Simplification or Deregulation? The EU's Sustainability Omnibus Explained

The first Omnibus package consists of three texts – two draft directives and a draft regulation. The first draft directive proposes to delay the dates by which Member States must apply CSRD and CS3D. The second draft directive, which includes the substantive measures, amends CSRD and CS3D. The third, a draft regulation, proposes to amend the EU's carbon border adjustment mechanism ("CBAM") – that would delay the financial element of CBAM by one year, and change the scope to remove a very significant proportion of formerly covered participants. According to the Commission, 90% of importers would be exempted, but 99% of emissions would still be in scope. The remainder of this briefing will focus on the changes to CSRD and CS3D.

Separately, the Commission has launched a four-week consultation on amendments to the Taxonomy. These include changes to the reporting requirements as well as substantive changes to the Taxonomy technical screening criteria to simplify Do No Significant Harm and minimum safeguard assessments.

The Sustainable Finance Disclosure Regulation (SFDR) does not feature in this package of measures, and is now expected to be subject to its own simplification treatment in Q4 2025. However, the dramatic reduction in scope of CSRD (some 80% of companies are expected to fall out of scope if the proposed thresholds are adopted) could provide some clues as to the likely direction of travel. In particular, it will be interesting to see whether the Commission relieves financial market participants from collecting and reporting the principal adverse impact ("PAI") indicators of their investments, given that PAI data was meant to be provided through CSRD reporting by investee companies.

It is important to note that the texts proposed by the Commission are just that – proposals which will now be scrutinised and debated by the legislative institutions of the European Union. It will be subject to lobbying from industry groups both for and against these dramatic changes, and voting by Member States representing divergent views, although it seems that the Commission has attempted to build consensus for the proposed changes.

One of the key challenges for businesses now will be navigating this limbo period in which they technically remain under a legal obligation which they know will be at least amended and potentially eliminated in the coming months. By separating the delay to reporting from the more substantive changes to CSRD and CS3D, the Commission is no doubt hoping that at least this directive can be agreed quickly to end the uncertainty that has been prevalent for the last few months. 

As mentioned above, the Commission has proposed to "stop the clock" on reporting obligations for any company which has not yet begun sustainability reporting. It will propose that this separate directive go through a fast-track procedure to provide certainty to those currently in scope of CSRD as soon as possible, which should be a common concern regardless of where individual Member States stand on the main Omnibus changes. If enacted, it will make changes independently of any more substantive changes, acknowledging that in some form, and with some delay, CSRD reporting must continue until further notice.

Member States would be required to transpose the amending directive by 31 December 2025, ensuring that any entity currently expecting to publish a sustainability statement in 2026 has clarity over its upcoming obligations. 

The substantive proposal has immediately impactful provisions on scope, assurance and timing. Reporting is addressed in part.

Scope:

-    Contrary to what has been widely trailed in recent days, the scope of CSRD for EU entities will not be completely aligned with that of CS3D. According to the published proposal, entities in scope are those with (i) more than 1,000 employees and (ii) which are also "large" within the existing meaning of the Accounting Directive. In practice, that means that the test will be whether the entity (or group) has (i) 1,000 employees and (ii) either turnover of at least EUR50m or a balance sheet of EUR25m. 

-        Individual entities crossing these thresholds are in scope, as well as parent undertakings of groups which exceed the thresholds "on a consolidated basis" - a phrase which is not further defined. As per CS3D, there is no clarification of whether "on a consolidated basis" should be read as aligning with financial consolidation. A "group" under the Accounting Directive (the text underlying CSRD) simply means a parent and its subsidiaries, with no reference to consolidation. There is no reference to scope being limited to "ultimate" parent companies; conceivably, a "midco" company which is both a parent and a subsidiary may be caught by the reporting obligations.  . 

-    Listed entities reporting under the Transparency Directive are subject to the same thresholds as non-listed companies – there will no longer be provision for reporting by listed SMEs.

-    Credit institutions and insurance undertakings are also subject to the above thresholds.

-    The tests are also amended for non-EU undertakings. At present, the two-limb test requires an ultimate third-country parent undertaking to (1) have an in-scope subsidiary, or a branch with over EUR40m net turnover, and (2) have generated a net turnover at group level in the EU of more than EUR150m. In the proposed text, the first limb requires that the non-EU entity has a "large subsidiary" (note, not necessarily one that has over 1,000 employees and therefore itself has to report), or a branch which exceeds the turnover threshold of EUR50m (a minor update reflecting the higher thresholds for "large" undertakings as per a previous amendment to the Accounting Directive). The second limb requires that the non-EU entity (or group) generates EUR450m of EU turnover, increased from EUR150m and now in alignment with CS3D. Not for the first time, this revised scoping may leave non-EU companies with high revenues but a small workforce wondering why they should have to comply when a similarly sized EU company would not have to.

Reporting:

-        Value chain information requests are limited to the level of information set out in the voluntary SME standards ("VSME"). As a result, the VSME will be adopted by the Commission via delegated regulation. The VSME were published by EFRAG earlier this year, but these may obviously be further revised by the Commission prior to adoption. 

-    The LSME standards will cease to exist, given that listed SMEs will no longer be required to report. 

-     There will be no sector specific standards, which had previously been foreseen and would have added additional reporting requirements.

-    Though no proposal is included in the Omnibus package, the Commission intends to amend the European Sustainability Reporting Standards (ESRS), including by removing the "least important" data points, and prioritising quantitative data points rather than narrative reporting. It hopes to do this within the first six months after CSRD 2.0 is finalised.

Assurance:

-     The Commission no longer commits to adopting a limited assurance standard by 1 October 2026, but it will adopt guidelines for limited assurance providers. It is not clear whether the use of guidelines will provide much relief compared with the certainty of an adopted standard, though the Commission suggests that this provision will allow it more agility and flexibility to address emerging issues.

-    The option for the Commission to adopt a reasonable assurance standard, which could have led to significantly higher audit requirements and costs, is deleted. 

Timetable:

-    Following the simplification of the scope thresholds, the phased introduction of reporting obligations is no longer needed. There is a single relevant date for EU companies and all listed companies, namely financial years beginning on or after 1 January 2025. 

-    However, the Omnibus directive provides for a 12-month period after the directive's entry into force during which Member States must enact the provisions into their national laws and bring those national laws into force. This must be read in conjunction with the Stop-the-Clock proposal which amends the reporting timetable, from 1 January 2025 with reporting in 2026 to 1 January 2027 with reporting in 2028. Whether agreement can be reached in time to maintain these deadlines remains to be seen. 

-    The single reporting deadline means that all those companies in the first reporting wave that are in the midst of final preparations for publication would, if the proposal was immediately enacted, have a further year to prepare their reports, or potentially be exempt from scope if they did not meet the financial and employee threshold. Realistically, there is no prospect of this happening. The Stop-the-Clock proposal similarly makes no changes to the first wave (large public interest entities) reporting deadlines, given how imminent they are.

-     There is apparently no change to the reporting timetable for non-EU companies. They must still report for financial years beginning on or after 1 January 2028, in 2029. 

Whereas the proposed changes to CSRD significantly reduce the scope, the proposals on CS3D seek to reduce the extent of the active obligations that large companies are under. 

Scope:

-        There are no proposed changes to the core scope of CS3D. 

-    The provision requiring the Commission to review the inclusion of downstream activities of financial services businesses is deleted. This may mean that the Commission has no plans to extend the Directive to such relationships, or it could simply be a matter of timing.  The Commission was to deliver a report to the European Parliament and the Council by 26 July 2026, which, the Commission states, is insufficient time to assess the operation of the revised Directive. Clearly it would have been inconsistent with the simplification agenda for the Commission to propose extension of scope in this Omnibus proposal. 

Due diligence obligations:

-        The definition of "stakeholder" is changed to exclude national human rights and environmental institutions and civil society groups. This means that NGOs will no longer be amongst those entitled to "meaningful engagement" in line with the requirement of Article 13.

-        Full due diligence obligations should generally be limited to an entity's own operations, those of its subsidiaries and "tier 1" business partners. (It is unfortunate that the Commission did not take the opportunity to clarify the unclear definition of subsidiary, which may be impactful for GPs of majority owned portfolio companies.) However, where the entity has plausible information about adverse impacts relating to indirect business partners, it should carry out the kind of in-depth assessment that will be needed for its Tier 1 business partners. This means that operations in high-risk areas will still need more careful consideration, and the company will have to take seriously any complaints it receives. It also means a tricky balancing act for a company seeking to better understand the full breadth of its supply chain for other reasons, which may put it on notice of potential adverse impacts and therefore subject to additional diligence obligations under CS3D. The Commission has also included anti-circumvention measures to prevent artificial arrangements being put in place.

-        It is further clarified that termination of relationships in connection with which an impact has arisen should only occur as a last resort, and management of such relationships can satisfy the requirements of the Directive. This is an important point unrelated to simplification, around the unintended consequences of CS3D on regions which do pose higher risks, and therefore were facing dramatic reductions in trade with large EU entities who might be inclined to take the easier option of withdrawing from the area rather than remedying impacts.

-        Information requests from business partners which are SMEs and the new size category of small mid-cap companies ("SMC") must generally be limited in line with the VSME standard. The proposed text inadvertently confirms that a SMC will be a company with fewer than 500 employees; a further proposal on SMCs with more details is expected in Q2.

Climate transition plan:

-    Contrary to some demands, transition planning persists for both EU and non-EU companies in scope of CS3D. However, the key obligation is reduced – entities must adopt a plan containing implementing actions, rather than the previous two-part obligation to adopt and then implement the plan.

-    In all other respects, the obligations on transition planning remain the same. 

Timing:

-    The first compliance deadline for the very largest companies under CS3D is currently 26 July 2027. The proposed text delays this by one year. The Commission will bring forward its guidelines on due diligence, from 26 January 2027 to 26 July 2026, so that covered entities have two years to digest and prepare, rather than six months. Other guidelines will also be expedited.

Harmonisation:

-    The Commission proposes to amend the provisions on national harmonisation (which were unclear in the final text), to make it clearer that Member States should not be gold-plating supply chain diligence requirements in their national laws. The list of provisions that must be harmonised is increased to cover all core active obligations. Member States would still be permitted to adopt further measures to address more specific risks, for example in respect of a specific products, services or situations. Therefore, despite the elimination of the financial services review clause mentioned above, it seems to be possible for Member States to extend the due diligence obligations to downstream relationships of financial services businesses, if they strongly disagree with the Commission's approach. The Commission has separately made clear (independently of this proposal) that it will clamp down on gold-plating by Member States, which it now characterises as an "interference with the expected policy goals" of EU measures, leading to fragmentation of the single market. 

Penalties:

-    The civil liability provisions are deleted. Entities which are successfully prosecuted by Member States may be ordered to compensate persons affected by their failure to comply, but regulatory action will be a necessary precursor to follow-on liability for affected legal or natural persons, rather than being an independent route of redress as per the existing text.

-    NGOs will no longer be able to bring representative actions.

-    The requirement for Member States to set maximum fines of at least 5% of group worldwide turnover is eliminated. The Commission will issue guidance for supervisory authorities to assist them in determining the appropriate level of penalties, which must nevertheless be effective, proportionate and dissuasive. 

The CSRD 2.0 proposal includes a lighter Taxonomy reporting burden for certain entities within the scope of CSRD, though it does not alleviate the reporting burden entirely.

"Large" undertakings with more than 1,000 employees but fewer than EUR450m of turnover are subject to lighter Taxonomy reporting requirements – if they claim any Taxonomy aligned activities, they must summarise the nature and extent of those activities, and non-financial undertakings must disclose turnover and capex associated with Taxonomy aligned activities (but opex disclosures become optional). However, companies may avoid Taxonomy reporting entirely by not claiming any Taxonomy-aligned activities, effectively creating an opt-in system.

Reporting entities will be allowed to exclude non-material activities, i.e., those representing less than 10% of revenue, capex or opex.

The Commission will adopt a revised delegated act including new (somewhat simplified) templates, which it has also today published for a four-week consultation.

The Commission's proposals will now be discussed and debated by the co-legislators and further changes are therefore possible – in fact, likely.  The Commission hopes to fast track the process but there is no doubt that, even if the Commission has already received informal assurances of support from some large Member States and Members of the European Parliament, they will face significant opposition from a number of quarters. The negotiations around CS3D less than one year ago demonstrated the power of dissenting voices from across the EU, and the last few weeks have demonstrated that such dissent is likely to be a feature of these negotiations too.

In the meantime, it will be interesting to see how Member States respond.  A number had not yet completed the transposition of the CSRD – including, notably, Luxembourg and Germany. The Stop-the-Clock proposal might result in a quick agreement to delay CSRD's application, but it does not change the fact that Member States should by now have CSRD written into their national law, so theoretically those reticent Member States should proceed with their national processes. On the other hand, it is difficult to see what motivation the European Commission will have to pursue any infringement action against them if they elect to pause their process pending the outcome of the CSRD 2.0 discussions.