Omnibus Scope and the Value Chain Cap: Who Can Ask You for What?

Two separate tests decide how far CSRD data requests can reach you. The first is whether your customer is a company that has to report. The second is whether you are protected by the value chain cap, which limits what a reporting company may require from smaller partners. Mixing them up produces wrong answers in both directions. This article keeps them apart. It replaces an earlier version that used the wrong scope figures and described a tiered Annex II list that I could not confirm.

Test 1: Is Your Customer in Scope?

Under Omnibus I (Directive (EU) 2026/470, in force since 18 March 2026), EU companies must report under the CSRD if they have more than 1,000 employees and more than €450 million net turnover. Non-EU groups need more than €450 million EU turnover and an EU subsidiary or branch with more than €200 million turnover. The earlier version of this article described the in-scope criteria as 250 employees, €50 million turnover and €25 million balance sheet, which is the old test and no longer applies, and it said the number of companies fell from about 50,000 to about 19,000. I could not confirm those counts.

This test says whether a company produces its own CSRD report. It says nothing about whether you must. Almost all suppliers are not in scope themselves. A supplier outside the EU is not in scope unless it is part of a large group that meets the non-EU test.

Test 2: Are You Protected by the Cap?

The voluntary sustainability reporting standard was adopted as Commission Delegated Regulation (EU) 2026/1560, published in the Official Journal on 21 September 2026 and in force from 24 September 2026. It is for undertakings that are not subject to mandatory CSRD reporting, up to 1,000 employees on average. It builds on the earlier VSME standard from EFRAG. Its value chain cap, in Article 3, says that a company reporting under the CSRD may not require value chain companies with an average of 1,000 employees or fewer to provide information beyond the essential datapoints listed in Annex II. The cap applies to financial years starting on or after 1 January 2027.

Sources I read say that a protected company may decline anything above Annex II and that the requesting company must tell it which extra information it is asking for. I read this in law-firm and adviser summaries and not in Article 3 itself, so check the exact wording on EUR-Lex.

Two limits matter. First, the cap protects companies with 1,000 or fewer employees. If you have more than 1,000, it does not protect you, whatever your turnover. Second, it covers information gathered for the requester's own sustainability reporting under the CSRD. It does not restrict requests needed to meet other EU or national laws, and it does not stop bank questionnaires, tender criteria or contract terms.

What Is in Annex II

I did not find a published list of the Annex II datapoints in the sources I could open, so I cannot tell you exactly which items are inside the cap. The voluntary standard has a Basic Module (B1–B11), which covers areas such as energy and emissions, water, waste, workforce, health and safety and corruption, and a Comprehensive Module (C1–C9), which adds items such as Scope 3 emissions, climate targets and risks, human rights and governance gender diversity. For companies with 10 or fewer employees, some items in both modules are voluntary. The earlier version said Annex II has two tiers, up to 10 employees and 11 to 1,000, and I could not confirm that structure. Read Annex II directly to see which of a customer's questions fall inside it.

How the Two Tests Combine

The Revised ESRS

The Commission also adopted the revised ESRS as Delegated Regulation (EU) 2026/1563, published on the same day. According to a law-firm summary it enters into force on 10 November 2026 and applies to financial years beginning on or after 1 January 2027, with first reports in 2028. For financial year 2026, companies in scope can choose the existing ESRS, the existing ESRS with some reliefs, or the revised ESRS in full. This means that the draft revision I described in other articles has now been adopted.

What a supplier can do

• Count your average employees. At 1,000 or fewer you are a protected company.
• List which of your customers are in CSRD scope, by asking them.
• Read Annex II and mark which items in each questionnaire fall inside it.
• Answer the items inside Annex II, using your standard dataset.
• For items beyond it, you may decline from financial years starting on or after 1 January 2027, but weigh the commercial cost of refusing.
• Keep in mind that requests under other laws, bank forms and tenders are outside the cap.

Frequently Asked Questions

References

Garrigues, EU publishes voluntary sustainability standard for companies with up to 1,000 employees and caps the value chain (September 2026). Linklaters, EU CSRD revised ESRS and voluntary reporting standard are published in the Official Journal. XBRL International, Voluntary sustainability standard and value chain cap enter EU law (27 September 2026). Directive (EU) 2026/470 and Arthur Cox's Omnibus I summary for the scope. The cap and Annex II details come from summaries, not the regulation; read Delegated Regulation (EU) 2026/1560 on EUR-Lex.