EU Omnibus: Update to CSRD and CSDDD. What large companies need to do and by when.

At the end of 2025, the European Parliament approved the final Omnibus agreement, confirming major rollbacks to core EU sustainability legislation: the Corporate Sustainability Due Diligence Directive (CSDDD) and the Corporate Sustainability Reporting Directive (CSRD).

Overview of the EU Omnibus Package:

The European Commission introduced the EU Omnibus I Package on 26 February 2025. Its purpose is to lessen the regulatory burden on companies by revising or scaling back several corporate sustainability requirements across the EU.

Next steps in the legislative process:

Now that trilogue negotiations have concluded and Parliament has endorsed the final text, the Directive must receive formal approval from the Council. It will become effective 20 days after publication in the Official Journal of the European Union. Member States must incorporate the Directive into national law by 26 July 2028.

What’s staying the same?

Risk-based due diligence
The risk-based approach has been kept, allowing companies to concentrate on the most severe and most likely risks throughout their chains of activities. This replaces the earlier proposal from the European Commission that would have limited due diligence to tier-1 suppliers.
Double materiality
Companies that continue to fall within the CSRD scope must still report using the double materiality principle. This requires disclosure of both how sustainability issues affect business performance and how business activities impact society and the environment.

What’s changing?

Updates to the Corporate Sustainability Due Diligence Directive (CSDDD):

Scope significantly reduced
The CSDDD will now apply only to the largest companies, reducing overall coverage by around 70%. Companies with both:
→ at least 5,000 employees
→ net turnover of €1.5 billion
Implementation delayed
The first phase of due diligence obligations for large companies is postponed until 26 July 2029. Guidance to support preparation will be issued by July 2027.
Risk-based approach replaces tier-based model
The final text aligns more closely with soft law frameworks such as the UN Guiding Principles on Business and Human Rights. Companies are allowed to prioritise areas of their chains of activities where adverse impacts are most severe and most likely, using reasonably available information.
Limits on supplier information requests
Requests for information from suppliers with fewer than 5,000 employees must be a last resort and only when the information cannot be obtained from alternative sources such as third-party datasets or research.
Less frequent due diligence assessments
Assessments will only be every five years rather than annually.
Reduced stakeholder engagement obligations
Stakeholder engagement requirements are streamlined, and the obligation to terminate business relationships as a last resort has been scrapped.
Removal of climate transition plan requirement
The obligation to produce a climate transition plan has been removed from the CSDDD.
Civil liability handled at national level
EU-level civil liability provisions are removed, leaving national laws to determine liability.
Financial services excluded
The review clause on including financial services in due diligence requirements has been deleted.
Greater EU-wide harmonisation
More provisions are standardised to ensure consistency across Member States, including a cap on penalties of 3% of global turnover.

Updates to the Corporate Sustainability Reporting Directive (CSRD):

Substantially narrower scope
The CSRD will apply only to larger companies, reducing coverage by around 85%. Companies with both:
→ 1,000 employees and
→ turnover above €450 million
Reduced reporting pressure on suppliers
New protections for businesses with fewer than 1,000 employees (protected undertakings) allow them to refuse requests for information beyond what’s required under the voluntary reporting standards (VSME). This is a much slimmed-down version of CSRD.
Two-year delay for new reporters
Reporting deadlines are postponed by two years for large companies that have not yet begun reporting.
Optional exemption for ‘wave 1’ companies
Member States may choose to exempt ‘wave 1’ companies from reporting obligations for 2025 and 2026.
Limited assurance only
Only limited assurance will be required, with no progression to reasonable assurance.
Simplification of ESRS requirements
Mandatory data points are reduced from 1,073 to 320 – a 70% reduction. Guidance on double materiality is clarified, and flexibility is introduced where data collection would involve undue cost or effort.
Removal of sector-specific standards
Sector-specific ESRS standards are removed, although guidance may be introduced later.
Introduction of voluntary reporting standards
For companies no longer within CSRD scope, the European Commission will adopt a delegated act creating a voluntary reporting standard based on the VSME developed by EFRAG. These standards will be reviewed every four years.

Planned future reassessments

Certain elements of the legislation will be reviewed in the coming years to ensure continued relevance:

Scope: Possible future expansion of both CSRD and CSDDD.
Civil liability: A review of civil liability under the CSDDD is scheduled for 2031.

Key benefits and implications

After a year of uncertainty, businesses now have clarity regarding scope and expectations, enabling them to prepare for compliance.

Key advantages include:

Extended implementation timelines that allow companies to prepare thoroughly and move beyond a purely tick-box approach.
Reduced regulatory spillover for SME suppliers.
Simplified ESRS requirements, significantly reducing mandatory disclosures and improving usability.

Despite these changes, the CSRD and CSDDD remain landmark regulations with substantial obligations for large companies, and other jurisdictions continue to follow the EU’s approach to mandatory due diligence.