EU CSRD after the Omnibus: what has actually changed and what has not

What you need to know

Between the "Stop-the-Clock" Directive and the Omnibus I Directive, the scope, timing and content of reporting under the Corporate Sustainability Reporting Directive (CSRD) have all moved. 

This post separates what has actually changed from what remains the same, so that companies can focus their attention where it matters.

What has changed

• Fewer companies are in scope. An EU undertaking or non-EU issuer is now only caught if it has, individually or on a consolidated basis, more than EUR 450 million net turnover and more than 1,000 employees on average. In light of the amended scope, the previous difference between second and third wave companies has been removed. In addition, non-EU ultimate parent undertakings now face a EUR 450 million EU turnover test plus a EUR 200 million EU subsidiary/branch threshold. Pre-March 2026 (when the Omnibus I came into force) scoping assessments should therefore not be relied on as still being correct.
• Timelines have shifted, but not for everyone. In-scope companies which have not yet been reporting under the CSRD now need to prepare reports as from 2028 (instead of 2026). Reporting by non-EU ultimate parent undertakings is unaffected, with reports still being due as from 2029.
• Falling out of scope isn't an immediate exit. First wave companies that drop below the new thresholds must keep reporting until the financial year starting on or after 1 January 2027, unless the relevant Member State grants an earlier exemption.
• The reporting standards are being slimmed down. Revised ESRS and a new voluntary standard were adopted on 3 July 2026, subject to Council/Parliament scrutiny. A value chain cap now limits what in-scope companies can demand from smaller value chain partners.
• Non-EU companies are getting a bespoke standard. Tailored standards for non-EU parents (ESRS-40a) are still in development, with a consultation running to 31 October 2026, and will be narrower and impacts-only compared to the standard ESRS.

What has not changed

• CSRD reporting is still mandatory for in-scope companies. The new voluntary standard is for companies outside the CSRD's scope, and for managing value chain requests, not an opt-out.
• Double materiality is still the core concept for the main ESRS: impact on people and the environment, and financial risks and opportunities (even if datapoints have been cut).
• Non-EU exposure hasn't disappeared. Companies can still be caught directly (through an EEA listing or large EU operations) or indirectly (by being included in the value chain of an in-scope company). The thresholds moved; the exposure didn't.
• Transposition is still unfinished. Both Directives (CSRD and Omnibus I) still need transposing across Member States, and implementation remains uneven, with potential goldplating in some Member States.

What this means in practice

The key takeaways are:

• Re-run your scoping: any assessment done before March 2026 needs revisiting against the new thresholds and timings.
• Keep building reporting capability even if currently out of scope. In-scope customers and partners will still come to you for value chain data, so being ready to respond puts you ahead.
• Watch the standards, not just the Directive. The Directive sets the scope and timing; the ESRS and voluntary standard set the actual reporting burden, and both those standards are still being finalised.

How we can help

For the full picture on scope, timing, content and assurance requirements under the CSRD as amended by Omnibus I, see our CSRD Quick Guide and EU CSRD demystified materials. 

If you would like to discuss how these developments affect you, please get in touch.