The EU Omnibus I — But Where Has It Stopped?

Background

In 2025, the European Commission proposed a package of 10 “omnibus” initiatives aimed at reducing recurrent administrative burdens across EU legislation. Collectively, these proposals are expected to deliver administrative cost savings of approximately €11.9 billion per year.

On 26 February 2025, the Commission adopted the first omnibus package, focusing on sustainability-related legislation (Omnibus I). The package revises the Corporate Sustainability Reporting Directive (CSRD) and the Corporate Sustainability Due Diligence Directive (CSDDD) with a view to simplifying requirements relating to sustainability reporting, due diligence obligations and the EU taxonomy framework. The Commission estimates that these revisions will generate approximately €4.5 billion in administrative cost savings.

Directive (EU) 2025/794 was published in the Official Journal of the European Union on 16 April 2025, entered into force on 17 April 2025, and must be transposed by Member States by 31 December 2025. The Directive postpones:

• by two years, the application of CSRD requirements for large undertakings that have not yet started reporting, as well as for listed SMEs; and
• by one year, both the transposition deadline and the first phase of application of the CSDDD, covering the largest companies.

On 16 December 2025, the European Parliament approved a provisional agreement reached between MEPs and EU governments on the revised sustainability reporting and due diligence framework. The text is currently awaiting the Council of the European Union’s first-reading position which is expected in early 2026. The revised text will enter into force 20 days after it is published in the Official Journal of the EU.

CSRD – Corporate Sustainability Reporting Directive

Scope - The CSRD will now apply to:

• EU undertakings with at least 1,000 employees on average during the financial year and net revenue of €450 million or more with effect from the year beginning 1 January 2027, with the first report due in 2028.
• Non-EU parent undertakings if their net revenue in the EU is €450 million or more for the previous two consecutive financial years and they have an EU subsidiary or branch with net revenue of €200 million or more on their balance sheet dates in the preceding financial year with effect from the year beginning 1 January 2028, with the first report due in 2029.

For the first reporting year, EU undertakings will need to assess net revenue and average employee numbers for 2026, and non-EU parent undertakings with a subsidiary or branch in the EU will need to assess net revenue of the parent for 2026 and 2027 and of the subsidiary or branch for 2027. Going forward, this assessment will need to be undertaken each year to determine whether a business is in scope.

These changes take an estimated 80% of companies out of scope compared to the original scope of the CSRD although not all companies originally in scope of CSRD benefitted from the Stop the Clock Directive adopted in April 2025. Wave 2 and 3 companies had reporting requirements delayed by two years while wave 1 companies were required to report in respect of the year beginning 1 January 2024 with first reports due in 2025. These were companies which were:

1. issuers (wheresoever incorporated) of securities admitted to trading on an EU-regulated market; and
2. EU-incorporated businesses which (i) had securities admitted to trading on an EU market, (ii) were insurance companies or (iii) were banks, which in each case were large undertakings[1] and had at least 500 employees on average during the financial year, or were parent undertakings of a large group[2] exceeding on its balance sheet date on a consolidated basis 500 employees during the financial year.

Many of these will now fall out of CSRD’s reduced scope. Member States are able to exempt such undertakings from the reporting obligations between 1 January 2025 until 1 January 2027 and therefore wave 1 companies will need to check whether they remain caught in the relevant Member States.

Omnibus I has also introduced exemptions:

• Financial holding undertakings where the main objective is to hold companies and manage such without being involved in the day-to-day operations and each of the companies is separate and not interdependent, e.g., in the case of private equity.
• Undertakings with securities listed on an EEA exchange if they are included in the disclosure report of their parent undertaking.

Value chain cap - There is now protection for smaller companies in the value chain of undertakings required to report under the European Sustainability Reporting Standards (ESRS) so that where they have fewer than 1,000 employees, these companies are considered protected and may decline to provide information requested for reporting. Furthermore, such protected undertakings must be advised by the reporting undertaking of whether the information requested exceeds the limit and of their right to refuse to provide information exceeding the limit.

ESRS - The Omnibus Directive requires the Commission to adopt a delegated act within six months of the Omnibus Directive to revise the ESRS to:

• remove data points considered less important;
• to prioritise quantitative data points over qualitative;
• distinguish between mandatory and voluntary data points;
• provide clarity on the materiality principle to mitigate unnecessary reporting; and
• improve consistency with other EU regulation.

Following a public consultation process, including the experience of wave 1 companies, EFRAG has published and delivered a simplified ESRS to the EU Commission cutting mandatory datapoints by more than half. The simplified text can be found here: Draft Simplified ESRS | EFRAG.

Transitional support to gathering information and other reliefs - During the first three years of reporting, reporting undertakings may use estimates if they cannot obtain all information from their value chain. The three-year transitional period begins when an undertaking becomes required to report.

Acquisitions and disposals - Also, entities acquired during a financial year do not need to be included in consolidated reporting until the subsequent financial year. Equally, undertakings that have exited a reporting undertaking’s group during a financial year may be excluded from consolidated reporting.

Greater protections in respect of commercial sensitivity - Reporting undertakings may also withhold information from reporting where the information is potentially prejudicial to their commercial position, relates to intellectual property, or is protected due to confidentiality or applicable EU or national privacy laws.

Review mechanism - The Commission has provided for a review of the scope of CSRD by 26 July 2031 involving an analysis of the need for sustainability data balanced between mobilising private investment into the EU Green Deal objectives and the impact of sustainability reporting on the competitiveness of EU undertakings, taking into account the principle of proportionality.

Conclusion - While the changes reduce the reporting burden, we would encourage companies to obtain legal advice on whether they remain in scope and to closely assess what effective compliance will now look like. High quality reporting capturing how sustainability is incorporated into decision making and how risks and opportunities are managed (carefully triaged against any potential future litigation risk) enables companies to make a proper assessment of sustainability initiatives and where efforts are resulting in the most value.

CSDDD – Corporate Sustainability Due Diligence Directive

Scope – The revised rules will apply to:

• EU undertakings or parent companies of groups with more than 5,000 employees and net annual worldwide revenue exceeding €1.5 billion; and
• Non-EU undertakings or parent companies of groups generating net revenue in the EU above the same €1.5 billion threshold[3].

Greater harmonisation - The provisional agreement introduces maximum harmonisation across several core provisions, notably (i) Article 6 (due diligence support at a group level); (ii) Articles 8 (identification and assessment of adverse impacts) and 9 (prioritisation); (iii) Article 10(1)–(5) (prevention); (iv) Article 11(1)–(6) (bringing adverse impact to an end); and (v) Articles 14 (grievance mechanism) to 16 (communication). This limits Member States’ discretion and aims to ensure greater consistency in implementation across the EU.

Reinforced risk-based approach - The due diligence obligation is further anchored in a risk-based approach to the identification and assessment of adverse impacts. Companies must take appropriate measures having regard to relevant risk factors, including:

• factors at the level of the business partner (e.g. whether the partner falls outside the scope of the Directive or comparable legislation);
• geographical and contextual risks, such as the effectiveness of law enforcement;
• risks linked to sectors, business operations, products and services.

Scoping exercise - The previous requirement for full operations and supply-chain mapping is replaced by a scoping exercise, based solely on reasonably available information, to identify areas where adverse impacts are most likely to occur and most severe across: (i) the company’s own operations; (ii) its subsidiaries; and (iii) its chain of activities, including business partners.

In-depth assessment - An in-depth assessment must then be carried out on the basis of that scoping exercise. In this context:

• companies may request information from business partners only where strictly necessary;
• for business partners with fewer than 5,000 employees, information may be requested only where it cannot reasonably be obtained by other means.

Where relevant information can be obtained from multiple business partners at different levels of the chain of activities, companies must, where reasonable, prioritise requests to those partners where adverse impacts are most likely to occur. Where adverse impacts are equally likely or equally severe in several areas, companies may prioritise assessment of areas involving direct business partners.

Prevention and remedial measures - The possibility to terminate a business relationship as a preventive measure is removed. Companies may instead suspend the relationship. As long as there is a reasonable expectation that an enhanced prevention action plan will succeed, continued engagement with the business partner will not, in itself, expose the company to administrative penalties or civil liability.

Stakeholders and consultation - The definition of “stakeholders” is narrowed. Stakeholders now include: (i) the company’s employees; (ii) employees of its subsidiaries and business partners, and their trade unions and workers’ representatives; and (iii) individuals or communities whose rights or interests are, or could be, directly affected by the company’s operations, products or services, as well as their legitimate representatives. The definition no longer expressly includes consumers, civil society organisations, or national human rights and environmental institutions.

Stakeholder consultation is correspondingly limited to relevant stakeholders. Consultation obligations are removed in particular (i) when deciding to terminate or suspend a business relationship; and (ii) when developing qualitative and quantitative indicators for monitoring purposes.

Monitoring - The frequency of monitoring is reduced from annually to once every five years.

Climate transition plans - The obligation to adopt a climate transition plan is removed.

Supervisory authorities - Member States must designate competent supervisory authorities by July 2028.

Sanctions - The co-legislators agreed on a maximum administrative fine of 3% of a company’s net worldwide revenue (reduced from the previously proposed 5%). The European Commission is expected to issue guidelines on the application of sanctions.

Civil liability - The provisional agreement confirms the removal of a harmonised EU-level civil liability regime. A review clause requires the Commission to assess the potential future need for such a regime. Civil liability will therefore arise only where provided for under national law.

Transposition and application - Member States must adopt and publish national implementing measures by 26 July 2028. The measures will apply from 26 July 2029, with the exception of provisions implementing reporting requirements, which will apply for financial years starting on or after 1 January 2030.