CSRD and ESRS Reporting After Omnibus I: Who Is Still in Scope

If you are working from a page or a slide that still says "250 employees and EUR 50 million", it predates February 2026 and it is wrong.

What the CSRD is, and where ESRS fit

The CSRD is the EU law that requires certain companies to publish sustainability information inside their management report. It does not list the disclosures itself; it delegates that to the European Sustainability Reporting Standards (ESRS), adopted by the European Commission as delegated regulations — the first set as Commission Delegated Regulation (EU) 2023/2772.

So the division of labour is simple: the CSRD, as it amends the Accounting Directive (2013/34/EU), answers who reports, when, where the information goes and what assurance it needs; the ESRS answer what you disclose, datapoint by datapoint. The text to read is the consolidated Accounting Directive, not the CSRD itself — that is where the rules now live, and where Omnibus I made its changes.

What Omnibus I changed

Directive (EU) 2026/470 was adopted on 24 February 2026, published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026. Member States have to transpose the reporting provisions by 19 March 2027. The changes that matter most:

The transposition deadline is worth holding on to. Until a Member State has transposed, the national law in force is the pre-Omnibus version, and Member States have discretion on some points. Where your obligation sits in 2026 is a question about a specific national law, not only about the directive.

Are you in scope? A two-part test

Under the amended Articles 19a and 29a of the Accounting Directive, an undertaking is in scope if, on its balance sheet date, it exceeds:

1. a net turnover of EUR 450,000,000, and
2. an average of 1,000 employees during the financial year.

Both have to be exceeded — this is an "and", not a "two out of three" test of the kind used in the EU's own size categories. The same test applies at group level under Article 29a.

A company listed on an EU regulated market that does not exceed both thresholds is no longer required to report. That is the largest change Omnibus I made, and the one most existing English-language material has not caught up with.

Who reports, and when

Two cautions. The exemption for financial years 2025 and 2026 is an option for Member States, not a rule, so whether a company that has dropped out may skip those years depends on national law. And "wave" is market shorthand, not a term in the directive, which works through the dates of application in Article 5(2) of Directive (EU) 2022/2464.

Non-EU groups: the Article 40a route

A group headquartered outside the EU — in the United Kingdom, the United States, Türkiye or anywhere else — can be caught even though no EU entity meets the Article 19a test. Article 40a of the Accounting Directive applies where:

• the third-country undertaking generated net turnover in the Union above EUR 450 million for each of the last two consecutive financial years, and
• it has an EU subsidiary whose net turnover exceeds EUR 200 million, or, where there is no such subsidiary, an EU branch whose net turnover exceeds EUR 200 million.

The obligation is different in kind from Article 19a. The EU subsidiary or branch does not report on itself: it publishes and makes accessible a sustainability report drawn up at the level of the third-country parent, together with an assurance opinion. Those provisions apply for financial years starting on or after 1 January 2028.

The standard for that report does not exist yet. EFRAG opened a 100-day consultation on the ESRS-40a exposure draft on 23 July 2026, running to 31 October 2026, and expects to deliver technical advice to the Commission in January 2027, after which the Commission runs its own consultation. If you sit in a non-EU group above these thresholds, the useful thing to do in 2026 is read the exposure draft and respond to it.

The revised ESRS: what changed

On 3 July 2026 the Commission adopted a delegated regulation replacing Annexes I and II of Delegated Regulation (EU) 2023/2772. Its own figures: mandatory datapoints cut by more than 60 per cent, total datapoints by more than 70 per cent, reporting costs down by more than 30 per cent per company. Beyond the arithmetic, the revision prioritises quantitative datapoints over narrative text, sharpens the line between mandatory and voluntary datapoints, and gives clearer instructions on applying the materiality principle — explicitly so that assurance providers stop pushing companies to report immaterial information.

Two dates matter more than the percentages. The revised ESRS apply to financial years beginning on or after 1 January 2027; and the regulation enters into force four months and one week after adoption, which at the date of this review had not yet happened — it was still with the European Parliament and the Council for scrutiny.

For financial years starting in 2026 there is a choice. A company already in scope may apply the current ESRS (as amended by Delegated Regulation (EU) 2025/1416), or the revised ESRS, or the current ESRS with a defined list of reliefs taken from the revision — including the top-down approach to the double materiality assessment, the undue cost and effort and value chain limitations, and the executive summary relief. Whichever it picks, it has to state in its sustainability statement which version it applied.

Out of scope, but your customer still asks

Removing a company from the scope of application does not remove it from someone else's value chain. This is the part of the package that matters most to suppliers.

Under Article 29ca of the Accounting Directive, the Commission adopted a second delegated regulation on 3 July 2026 establishing what it calls the Voluntary Standard — built on the VSME standard recommended in July 2025, with changes "kept to a minimum", and superseding that recommendation.

It does two jobs. It gives a company outside the scope of application one proportionate framework to report against instead of dozens of buyer questionnaires. And it sets the value chain cap: a company subject to CSRD reporting is prohibited from requiring, from an undertaking in its value chain that does not exceed an average of 1,000 employees — a "protected undertaking" — information beyond what the Voluntary Standard specifies. The protected undertaking has a statutory right to refuse anything more, and a reporting undertaking that asks for more must tell it which extra information is requested and that it may decline.

The cap has limits that are easy to misread:

• it does not prohibit voluntary sharing, including information commonly shared within a sector;
• it does not override a contractual obligation, or an obligation under Union or national law, to provide information that stays within the Voluntary Standard;
• it applies only to information gathered for the purpose of sustainability reporting under the Accounting Directive — not to due diligence obligations or to the buyer's own risk management.

Size is established by self-declaration: a reporting undertaking may rely on it without verification, unless it knows, or can reasonably be expected to know, that the declaration is manifestly incorrect. The Voluntary Standard has a Basic Module and a Comprehensive Module; its value chain cap provisions apply from financial years beginning on or after 1 January 2027.

Double materiality is still the basis

Omnibus I did not touch the foundation. Article 19a still requires "information necessary to understand the undertaking's impacts on sustainability matters, and information necessary to understand how sustainability matters affect the undertaking's development, performance and position". That is impact materiality and financial materiality, side by side — double materiality — and it remains what separates CSRD reporting from the investor-focused approach of IFRS S1 and S2 and of the national standards built on them.

What changed is the mechanics, not the principle: the revised ESRS simplify the materiality assessment and allow a top-down approach. The assessment still determines the shape of the whole report, so it is worth treating as a governance exercise with an audit trail rather than a workshop.

Assurance: limited, and only limited

Sustainability reporting under the CSRD is subject to a limited assurance engagement. Omnibus I removed the Commission's mandate to adopt reasonable assurance standards, so the step up to reasonable assurance is no longer on the statute book. The deadline for the Commission to adopt harmonised limited assurance standards was postponed to 1 July 2027; until then, assurance follows national standards.

In practice, limited assurance is not a light touch on a first report. The assurance provider tests whether the process that produced the numbers exists, and a materiality assessment with no documented evidence base is where first-time reporters most often lose time.

Subsidiaries and suppliers outside the EU

Most groups in scope have part of the picture outside the Union, and it has three layers that are easy to conflate.

One: is the group caught by Article 40a? If the group's EU turnover exceeds EUR 450 million for two consecutive years and it has an EU subsidiary or branch above EUR 200 million, the answer is yes, from financial year 2028 — and the non-EU entity is part of the group being reported on, not the reporting entity.

Two: is that entity being asked for data as part of someone's value chain? Almost certainly, and from more than one direction: the group's own reporting, plus EU customers running their own ESRS value chain disclosures. Here the value chain cap is the practical tool. A supplier with fewer than 1,000 employees is a protected undertaking in the value chain of an EU reporting undertaking, and the Voluntary Standard defines the ceiling of what may be required of it for that purpose.

Three: what does the local regime require? A non-EU subsidiary can carry a mandatory obligation of its own, entirely independent of the group's CSRD position, and often on a different materiality basis. Türkiye is one example among several: the Turkish Sustainability Reporting Standards (TSRS), issued by the Public Oversight, Accounting and Auditing Standards Authority (KGK), are based on IFRS S1 and IFRS S2 and have applied to fiscal periods beginning on or after 1 January 2024, with limited assurance required from the first year of reporting — financial materiality, not double materiality.

The efficient answer is one data set that serves all three layers. The expensive answer is three separate projects, which is the default when a group treats a subsidiary as a data source rather than as a reporting entity in its own right.

What to do in the next six months

1. Re-run the scope test on the current thresholds — EUR 450 million and 1,000 employees, both exceeded, at the level that actually reports. Write down the result and the date.
2. Check your Member State, not just the directive. Transposition is due 19 March 2027, and the exemption for financial years 2025 and 2026 is a national choice.
3. If you remain in scope, plan for the revised ESRS. They apply from financial year 2027. Decide now whether you will take the 2026 reliefs, and record the choice — you will have to state it in the sustainability statement.
4. Re-baseline the materiality assessment against the revised standards rather than carrying the 2024 version forward untested.
5. Fix your value chain requests. If you are a reporting undertaking, align supplier questionnaires to the Voluntary Standard and add the notice the directive requires when you ask for more.
6. If you are a supplier, prepare one answer. A Voluntary Standard Basic Module data set, kept current, replaces most of the questionnaire traffic and gives you a documented basis for declining the rest.
7. If you are a non-EU group above the Article 40a thresholds, read the ESRS-40a exposure draft and respond before 31 October 2026.

This guide is general information about published EU legislation, not legal advice on your company's position. Where a decision depends on national transposition, confirm it against the law of the Member State concerned.

Frequently asked questions