.

What do the simplified ESRS actually require?

The standards went through their own overhaul. EFRAG delivered its technical advice in November 2025 and published draft simplified standards on 3 December 2025; the Commission consulted on its own "ESRS 2.0" draft in spring 2026 and adopted the revised delegated act on 3 July 2026.3,11 One caveat: the act now sits in a two-month scrutiny period before the European Parliament and Council (extendable by two months), stable, but not yet beyond amendment.3

The revised ESRS cut mandatory datapoints by more than 60% and total datapoints by more than 70% against the original standards' 1,100-plus, with the Commission estimating cost savings above 30% per company.3,12

The architecture is unchanged. Sector-specific ESRS have been abandoned altogether,6 but the structure of two cross-cutting standards and ten topical standards survives.11 ESRS 2 (general disclosures on governance, strategy and the materiality process) always applies; every topical standard applies only where your double materiality assessment finds the topic material.

Standard Covers Typical disclosures
E1 Climate change Mitigation, adaptation, energy Transition plan, Scope 1–3 GHG emissions, targets, energy mix
E2 Pollution Air, water, soil, substances of concern Pollutant emissions, policies and action plans
E3 Water & marine resources Water consumption and withdrawal Water use in water-stressed areas, intensity metrics
E4 Biodiversity & ecosystems Ecosystems, species, land use Sites near sensitive areas, impact drivers, action plans
E5 Circular economy Resource inflows/outflows, waste Material composition, recycled content, waste streams
S1 Own workforce Employees and non-employee workers Headcount data, pay, health & safety, training, collective bargaining
S2 Value-chain workers Workers upstream and downstream Human-rights processes, engagement, remediation channels
S3 Affected communities Communities near operations / value chain Impacts, engagement, remedy
S4 Consumers & end-users Product safety, privacy, access Impacts on end-users, complaint channels
G1 Business conduct Ethics, corruption, supplier payment Anti-corruption controls, lobbying, payment practices

Beyond the datapoint cull, the revised standards change how you report:3

  • Materiality is assessed top-down from business model and strategy rather than bottom-up from a datapoint catalogue.
  • "Fair presentation" applies to the sustainability statement as a whole rather than to each datapoint.
  • Companies may omit information whose collection involves undue cost or effort, and commercially sensitive information.
  • Anticipated financial effects may be estimated and refined later without that counting as an error.
  • Groups may choose between financial control and operational control when setting their GHG boundary.

Is double materiality still required, and how do you actually do one?

Double materiality survived every round of the Omnibus untouched. It remains the single most important exercise in CSRD compliance, because it determines which of the ten topical standards you must apply at all.

The concept is simple, even if the execution is not. Every sustainability matter is tested through two independent lenses:

  • Impact materiality (inside-out): does the company cause, contribute to, or find itself directly linked to actual or potential impacts on people or the environment, across its own operations and its value chain? Severity (scale, scope, irremediability) and likelihood drive the scoring.
  • Financial materiality (outside-in): does the sustainability matter generate risks or opportunities that could reasonably be expected to affect the company's cash flows, development, performance, position, cost of capital or access to finance?

A topic material under either lens must be reported. Carbon pricing might be financially material without your emissions being an outsized environmental impact; water pollution in a supplier's river basin might be impact-material with no near-term financial consequence.

Figure 2. Double materiality's two lenses and the assessment question each asks; a matter enters the report if material under either lens (ESRS 1).
Impact materiality, inside-out "Do we cause, contribute to, or find ourselves directly linked to actual or potential impacts on people or the environment, in our operations or our value chain?" Score each impact by severity (scale, scope, irremediability) and likelihood Your company + its upstream and downstream value chain People & environment workers, communities, nature Material under either lens → disclose under that topic Financial materiality, outside-in "Could this matter create risks or opportunities that affect our cash flows, development, performance, position, cost of capital or access to finance?"

A defensible assessment has five steps. Map your business model and value chain; build a long-list of sustainability matters from the ESRS topic taxonomy; score impacts and financial effects with documented thresholds; consult stakeholders (workers, customers, investors, affected communities) to test your scoring; and record the whole process, because your assurance provider will start there.

The revised ESRS explicitly push a top-down approach anchored in strategy, a licence to stop drowning in 500-row scoring spreadsheets, not to skip the analysis.3

How far into the value chain must you report? The 1,000-employee cap

CSRD reporting was never limited to your own four walls. Material impacts, risks and opportunities must be identified across the upstream and downstream value chain, and E1 requires Scope 3 greenhouse gas emissions, usually the largest and hardest part of a corporate footprint.

The Omnibus adds an important protection for smaller businesses: an in-scope company may not require information beyond the voluntary VSME standard from value-chain partners with fewer than 1,000 employees, except for additional sustainability information that is commonly shared in the sector.5 The Commission is to anchor this "value-chain cap" in a delegated act based on the VSME.5

If you are in scope, design supplier data requests around VSME-shaped questions plus estimation, sector averages, spend-based factors and supplier sampling remain legitimate where primary data is not obtainable. If you are a smaller supplier, the VSME is now the de facto ceiling on what your large customers can demand, and answering it once beats answering forty bespoke questionnaires.

Which phase-in reliefs and transitional options apply?

First-time reporters do not have to disclose everything in year one, and 2026–27 offers unusual optionality:

  • The July 2025 "quick fix" extended wave 1's phase-in reliefs (including anticipated financial effects and certain S1 datapoints) through FY2025 and FY2026, so early reporters gained breathing space rather than new obligations while the rules were rewritten.13
  • For financial years beginning in 2026, companies may choose between the existing ESRS, the revised ESRS in full, or the existing ESRS with specified new reliefs.3
  • From financial years beginning on or after 1 January 2027, the revised ESRS apply, the same year newly scoped companies produce their first data. New reporters therefore prepare against the simplified standards only, and never need to touch the 2023 datapoint list.3

The lesson: build your data model on the revised ESRS, use the phase-ins deliberately (disclose what you have, plan what you defer), and document each relief you rely on, reliefs claimed silently are a classic assurance finding.

What are the CSRD assurance requirements?

Every CSRD sustainability statement requires limited assurance from the statutory auditor or, where member states allow, an accredited independent assurance services provider. The Omnibus locked this at limited assurance permanently: the planned escalation to reasonable assurance is deleted, and the Commission must adopt targeted limited assurance standards by 1 July 2027 to harmonise practice.5

"Limited" should not be read as "light-touch". Assurers test whether your materiality process was actually performed as described, whether disclosed figures trace to evidence, and whether calculation methodologies (emission factors, consolidation boundaries, estimation approaches) are documented and consistently applied. The first two wave 1 cycles showed that the companies that struggled were rarely short of data, they were short of an audit trail.

What are the penalties for non-compliance?

CSRD penalties are set nationally. Member states must provide effective, proportionate and dissuasive sanctions through their transposition of the Accounting Directive, from administrative fines to director-level consequences under national company law, depending on where your reporting entity sits. With Omnibus transposition running until March 2027, several national regimes are still being finalised, so treat any specific fine figure you read as provisional.5 (For due diligence, the parallel CSDDD amendments cap fines at 3% of net worldwide turnover, a separate regime often conflated with CSRD.1)

In practice, the sharper penalties are commercial: a qualified assurance opinion, exclusion from tenders that require CSRD data, higher financing costs where banks price sustainability risk, and greenwashing exposure if published claims cannot be evidenced.

Fell out of scope? What de-scoped companies should still do

If the Omnibus removed your obligation, resist the temptation to stand the whole programme down. Three forces keep the data demand alive:

  • Customer requests. Roughly 8,000 companies still report, and their Scope 3 and S2 obligations flow straight into supplier questionnaires, now standardised around the VSME.
  • Banks and investors. Lenders subject to their own disclosure rules keep asking borrowers for emissions and transition data regardless of CSRD scope.
  • Re-entry risk. Growth or acquisition can carry you back over 1,000 employees / €450 million; a cold start two years before a mandatory FY2027-style deadline is expensive.

Figure 3 shows the scale of the shift, most of the market moved from mandatory to "voluntary but still asked".

Figure 3. Estimated companies in mandatory CSRD scope before and after the Omnibus I Directive: from roughly 50,000 to roughly 8,000 worldwide.
Original CSRD scope (2022 rules) ≈50,000 companies (est.) After Omnibus I (2026 rules) ≈8,000 companies (est.) ≈42,000 companies, 80–90% of the original population, leave mandatory scope Estimates from director-focused analysis of the Omnibus; precise counts depend on national transposition and group structures.

The VSME is the rational baseline. The voluntary standard for SMEs, adopted as Commission Recommendation (EU) 2025/1710 on 30 July 2025, offers a basic module of general disclosures plus a comprehensive module covering the datapoints large counterparties most often request, explicitly designed to replace ad-hoc questionnaires.14 A pragmatic de-scoped posture: keep a Scope 1–2 (and top-line Scope 3) GHG inventory running, publish a short VSME-aligned statement annually, and retain your materiality thinking at memo length rather than full ESRS depth.

A practical first-year CSRD roadmap for FY2027 reporters

If you are newly in scope, your first reporting year starts in under six months. A workable twelve-month sequence:

  1. Months 1–2, Confirm scope and entity structure. Test the 1,000-employee/€450m thresholds at the right consolidation level, decide which entity reports (parent exemptions can consolidate subsidiaries' obligations), and note your member state's transposition status.
  2. Months 2–4, Run the double materiality assessment. Top-down from strategy, both lenses, stakeholder input, documented thresholds. This fixes which topical standards apply and sizes everything downstream.
  3. Months 3–5, Gap analysis against the revised ESRS. Map each applicable disclosure requirement to an owner, a data source and a current-state rating. Expect E1 (especially Scope 3) and S1 workforce data to dominate the gap list.
  4. Months 4–9, Build the data and evidence infrastructure. Stand up GHG accounting across Scopes 1–3, define methodologies, and put every datapoint into a system with an audit trail rather than in spreadsheets. Specialist platforms earn their keep here, EcoLedger, for instance, pairs the revised ESRS datapoint library with an evidence register built for limited assurance.
  5. Months 8–10, Dry run. Draft the statement on part-year data, apply the phase-in reliefs you intend to use, and let internal audit or your assurance provider kick the tyres early.
  6. Months 10–12, Governance sign-off. Board and audit committee review the materiality conclusions and the draft disclosure architecture before the reporting year closes, retrofitting governance after year-end convinces no assurer.

Frequently asked questions

Who does CSRD apply to after the Omnibus?

After the Omnibus I Directive (Directive (EU) 2026/470), CSRD applies to EU companies and groups with more than 1,000 employees and net turnover above €450 million, and to non-EU groups generating more than €450 million of net turnover in the EU with an EU subsidiary or branch above €200 million of net turnover. Listed SMEs and other companies below the thresholds no longer have to report.

Is CSRD delayed?

Partly. The April 2025 stop-the-clock directive postponed wave 2 and wave 3 reporting by two years, and the final Omnibus then removed most of those companies from scope altogether. Companies newly in scope under the 1,000-employee/€450m thresholds report first on financial years beginning on or after 1 January 2027, publishing in 2028; wave 1 companies still above the thresholds continue without a break.

Does CSRD apply to non-EU companies, including UK companies?

Yes, if the group generates more than €450 million of net turnover in the EU for two consecutive financial years and has an EU subsidiary or branch with net turnover above €200 million. First reports cover financial year 2028, published in 2029. UK-headquartered groups with large EU operations are among the most commonly caught.

How many data points are in the ESRS now?

The original ESRS contained well over 1,100 datapoints. The revised ESRS adopted by the European Commission on 3 July 2026 cut mandatory datapoints by more than 60% and total datapoints by more than 70%, while keeping two cross-cutting standards (ESRS 1 and 2) and ten topical standards (E1–E5, S1–S4, G1). They apply to financial years beginning on or after 1 January 2027, subject to the Parliament and Council scrutiny period.

Is double materiality still required under CSRD?

Yes. Double materiality survived the Omnibus intact and remains the foundation of ESRS reporting. Companies must assess each sustainability matter through two lenses, the company's impacts on people and the environment, and the financial risks and opportunities sustainability matters create for the company, and report on any topic material under either lens.

Does a CSRD sustainability statement need to be audited?

Yes, limited assurance by an auditor or, where a member state permits, an independent assurance provider is mandatory. The Omnibus removed the planned escalation to reasonable assurance, and the European Commission must adopt targeted limited assurance standards by 1 July 2027.

What should companies that fell out of CSRD scope do?

De-scoped companies still face sustainability data requests from banks, investors and large customers. The EU's voluntary VSME standard (Commission Recommendation (EU) 2025/1710) is the recognised format for responding, and the Omnibus caps what larger companies may demand from value-chain partners with fewer than 1,000 employees at the VSME level.

Newly in scope for FY2027? The clock is already running.

EcoLedger's ESRS & Double Materiality Software gives you the two-lens assessment, the revised E1–G1 datapoint library and an assurance-ready evidence register in one place. Run the scope test, fix your material topics and start closing gaps before the reporting year opens.

See the ESRS & Double Materiality Software

References

  1. Latham & Watkins, EU Sustainability Omnibus Published in the Official Journal, accessed July 2026.
  2. EUR-Lex, Directive (EU) 2026/470 of 24 February 2026 (Omnibus I), accessed July 2026.
  3. Mayer Brown, European Commission Adopts Revised European Sustainability Reporting Standards, accessed July 2026.
  4. Council of the EU, Council signs off simplification of sustainability reporting and due diligence requirements (press release, 24 February 2026), accessed July 2026.
  5. Covington & Burling, EU CSDDD/CSRD Omnibus Published in Official Journal: Transposition, Delegated Acts, and Guidelines Are Next, accessed July 2026.
  6. Commonwealth Climate and Law Initiative, CSRD reporting post-Omnibus I: what directors need to know in 2026, accessed July 2026.
  7. EUR-Lex, Directive (EU) 2025/794 of 14 April 2025 ("stop-the-clock"), accessed July 2026.
  8. Ebner Stolz, CSRD & CSDDD: Omnibus agreements published in the Official Journal of the EU, accessed July 2026.
  9. ISS-Corporate, EU Sustainability Rules Reset: What the 2026 Changes Mean, accessed July 2026.
  10. GOV.UK, UK Sustainability Reporting Standards: UK SRS S1 and UK SRS S2, accessed July 2026.
  11. EFRAG, Draft Simplified ESRS (technical advice November 2025; drafts published 3 December 2025), accessed July 2026.
  12. EUR-Lex, Commission Delegated Regulation (EU) 2023/2772 of 31 July 2023 adopting the ESRS, accessed July 2026.
  13. European Commission (DG FISMA), Commission adopts "quick fix" for companies already conducting corporate sustainability reporting, accessed July 2026.
  14. EUR-Lex, Commission Recommendation (EU) 2025/1710 of 30 July 2025 on the voluntary sustainability reporting standard for SMEs (VSME), accessed July 2026.
Back to blog