If you built a compliance plan for European sustainability disclosure two years ago, most of it is now out of date.
The rules that were meant to pull tens of thousands of companies into mandatory environmental and social reporting have been cut back sharply. Thresholds went up, deadlines moved, and the reporting standards themselves were rewritten and trimmed.
For legal, finance and operations teams, this is good news wrapped in a headache. The obligation is lighter, but working out whether it still applies to you takes real effort. Here is where things actually stand.
Key Takeaways
- The Omnibus I Directive (EU) 2026/470 was published in the EU Official Journal on 26 February 2026 and entered into force on 18 March 2026.
- Mandatory reporting now applies to EU companies with more than 1,000 employees and net turnover above €450 million. Roughly 85% of previously in-scope companies fall out.
- Non-EU parent companies are caught at €450 million of EU turnover, provided they have an EU subsidiary or branch above €200 million.
- First reports under the new framework cover financial years starting on or after 1 January 2027, published in 2028. Non-EU groups follow a year later.
- The reporting standards were rewritten with 61% fewer mandatory datapoints, but double materiality survived intact.
- Third-party assurance stays, on a limited assurance basis. The planned escalation to reasonable assurance was dropped.
The rewrite that landed in March
The Corporate Sustainability Reporting Directive was never a quiet piece of law. It arrived in 2022, replaced the older Non-Financial Reporting Directive, and turned voluntary ESG disclosure into a binding legal obligation backed by real penalties.
Then, two months into the first reporting year, the European Commission proposed unpicking large parts of it. That proposal became the Omnibus package, and after a year of negotiation between the Parliament and the Council it was finalised.
The result is Directive (EU) 2026/470, in force since 18 March 2026. Member States generally have until 19 March 2027 to write it into national law.
Who still has to report
The threshold change is the headline. Previously a company was caught if it met two of three tests: 250 employees, €50 million turnover or €25 million on the balance sheet.
Now an EU company must exceed both 1,000 employees and €450 million in net turnover. Both conditions, not either. Listed small and medium enterprises are out entirely.
For non-EU groups the test is turnover-based. The ultimate parent needs more than €450 million of net turnover generated in the EU, plus an EU subsidiary or branch above €200 million.
Estimates put the reduction in scope at around 85% compared with the original directive. Sector-specific reporting standards, which many industries had been preparing for, were scrapped altogether.
The timeline nobody should assume they know
This is where teams are getting caught out. Companies that were already reporting, the so-called wave one group, do not simply stop.
Their obligations under existing national law continue for financial years 2025 and 2026. Member States were given the option to exempt companies that will drop out of scope in 2027, but that exemption only exists once a country has actually passed it into national law.
Everyone else in scope reports on financial years beginning on or after 1 January 2027, with publication in 2028. Non-EU companies get an extra year and report on financial year 2028 in 2029.
A lighter standard, not a different one
The European Sustainability Reporting Standards were rewritten alongside the directive. EFRAG delivered its technical advice in December 2025, the Commission consulted on a draft and the final delegated act was adopted on 3 July 2026.
The trimming was substantial. Mandatory datapoints fell by 61%, and because voluntary datapoints were removed as a category, the total count dropped by roughly 70%.
The revised standards apply to financial years beginning on or after 1 January 2027, with voluntary early application permitted for financial year 2026. They become legally effective once the scrutiny period by the Parliament and Council ends and the act is published in the Official Journal, so it is worth checking the current status before you plan around them.
What did not change is more interesting than what did. Double materiality remains the foundation, meaning companies still assess both how sustainability issues affect their finances and how their operations affect people and the environment. Limited assurance by a statutory auditor or independent provider also stays.
Why this lands on your contracts
There is a provision here that legal teams should not miss. Companies in scope cannot demand sustainability data from value chain partners with 1,000 employees or fewer beyond what the new voluntary standard covers.
That cap protects smaller suppliers from being buried in questionnaires. It also means large reporters have to be far more deliberate about what they ask for and how they secure it.
In practice, the data you can rely on is the data your agreements actually oblige someone to give you. Well-drafted climate clauses with measurable commitments, defined reporting obligations and clear audit rights do more for a disclosure programme than any amount of chasing by email.
Building a process that survives the next revision
The lesson from the last eighteen months is that the rules move. Anyone who hard-coded the 2023 standards into spreadsheets spent 2026 rebuilding from scratch.
Teams that came through it well treated disclosure as a data problem rather than a document problem. They centralised source data once, mapped it to whichever framework needed it, and kept the mapping layer flexible.
Sweep, the sustainability intelligence platform, takes that approach with a dedicated module for CSRD reporting built around a pre-configured library of indicators aligned to ESRS. It pairs a double materiality assessment tool with data collection questionnaires, gap analysis dashboards and an AI-assisted report generator, and the platform updates as reporting standards evolve.
The multi-framework angle matters too. Sweep maps a single set of ESG inputs across CSRD and ESRS, CDP, GRI, ISSB and IFRS S1 and S2, the EU Taxonomy and SBTi-aligned target setting, which removes a lot of duplicate data collection.
What to do between now and 2027
Start by confirming scope properly, using consolidated figures and both tests rather than a rough guess. Plenty of companies assume they are out when a subsidiary structure says otherwise.
If you are in scope, decide now who owns the process internally. Sustainability data touches finance, legal, procurement and operations, and ownership disputes are the single most common cause of missed deadlines.
Then audit what data you can actually get. Run a materiality assessment early, identify the gaps, and fix the contractual and system problems while you still have a full financial year of runway.
The bottom line
Europe did not abandon sustainability disclosure. It narrowed the net and simplified the catch, and then gave the remaining companies a longer runway to get it right.
If you are still in scope, the reprieve is real but it is not indefinite. Financial year 2027 starts sooner than it looks, and the companies that use the intervening months to build a durable data process will find the next rule change far less painful than the last one.
Frequently Asked Questions
Is the CSRD cancelled? No. The directive remains in force. The Omnibus I Directive amended it, raising the thresholds and pushing back the deadlines, but the obligation itself still exists for companies that meet the new tests.
My company has 1,200 employees but €300 million turnover. Are we in scope? Not under the new EU thresholds, which require both more than 1,000 employees and net turnover above €450 million. You may still choose to report voluntarily, and a Commission-adopted voluntary standard exists for exactly that purpose.
Do we still need a double materiality assessment? Yes. Despite the simplification, double materiality survived the rewrite unchanged and remains the mechanism for deciding which sustainability matters you disclose.
What level of assurance is required? Limited assurance, provided by a statutory auditor or an independent assurance services provider. The original plan to move to reasonable assurance later was removed.
When do non-EU companies have to report? Non-EU groups meeting the turnover tests report on financial year 2028, with publication in 2029, which is one year behind their EU counterparts.
Will the rules change again? Possibly. The Commission is required to review whether the scope is appropriate in 2031, and the revised standards were still completing their scrutiny period through 2026. Building a flexible process is safer than optimising for one version of the rules.