CSRD After Omnibus: The Finance Director's Guide to What Actually Changed (2026)

If you built a CSRD plan in 2024 or early 2025, tear it up. The EU has since rewritten the rules through its Omnibus package, and the version of CSRD you prepared for no longer exists.

This is the current picture, in plain terms, for a finance director who needs to know one thing: are we still on the hook, and if not, what replaces it?

What Omnibus actually did

On 26 February 2026 the EU published the Omnibus I directive — Directive (EU) 2026/470 — and it entered into force on 18 March 2026. It's law, not a proposal, and it is the biggest change to European sustainability reporting since CSRD was created.

The headline: the number of companies caught by CSRD has fallen from an estimated 50,000 to roughly 5,000. Omnibus took a regulation designed to sweep in the mid-market and narrowed it back to the largest companies only.

Who is still in scope

Under the revised rules, mandatory CSRD reporting applies mainly to:

• EU companies with more than 1,000 employees and more than €450m net turnover. Both tests, not either.
• Non-EU parent groups generating substantial turnover in the EU — the threshold has been raised significantly from where it was, so a lot of internationally-owned groups that were preparing are now out.

And the change that removes most of the mid-market: listed SMEs are now fully exempt. The wave that was going to bring smaller listed companies into scope has been scrapped entirely.

If your business sits below 1,000 employees or below €450m turnover, you are — with limited transitional exceptions — very unlikely to have a direct legal CSRD obligation.

The timeline, now that the dust has settled

• Companies already reporting (the original Wave 1 — large public-interest entities that were under the old NFRD) continue reporting near-term. Some now fall below the new thresholds, and member states may grant exemptions for the 2025 and 2026 financial years, but this is being decided country by country.
• Other large companies that still meet the revised thresholds begin reporting in 2028, covering financial year 2027.
• Non-EU groups in scope come in later still, reporting on FY2028 in 2029.
• The simplified ESRS — the actual disclosure standards — are being cut back, with a delegated act expected in late 2026 and the new standards applying from FY2027. Sector-specific standards have been dropped.

The practical read for most finance directors: even where you remain in scope, the first mandatory report is 2028, and the standards you'll report against are being simplified before then. There is time, and the target is smaller than it was.

The part that matters even if you're out of scope: the value-chain cap

Here's where it gets directly relevant to businesses that will never file a CSRD report.

Companies that are in scope still have to report on their value chains — which means they need sustainability data from their suppliers. Under the old rules, that created an open-ended risk: a large customer could ask a small supplier for almost anything.

Omnibus introduced a value-chain cap to stop that. Companies in a reporting company's value chain that have fewer than 1,000 employees now have a legal right to refuse information requests that go beyond a forthcoming voluntary standard (the VSME). In the language of the directive, they're "protected undertakings."

Translated: if you're a smaller supplier, your large customers can still ask you for carbon and sustainability data — but they can't demand a full CSRD-grade inventory. The request is capped at a defined, proportionate set of information.

That's a meaningful shift, and it changes the right response from "brace for anything" to "prepare a proportionate answer."

So what should a finance director actually do now?

If you're in scope (over 1,000 employees and over €450m turnover): treat 2026 as a capacity-building year — a lightweight double-materiality assessment and a data inventory to find what you can already evidence and where the gaps are — ahead of mandatory reporting on FY2027 in 2028. Don't over-build against the old, longer ESRS disclosure lists; they're being simplified.

If you're now out of scope: don't declare the topic closed. The pressure hasn't disappeared, it's just changed shape. Your large customers, your lenders, and your investors still need sustainability data for their own reporting and risk processes, and they will ask for it — now within the capped, voluntary boundary. The businesses that keep a credible, current carbon number look far more prepared than those scrambling when a request lands.

Either way, the smart posture is the same: know your numbers, keep them defensible, and don't gold-plate. The whole direction of Omnibus is proportionality. Matching your reporting effort to what's actually required — rather than what you feared might be required — is now the explicit intent of the law.

Where the UK sits

If your interest is UK rather than EU obligations, CSRD may be a value-chain question for you rather than a direct one — it bites when you supply an in-scope EU company. The UK's own equivalent regime is developing separately; we cover it in what UK SRS and SECR mean for small suppliers.

The pragmatic way to be ready

Whether you're in scope, capped as a protected supplier, or simply fielding customer requests, what you need is a credible carbon footprint you can produce and refresh without a project team. The voluntary standard at the centre of the value-chain cap is built around exactly the kind of proportionate, emissions-focused data that a spend-based approach produces well.

That's the gap SpendToScope fills: it builds a Scope 1, 2 and 3 footprint straight from your accounting data (Xero, Sage, Microsoft Business Central), so you can answer a customer, a lender or a proportionate CSRD value-chain request in minutes — and keep it current as the requests keep coming. If you want the method behind that, see how to calculate Scope 3 from spend data.

The bottom line

• Omnibus is law. CSRD scope fell from ~50,000 to ~5,000 companies, in force since March 2026.
• In scope now: mainly EU companies over 1,000 employees and over €450m turnover. Listed SMEs are exempt.
• First mandatory reports for newly-in-scope large companies: 2028 (FY2027), against simplified standards.
• The value-chain cap protects sub-1,000-employee suppliers from open-ended data demands — requests are limited to a voluntary standard.
• The task for most businesses is no longer full CSRD compliance. It's a proportionate, defensible carbon number, ready before a customer, bank or in-scope partner asks for it.