Simplified, but intact: what Omnibus I now means for CSRD and CSDDD

Updated on 30 October 2026 to reflect the final published text of Omnibus I and the revised reporting standards. First published on 17 December 2025.

When the European Parliament approved Omnibus I in December 2025, the package still had to be published before it became law, and the revised reporting standards were still in draft. Both steps are now complete. The scope of both laws is now settled until the Commission’s review, due by 26 July 2031.

Far fewer companies are in scope than under the original texts, and those that are have more time and fewer datapoints to report. Companies that stay in scope still have to show how they find and deal with harm in their supply chains, and the changes put more weight on independent evidence.

CSRD now covers only the largest companies

From financial year 2027, CSRD applies to EU companies and groups with more than 1,000 employees and net turnover above €450 million, with the first reports due in 2028. Non-EU groups are in scope if their EU turnover is above €450 million in each of the last two financial years and they have an EU subsidiary or branch with turnover above €200 million. Listed small and medium-sized enterprises (SMEs) are out of scope.

Companies that already report under the first wave of CSRD continue for financial years 2025 and 2026, though Member States can exempt those that fall below the new thresholds. Member States have until 19 March 2027 to transpose the changes into national law.

Assurance stays at the limited level, and the requirement to adopt standards for reasonable assurance has been removed. The Commission must adopt limited assurance standards by 1 July 2027. It will no longer adopt sector-specific reporting standards.

The revised European Sustainability Reporting Standards (ESRS) were published as Delegated Regulation (EU) 2026/1563 and enter into force on 10 November 2026. The Commission states that they reduce mandatory datapoints by more than 60% and total datapoints by more than 70%. They apply from financial year 2027. For financial year 2026, companies can choose between the previous and the revised standards, and must say which they used.

Smaller suppliers can decline extra reporting requests

The change with the most direct effect on supplier programmes is the value chain cap. A company reporting under CSRD cannot require more information than a short voluntary standard sets out from companies in its value chain with 1,000 or fewer employees. Those suppliers can decline to provide anything beyond it, though they can choose to share more.

The cap applies only to information requested for sustainability reporting. The Directive states that it does not affect requests made for other purposes, including due diligence. Supplier questionnaires will therefore need to make clear why each question is being asked.

CSDDD applies from 2029, with a narrower scope and a risk-based process

CSDDD now applies to EU companies with more than 5,000 employees and net worldwide turnover above €1.5 billion, and to non-EU companies with net turnover in the EU above €1.5 billion. Member States must transpose it by 26 July 2028, and it applies to all in-scope companies from 26 July 2029.

The process is now explicitly risk-based. Companies first carry out a scoping exercise, based on reasonably available information, and then assess in depth the areas where adverse impacts were identified. They can request information from business partners with fewer than 5,000 employees only where it cannot reasonably be obtained by other means. Due diligence measures are assessed at least every five years, and sooner where there are reasonable grounds.

Several obligations have been removed. Companies no longer have to adopt a climate transition plan under CSDDD. The EU-wide civil liability regime has gone, so civil claims will depend on national law. Fines are capped at 3% of net worldwide turnover. Member States cannot introduce national rules that diverge from the Directive’s core due diligence steps, such as identifying and addressing adverse impacts.

Independent evidence matters more under both laws

Read together, the two laws pull in the same direction. CSRD limits what you can require from smaller suppliers for reporting. CSDDD limits what you can ask smaller business partners when the information is available elsewhere. Both still expect you to know where your most serious risks are and to show what you did about them.

That evidence has to come from more than supplier questionnaires. Risk data by country, sector and supplier tells you where to look first, and independent site assessments and corrective action records show what was found and what was done about it. EiQ’s risk ratings draw on data from LRQA’s own audit network, so the first scoping step can start from evidence rather than from what suppliers choose to report.

A risk-based approach also means that not every supplier gets the same attention, so keep a record of how you decided where to focus and why.

Meghan Quinlan and Jaime Rúa Tavira discussed how to build a due diligence programme that holds up while the rules keep changing in a recent episode of EiQ Voices.

Where to start

Our CSDDD regulation page sets out the current obligations and dates in more detail. To discuss what the changes mean for your supplier programme, contact our team.