CSRD After Omnibus I: Who Is Still in Scope

A figure that circulates about this reform says the CSRD shrank by 61%. That number does not describe company scope. It comes from EFRAG's proposal to cut the mandatory datapoints in the reporting standards. The change to scope is much larger: commentators put the reduction at around 90% of the companies originally expected to report. For a supplier, the more important point is that fewer companies being legally required to report does not mean fewer data requests. This guide sets out who is still in scope, what the value chain cap does and does not protect, and what to prepare.

What Omnibus I Changed

The Omnibus I Directive, Directive (EU) 2026/470, was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026. Member States must transpose the CSRD changes by 19 March 2027. It followed the stop-the-clock directive of April 2025, which had already delayed the second wave of reporting. Omnibus I raised the scope thresholds sharply, kept limited assurance and dropped the move to reasonable assurance, and introduced a cap on what reporting companies can ask of smaller business partners.

I could not find an official final count of companies in scope. Estimates differ by source and some are not attributed, so treat any single number with caution. The thresholds themselves are what matter for you: if your customer does not have more than 1,000 employees and more than €450 million of net turnover, it is not directly required to publish a CSRD report.

Where the 61% Figure Comes From

EFRAG proposed simplified ESRS that cut mandatory datapoints by 61%, and by more than 70% when voluntary disclosures are removed as well. The Commission published the revised ESRS in September 2026. They enter into force on 10 November 2026 and apply to financial years starting on or after 1 January 2027. So the 61% is about how much a reporting company has to disclose, not how many companies have to report.

Who Is Still in Scope

Companies already reporting

Large public-interest entities that were already under the earlier reporting rules began CSRD reporting for FY2024. Those that are below the new thresholds, for example with 500 to 1,000 employees, are no longer required to continue from FY2027. Member States may also exempt such companies for FY2025 and FY2026, so the position depends on the country.

Companies that have not yet reported

Companies that meet the new thresholds and have not reported before start with financial years beginning on or after 1 January 2027, with reports in 2028. The earlier distinction between second-wave and third-wave companies has been removed.

Listed SMEs

Listed SMEs are fully out of scope. They were previously due to report in the third wave.

Non-EU parent companies

A non-EU parent is in scope if it has more than €450 million of EU net turnover in each of the last two years and an EU subsidiary or branch with more than €200 million of net turnover. Reporting starts with FY2028, with first reports in 2029, and needs limited assurance. They will use a separate standard for non-EU companies, which is still in draft, with a consultation open until 31 October 2026.

What Out of Scope Means for a Supplier

If your customers are among the companies still reporting, they need information from their supply chain, and the revised ESRS still ask in-scope companies about their value chain, with fewer mandatory datapoints and subject to materiality. Even customers that no longer report may keep asking, for example because of their own targets, lenders, retail customers or due diligence obligations.

The value chain cap limits what in-scope companies can ask. Companies with 1,000 or fewer employees on average are protected undertakings. A CSRD reporting company cannot require them to provide information beyond the Voluntary Standard, which is based on EFRAG's VSME, and protected companies may decline requests that go beyond it. They can rely on self-declarations, and contract terms that go against the cap are not binding. The delegated regulation setting out the standard, Commission Delegated Regulation (EU) 2026/1560, was published in the Official Journal and entered into force on 24 September 2026.

The cap has limits. It applies to requests made for CSRD reporting purposes, and it does not cover other commercial information exchanges. A buyer can still ask for data in a supplier code, a purchase contract or a customer questionnaire for its own reasons, and you will need to decide commercially how to respond.

CSDDD: A Separate Law With Its Own Thresholds

The Corporate Sustainability Due Diligence Directive (Directive (EU) 2024/1760) was also amended. It now applies to EU companies with more than 5,000 employees and more than €1.5 billion of net worldwide turnover, and to non-EU companies with more than €1.5 billion of turnover generated in the EU. Member States must transpose it by 26 July 2028, and companies must comply from 26 July 2029. The mandatory EU-wide civil liability regime and the duty to adopt and put into effect a climate transition plan were removed, and the maximum penalty is capped at 3% of net worldwide turnover. Companies may request information from partners with fewer than 5,000 employees only when they cannot reasonably get it by other means. Check the national law in the countries where your customers are based.

What to Watch Next

Three things matter for a supplier. First, the final standard for non-EU companies, since some of your customers' parents may fall under it. Second, how buyers update their supplier questionnaires to reflect the cap, which has not happened uniformly. Third, the Commission's review of the scope, due by 30 April 2029, which could change thresholds again.

What a supplier should do now

• Check your average headcount. If it is 1,000 or fewer, you are a protected undertaking under the value chain cap.
• Ask your main EU customers whether they are still in scope, and under which standard and year they will report.
• Prepare a basic data set based on the Voluntary Standard. If it keeps the EFRAG VSME structure, the Basic Module has 11 disclosures, B1 to B11, so check the final text. Include energy, greenhouse gas emissions, water, waste, workforce and health and safety data from your existing records.
• If a questionnaire asks for more than the Voluntary Standard and the request is for CSRD purposes, raise it with the buyer's sustainability team before declining. Many questionnaires were written before the cap.
• If you have more than 1,000 employees, the cap does not protect you. Prepare for requests aligned with the revised ESRS, including Scope 1 and 2 and, where relevant, Scope 3.
• Record the emission factor source and year with every figure. A grid factor changes every year, so using an old factor in a new submission changes your Scope 2 result.

Frequently Asked Questions

References

Directive (EU) 2026/470 (Omnibus I), Official Journal, 26 February 2026. Covington, EU CSDDD/CSRD Omnibus published in the Official Journal (February 2026). Linklaters, EU CSRD after the Omnibus. Accountancy Europe, Omnibus explained: CSRD factsheet (January 2026). XBRL International, Voluntary sustainability standard and value chain cap enter EU law (September 2026). ESG Today, EU publishes final revised ESRS (22 September 2026). Dcycle, CSRD Omnibus I approved. I used law-firm and industry summaries, not the full legal texts, so confirm the details in the Official Journal and in your customers' national laws.