CSRD is not the directive you read about two years ago.

On February 26, 2026, the EU published the Omnibus Directive in the Official Journal. The rules have changed — significantly — and if your team is still working from pre-2025 guidance, you’re operating on a map that no longer matches the terrain.

This post covers exactly what changed, who is still in scope, what the new thresholds mean, and what you should actually be doing right now.

What Is the CSRD, and Why Does 2026 Matter?

The Corporate Sustainability Reporting Directive (CSRD) is the EU’s framework requiring large companies to disclose how their business affects — and is affected by — social and environmental issues. Introduced in 2022, it replaced the older Non-Financial Reporting Directive (NFRD) and dramatically expanded the reporting scope.

For several years, CSRD was on track to cover roughly 50,000 companies across the EU. Wave 1, Wave 2, Wave 3 — a phased rollout by company size, listing status, and geography.

Then 2025 happened. The EU Commission launched the Omnibus simplification package on February 26, 2025, and the regulatory picture shifted fast. By December 2025, the European Parliament and Council reached agreement. By February 2026, the final directive was published. CSRD 2026 now looks fundamentally different from what was originally designed.

The Omnibus Directive: What Actually Changed

The Omnibus I legislative package — formally Directive 2026/470 — is the most sweeping revision to CSRD since the directive was adopted. It rewrites the scope, adjusts reporting standards, caps trickle-down obligations, and restructures the wave timeline.

Here is what changed.

1. New CSRD 2026 Scope Thresholds: The 1,000-Employee Rule

The most consequential change in CSRD 2026 is the new scope definition.

Under the original CSRD, a company was in scope if it met two out of three criteria:

• More than 250 employees
• Net turnover above €50 million
• Balance sheet total above €25 million

That test is gone.

Under CSRD 2026, a company must meet both of these criteria to be subject to mandatory reporting:

• More than 1,000 employees
• Net annual turnover above €450 million

This is not a minor adjustment. According to analysis from ERM, this single change reduces the number of in-scope companies by approximately 85 percent. The EU went from targeting ~50,000 companies to a far smaller group of large enterprises where sustainability impacts are most material and most visible to markets.

Listed SMEs are fully exempt. They will not be required to report under CSRD at all — a complete departure from the original framework, which included a Wave 3 for listed small and medium-sized enterprises.

Financial holding companies are also exempt, provided they are not involved in managing their subsidiary companies.

2. The Wave Structure: Redesigned

The original CSRD rolled out in three waves. CSRD 2026 has restructured this substantially.

Wave 1 — Large public interest entities with more than 500 employees — began reporting in 2025 for the 2024 financial year. They are still required to report. The EU adopted a “quick-fix” delegated act in July 2025 to give Wave 1 companies additional flexibility for 2025 and 2026 reporting, ensuring they do not face additional disclosure burden compared to what they disclosed for FY2024.

Wave 2 — Large non-listed companies that would have started reporting for FY2025 — has been postponed by two years under the Stop-the-Clock Directive (adopted April 14, 2025). Wave 2 entities now face reporting requirements for FY2027, published in 2028.

Wave 3 — Listed SMEs — no longer exists in its original form. With listed SMEs fully removed from CSRD scope under the Omnibus, the Wave 3 category is effectively eliminated.

New application date: The revised scope thresholds officially apply to financial years beginning on or after January 1, 2027.

Member States may also grant a transition exemption for Wave 1 companies that fall outside the new thresholds — meaning companies that started reporting for FY2024 but no longer qualify under the 1,000-employee test can potentially be exempt from reporting for 2025 and 2026.

3. ESRS: Simplified, Not Scrapped

European Sustainability Reporting Standards (ESRS) are the detailed reporting standards that CSRD-in-scope companies must follow. The Omnibus package revised these, too.

On July 11, 2025, the Commission adopted a “quick-fix” delegated act to give Wave 1 companies reporting flexibility for FY2025 and FY2026. On July 31, 2025, EFRAG published revised ESRS exposure drafts and launched a 60-day public consultation. EFRAG has since submitted final technical advice to the European Commission on simplified standards.

The revised ESRS will be formally adopted by the European Commission — expected in mid-2026. The European Parliament and Council then have a brief window to object, after which the standards automatically become law.

Key changes in the revised ESRS include:

• Extended transitional provisions for first and second-year reporters
• Greater use of indirect data sources — sector averages, spend-based proxies, peer benchmarks — reducing the burden of primary data collection
• Simplified disclosures for certain environmental and social topics
• Sector-specific standards guidance to follow

One important point: limited assurance on CSRD reports remains mandatory. The standard for this assurance is to be adopted no later than July 1, 2027. Penalties for non-compliance are subject to a cap of 3% of net worldwide turnover.

If you want to understand how ESRS intersects with your supply chain disclosure obligations, Sprih’s guide on CSRD Supply Chain Disclosures covers the practical implications in detail.

4. Value Chain Cap: Smaller Suppliers Are Protected

One of the most significant — and underreported — provisions in CSRD 2026 is the value chain cap.

Under the original CSRD, large companies had broad latitude to request sustainability data from smaller suppliers in their value chain. This created a trickle-down burden: suppliers not formally in scope were still being asked to gather and report data as a condition of staying on large enterprise vendor lists.

The Omnibus Directive addresses this directly. Companies that fall below the 1,000-employee threshold can now refuse information requests that go beyond what is required under the Voluntary SME Standard (VSME) — a standard developed by EFRAG and formally recommended by the European Commission in July 2025.

What this means in practice:

• Large CSRD-reporting companies must limit what they ask from small suppliers
• Requests must stay within the scope of the VSME standard
• Suppliers with fewer than 1,000 employees have legal standing to decline excessive data asks

This is a meaningful protection for mid-sized and smaller companies in complex global supply chains. But it also puts pressure on large enterprises to be more strategic about how they collect supplier data — and which suppliers they prioritize for sustainability assessments.

For a deeper look at how supplier data collection works within CSRD-aligned reporting, read Sprih’s breakdown on Scope 3 supply chain emissions disclosures.

5. CSDDD: The Parallel Shift

CSRD 2026 does not exist in isolation. The Corporate Sustainability Due Diligence Directive (CSDDD) underwent parallel changes under the same Omnibus package.

The new CSDDD thresholds are significantly higher:

• More than 5,000 employees
• Net annual turnover above €1.5 billion

This reduces CSDDD scope by approximately 70 percent. The directive’s application date has been pushed to July 26, 2029. Member States must transpose it by July 26, 2028.

Notably, the requirement to adopt and implement a climate transition plan has been removed from CSDDD. Obligations to report on climate transition plans under CSRD, however, remain in force.

The EU harmonized civil liability regime has also been removed and replaced with a review clause — meaning liability for sustainability due diligence failures now runs through national legal frameworks, not a single EU-wide standard.

Who Is Still In Scope for CSRD 2026?

Even with the dramatic scope reduction, a significant group of companies must continue reporting.

In scope under CSRD 2026:

• EU companies with more than 1,000 employees AND more than €450 million net turnover
• Wave 1 companies (already reporting) — still required, subject to transition relief options
• Non-EU companies with more than €450 million net turnover in the EU (individually or on a consolidated basis) for two consecutive years, with an EU subsidiary generating more than €200 million in net turnover

Out of scope:

• Companies below the 1,000-employee AND €450 million dual threshold
• Listed SMEs (fully removed)
• Financial holding companies not managing their subsidiaries
• Wave 1 companies falling below the new thresholds (subject to Member State transition exemption)

If your company operates in sectors like pharma, advanced manufacturing, or enterprise software — and you are a supplier to large EU-headquartered groups — your customers are still required to report. That means they will still ask you for sustainability data. Whether those requests are now legally limited to the VSME standard depends on your size and how your customers structure their programs.

Sprih’s Sustainability Compliance Library maps the CSRD, BRSR, CSDDD, CBAM, and related frameworks side by side, so you can quickly assess what applies to your business.

What Has Not Changed

With so much attention on what the Omnibus relaxed, it is worth being direct about what remains.

• Wave 1 reporting obligations are intact. Companies that began reporting for FY2024 must continue reporting.
• Assurance requirements are not gone. Limited assurance on CSRD sustainability reports remains mandatory.
• Transition plan disclosures under CSRD still apply. The removal of transition plan requirements was in CSDDD, not CSRD.
• The review clause matters. Both CSRD and CSDDD include formal review clauses. The EU has not permanently narrowed the scope — it has re-calibrated it, with the explicit possibility of expanding scope again in the future.
• Investor and market pressure continues. The Omnibus changes regulatory floor, not market expectations. Institutional investors, lenders, and ESG-focused customers will continue asking for sustainability data regardless of whether a directive requires it.

5 Actions to Take Right Now

1. Reassess whether you are in scope. The dual threshold (1,000 employees AND €450 million turnover) is new. Run your numbers. If you previously assumed you were in scope under the original two-of-three test, check again.

2. If you are Wave 1, keep reporting — and use the quick-fix relief. The July 2025 ESRS delegated act gives Wave 1 companies real flexibility for FY2025 and FY2026. Use it. Extend transitional provisions where available rather than over-reporting.

3. Review your supplier data strategy. The value chain cap changes what you can ask suppliers — and what suppliers can push back on. Restructure your supplier questionnaires to align with the VSME standard for companies below 1,000 employees.

4. Monitor Member State transposition. The Omnibus Directive must be transposed into national law by Member States within 12 months of its entry into force. Transposition timelines will vary. Some countries may move faster or add stricter national requirements. Watch this space if you operate across multiple EU markets.

5. Do not confuse regulatory relief with strategic retreat. 85% fewer companies are required to report. That does not mean 85% fewer investors, banks, customers, or procurement teams asking about your sustainability performance. Voluntary frameworks — including the VSME standard — are becoming the baseline expectation for companies not formally in scope.

The Bottom Line on CSRD 2026

CSRD 2026 is a structural reset, not a temporary pause. The EU Commission set out to simplify a framework that had become operationally complex for a wide range of companies — and it delivered a significant scope reduction.

But the core logic of the directive has not disappeared. Large enterprises still report. Assurance still applies. Non-EU companies with material EU revenues still have obligations. And the review clause signals that the current thresholds are not permanent.

For companies that remain in scope, the practical work of CSRD compliance — data collection, gap analysis, ESRS alignment, supplier engagement — is the same. The standards are simplified, the timeline has shifted, but the expectation of defensible, auditable sustainability data has not.

If you are navigating CSRD 2026 and need a clear view of where you stand, talk to Sprih. SustainSense, our AI engine, runs across 120,000+ companies and 300,000+ sustainability reports. We help you understand what reporting your business actually requires — and build the data infrastructure to meet it.