Omnibus Directive and CSRD: Which Companies Are Still Required to Report, and What Will Change in 2027

The CSRD Omnibus Directive (Directive (EU) 2026/470) limits the obligation to EU companies with an average of more than 1,000 employees and revenue of more than 450 million euros, either individually or as a group. They will report for the first time on the 2027 fiscal year.

With this change, most companies that were preparing for the second wave—including all publicly traded SMEs—are now excluded. But falling outside the scope does not mean they will stop managing ESG data: customers, banks, and government agencies will continue to request it, albeit in a more limited format.

What Is the Omnibus I Directive and Why Does It Change the CSRD?

Directive (EU) 2026/470, known as Omnibus I, is the centerpiece of the simplification package that the Commission presented in February 2025. It amends the CSRD and the CSDDD to focus obligations on larger companies and limit what can be required of smaller ones.

It was adopted on February 24, 2026, published in the Official Journal of the European Union on February 26, and has been in effect since March 18. Member States have until March 19, 2027, to transpose the changes to the CSRD and until July 26, 2028, to transpose those to the CSDDD (text available on EUR-Lex).

This was preceded by the “stop-the-clock” directive (Directive (EU) 2025/794), which in 2025 delayed the second and third waves by two years to allow time to negotiate the new scope.

Which Companies Are Still Subject to the CSRD Following the Omnibus Directive

The new thresholds: more than 1,000 employees and more than €450 million

Since the Omnibus Directive, the CSRD applies only to EU companies that meet both of the following criteria:

• an average of more than 1,000 employees during the fiscal year;
• more than 450 million euros in net sales.

They apply to individual companies and parent companies of corporate groups on a consolidated basis. The “two out of three” rule from the original CSRD is eliminated. With these thresholds, a manufacturing company with 1,200 employees and revenue of €300 million is excluded, as is a logistics group with 900 employees and revenue of €600 million.

Non-EU Groups

Parent companies from third countries are subject to the requirements if they generate more than €450 million in revenue in the EU over two consecutive fiscal years and have a subsidiary or branch in the EU with revenue exceeding €200 million.

Listed SMEs Are Exempt from the Mandatory Reporting Requirement

The third wave is eliminated. Listed SMEs may report on a voluntary basis and are protected by the value chain limit described below.

Before and after the Omnibus Act

	Original CSRD (Directive 2022/2464)	CSRD following Omnibus I
EU Companies	Large companies: two out of three criteria (more than 250 employees, more than €50 million in revenue, more than €25 million in total assets) and EIP	More than 1,000 employees and more than 450 M€ in revenue (cumulative)
Listed SMEs	Mandatory (with the option to defer)	Not subject to mandatory reporting
Non-EU groups	More than €150 million in the EU and a subsidiary or branch exceeding certain thresholds	More than €450 million in the EU and a subsidiary or branch with more than €200 million
Verification	Limited, with planned transition to reasonable	Limited only
Value chain inquiries	No specific limit	Limit for companies with up to 1,000 employees

Source: Directive (EU) 2022/2464 and Directive (EU) 2026/470.

CSRD Timeline: Who Reports and When

Here is the CSRD schedule.

First Wave and Temporary Exemption

Large public-interest entities that report starting in fiscal year 2024 remain subject to the requirements if they exceed the new thresholds. Those that do not exceed them may be exempt from reporting for fiscal years 2025 and 2026 if their Member State exercises the option provided by the Omnibus Directive. Starting in 2027, they will fall outside the scope.

Entities now falling within the scope: fiscal year 2027

Companies that were not included in the first wave (in practice, the large companies from the former second wave with more than 1,000 employees and €450 million in revenue) will report on the fiscal year beginning on January 1, 2027, and publish their reports in 2028.

Non-EU parent companies: fiscal year 2028

Groups from third countries that meet the thresholds will report on the 2028 fiscal year and publish their reports in 2029.

In summary: 2027 is the first reporting year for nearly all required companies, and the data they record starting January 1 must be verifiable in 2028.

What’s Changing in the Simplified ESRS

They have already been approved and are in effect

The Commission adopted the delegated act in July 2026. It was published in the Official Journal of the European Union on September 21 as Delegated Regulation (EU) 2026/1563 and entered into force on November 10, 2026. They are mandatory for reporting periods beginning on or after January 1, 2027.

Fewer Data Points and Greater Emphasis on Quantitative Analysis

The revision substantially reduces the number of mandatory datapoints, eliminates a significant portion of the narrative sections, and makes the double materiality analysis more balanced. The result is a shorter standard that is more focused on quantitative indicators (emissions, energy, water, waste, workforce), which must be based on actual, traceable data.

Indicators related to the company’s own workforce, including those on health and safety, remain. This is one of the reasons why occupational health and safety (PRL) and ESG can no longer be separated.

Voluntary early adoption in 2026

For the 2026 reporting year, reporting entities may continue to use the previous ESRS (Set 1, as amended by Delegated Regulation (EU) 2025/1416), apply them with the simplifications provided for in the new regulation, or adopt the fully simplified ESRS. The sustainability report must indicate which version has been applied.

Assurance remains limited

The Omnibus Directive eliminates the transition to reasonable assurance. Verification will be limited, with harmonized standards expected by July 1, 2027. “Limited” does not mean superficial: the verifier will continue to ask where each piece of data comes from and how it was calculated.

If your company falls outside the scope of the CSRD: ESG data is still required

This is the largest group. Falling outside the scope of the CSRD eliminates the regulated reporting requirement, but not the demand for information. Clients who are required to report will report on their value chain and will ask you for emissions, consumption, and safety data. Banks and investors need ESG data for their own reporting. Tenders are increasingly weighting environmental and social criteria, and government agencies continue to request your environmental disclosures. In the manufacturing, energy, and logistics sectors—where companies are regular suppliers to large conglomerates—that pressure shows no signs of letting up.

The Value Chain Limit and the Voluntary Standard

The new development is that these requests are now subject to a limit. Starting with fiscal years beginning on January 1, 2027, a reporting entity may not require partners in its value chain with 1,000 or fewer employees to provide more information than is specified in the voluntary standard (value chain cap). That standard is based on EFRAG’s VSME, and the Commission has adopted it as Delegated Regulation (EU) 2026/1560, effective as of September 24, 2026.

The limit applies only to what the client requests for its own CSRD report, not to requests arising from other legal obligations. And while you may refuse to provide additional information, this does not exempt you from providing—and providing quickly—what is required. In practice, the voluntary standard has become the go-to format for responding to clients and banks. If you plan to use it to prepare your own report, our guide on how to prepare a sustainability report explains how to structure it.

Situation in Spain: Transposition Pending and EINF in Effect

Spain did not fully transpose the original CSRD. The Draft Law on Corporate Sustainability Reporting, approved by the Council of Ministers in October 2024, is still pending in Congress and, as of the date of this article, has not been published in the Official State Gazette (BOE). Since it was drafted using the old thresholds, it will have to be brought into compliance with the Omnibus Directive by March 19, 2027. For now, there is no confirmed timeline or national thresholds.

In the meantime, Law 11/2018 remains in effect. The Non-Financial Information Statement (EINF), verified by an independent service provider, remains mandatory for entities that meet its requirements: having more than 250 employees and being a public-interest entity, or meeting two size criteria for two fiscal years.

On October 20, 2026, the CNMV and the ICAC updated their joint statement on the EINF. They recommend that companies with more than 1,000 employees prepare it in accordance with the revised ESRS, and that other companies consider either the ESRS or the voluntary standard.

Practical implication: Many Spanish companies that fall outside the scope of the CSRD following the Omnibus Directive are still required to prepare the EINF. It is not advisable to dismantle the reporting process prematurely.

The CSDDD is also being scaled back

Omnibus I also amends the Due Diligence Directive (CSDDD). It will apply only to companies with more than 5,000 employees and global revenue exceeding 1.5 billion euros, and their obligations take effect on July 26, 2029. The maximum penalty is set at 3% of global revenue.

For most medium-sized and large companies, this will not be a direct obligation, but rather an indirect one: affected groups will pass on due diligence questionnaires and clauses to their suppliers.

What to Do Now with Your Sustainability Reporting

Regardless of your company’s situation following the CSRD Omnibus Directive, there are four tasks you should address in the coming months.

1. Review your double materiality analysis

If your company remains subject to the requirement, align it with the more proportionate approach of the simplified ESRS: some issues may no longer be material, while others may gain importance. If your company falls outside the scope, this will help you decide which data to prioritize for clients and investors.

2. Refine the indicators

With fewer data points, each one carries more weight. Review the formula, the source data, and who is responsible for validating each indicator. Remove duplicates and document the definitions so that the waste recovery rate or frequency index is calculated the same way at all facilities.

3. Prepare Your Response for the Value Chain

If your company has 1,000 employees or fewer, prepare a “standard data package” aligned with the voluntary standard to respond quickly to clients and banks. If your company is required to comply, adjust the supplier questionnaires to the new threshold.

4. Ensure that data can be traced

Limited assurance requires tracing the path of each data point—from the utility bill, the waste management company’s delivery note, or the accident report all the way to the figure in the report. If that path involves multiple Excel spreadsheets sent via email, the risk of error is high.

How to Keep the Sustainability Report Traceable and Auditable

Simplified ESRSs require less, but what they do require must be done correctly. The main risk isn’t the standard itself, but rather the data collection process. In many companies with multiple locations, each site sends its Excel file, someone consolidates it manually, the KPIs are recalculated on another sheet, and no one knows which version is the final one when the auditor arrives.

Fertiberia, which has production facilities in Spain, France, and Portugal, moved beyond using Excel to centralize its environmental data. Estela Zapico, from the Environmental Coordination department, explains this in this video, which is less than three minutes long.

What Fertiberia describes is what any report needs to include following the Omnibus Directive:

• “Raw” data from all facilities in one place, rather than pre-calculated results on local spreadsheets.
• Automatically calculated KPIs, such as waste recovery rates or indicators per metric ton produced, using the same formula across all plants.
• Comparisons between plants to detect deviations before the auditor does.
• Data extraction for the EINF, administrative purposes, investors, or a client’s questionnaire, without having to recreate Excel spreadsheets.

Prodity does not include the regulatory framework: your team is responsible for interpreting the ESRS, the voluntary standard, and Law 11/2018. What it does is ensure that the data feeding those reports is organized, traceable, and ready for extraction. If you’re evaluating tools, we’ve compiled the key features of ESG software. In Prodity’s ESG solution, you can see how it applies to environmental and sustainability management.

Get Your ESG Data Ready for What’s Ahead

Whether your company is subject to the CSRD or not, the starting point is the same: centralized source data, uniformly defined metrics, and a historical record that stands up to scrutiny. Fertiberia has already done this with Prodity at its facilities in three countries. Request a demo and discover how to automate ESG reporting using your own facilities and metrics.

Frequently Asked Questions About the Omnibus Directive and the CSRD

“`