CSRD & CSDDD Omnibus: Final EU Thresholds Explained

Editor's note: This article originally covered the uncertain state of EU ESG legislation following the April 2025 "stop-the-clock" vote. That uncertainty is now resolved. The EU's Omnibus I package has been negotiated, voted through, and entered into force. This update replaces speculation with the final rules — new thresholds, new timelines, and what they mean in practice for Procurement, Sourcing, and Sustainability teams.

For over a year, professionals in Procurement, Sourcing, and Sustainability sat in a kind of regulatory limbo. In April 2025, the European Parliament voted to delay and simplify two flagship sustainability laws, the Corporate Sustainability Reporting Directive (CSRD) and the Corporate Sustainability Due Diligence Directive (CSDDD), but exactly how much would change was still up for negotiation.

That negotiation is over. On 24 February 2026, the Council of the European Union gave final approval to the Omnibus I Directive, published as Directive (EU) 2026/470 in the Official Journal on 26 February 2026. It entered into force on 18 March 2026. The scope, timelines, and obligations of both directives are now fixed in law, not a stop-gap, but the new baseline procurement teams need to plan around.

Here's how we got here, what actually changed, and what it means for the people managing supplier relationships day to day.

A Quick Recap: Why CSRD & CSDDD Mattered to Procurement in the First Place

Corporate Sustainability Reporting Directive (CSRD)

CSRD grew out of the EU's 2014 Non-Financial Reporting Directive, expanding sustainability disclosure into something closer to financial-reporting rigor. It introduced double materiality, companies must report both how ESG issues affect them and how their activities affect people and the planet, backed by detailed European Sustainability Reporting Standards (ESRS).

Because most of the underlying data (supplier emissions, labor conditions, sourcing practices) sits with suppliers, CSRD reporting obligations land squarely on Procurement's desk, even though the directive itself is "just" a reporting law.

Corporate Sustainability Due Diligence Directive (CSDDD)

CSDDD takes aim at the actions behind the reports: identifying, preventing, and mitigating human rights and environmental harm across the value chain, with enforcement teeth, administrative fines and liability exposure for failing to act. In practice, this means supply chain mapping, supplier audits, contractual ESG clauses, and remediation processes, all core Procurement functions.

Together, CSRD (transparency) and CSDDD (accountability) were designed to work in tandem. The Omnibus process has reshaped both, but hasn't eliminated either.

The Timeline: From "Stop the Clock" to Final Law

What Changed: Final Scope & Thresholds

CSRD

• Mandatory reporting now applies only to EU companies with more than 1,000 employees and over €450 million in net turnover.
• Non-EU parent companies are in scope if they generate more than €450 million in EU turnover, with an EU subsidiary or branch exceeding €200 million in turnover.
• Listed SMEs are no longer in mandatory scope at all.
• Companies that fall outside the new thresholds are not required to report for financial years starting on or after 1 January 2027.
• "Wave 1" companies (the largest public-interest entities, already reporting since FY2024) will not have to report for FY2025 or FY2026, effectively aligning their timeline with Wave 2 companies.
• Member States must transpose the CSRD amendments into national law by 19 March 2027.

CSDDD

• Mandatory due diligence now applies only to companies with more than 5,000 employees and over €1.5 billion in net worldwide turnover (EU companies), or non-EU companies generating more than €1.5 billion in EU turnover.
• Member States must transpose the amendments by 26 July 2028; companies must comply from 26 July 2029.
• The first mandatory website disclosures on due diligence (under Article 16) apply to financial years starting on or after 1 January 2030.

In short: both directives now apply to a much smaller pool of the very largest companies than originally intended — but for those companies, the obligations are real, dated, and no longer negotiable.

Lighter Reporting Load: Confirmed, Not Just Proposed

For companies still in scope of CSRD, the reporting standards (ESRS) have been genuinely pared back:

• Sector-specific reporting standards have been scrapped entirely, not just postponed.
• Assurance requirements stay at "limited assurance" rather than progressing toward full audit-level "reasonable assurance."
• Double materiality survives as a core concept, but with fewer required data points overall.
• A new "value chain cap" limits how much sustainability information large in-scope companies can demand from smaller suppliers (broadly, those under 1,000 employees) — a direct, practical change for Procurement teams that have been sending out extensive supplier ESG questionnaires.

That last point matters operationally: if your organization sits below the new thresholds, your larger customers now have a legal ceiling on what they can ask of you. If you're above the thresholds and doing the asking, that ceiling applies to you too.

Due Diligence, Recalibrated

The final CSDDD retains a risk-based due diligence obligation — it hasn't been reduced to a checkbox exercise — but the mechanics have shifted:

• Companies now start with a "scoping exercise" based on information that is already reasonably available, rather than an open-ended mapping obligation across the entire value chain.
• Deeper, in-depth assessment is then prioritized toward the areas of greatest identified risk. Exactly how far "downstream" or "upstream" that scrutiny needs to extend by default is one of the more actively debated points among legal commentators — some read the final text as centering on direct business partners with escalation triggers for deeper tiers, others emphasize that the broader "chain of activities" concept remains in scope. Companies should treat this as a compliance question for legal counsel rather than a settled line.
• The requirement to terminate a business relationship as a last resort has been removed; suspension is now the only last-resort measure.
• Mandatory periodic review of due diligence measures moves from an annual cycle to once every five years.
• The obligation to adopt and implement a climate transition plan has been removed from CSDDD entirely. Companies in CSRD scope with an existing transition plan still have to report on it — but it's no longer a mandated deliverable in itself.
• The EU-harmonized civil liability regime has been dropped; whether and how affected parties can sue in European courts now depends on national law, which will vary by Member State.
• The penalty ceiling for non-compliance is now capped at 3% of worldwide net turnover, down from the 5% floor in the original directive.

Reactions Remain Split

The final text hasn't settled the debate, just moved it from "will this happen" to "was this the right call." Business and legal groups broadly describe the outcome as a workable recalibration that gives companies room to build sustainable data infrastructure without a rushed compliance sprint. Civil society groups and some lawmakers see it differently — several have characterized the final package as prioritizing competitiveness over the original directives' human rights and environmental ambitions, while acknowledging that a risk-based due diligence obligation, however narrowed, is still on the books.

Both things can be true at once: the legal requirement is smaller and later than originally planned, and it still represents a binding, enforceable EU standard for the companies it covers.

What This Means for Procurement & Supply Chain Teams Now

The planning question has changed from "how do we prepare for an uncertain deadline" to "do we fall inside or outside this now-final scope — and what follows from that."

1. Check Your Actual Scope

Run your own headcount and turnover (and your parent company's, if applicable) against the final thresholds — 1,000 employees / €450M turnover for CSRD, 5,000 employees / €1.5B turnover for CSDDD. Many companies that were gearing up in 2024 are now out of mandatory scope entirely.

2. Watch for Flow-Down Requirements Even If You're Out of Scope

If you supply into a company that is in scope, expect continued (if now capped) ESG data requests as part of their own due diligence and reporting obligations. The value chain cap limits what they can ask — it doesn't eliminate the request.

3. Build Toward the Real Deadlines

CSRD transposition lands March 2027; CSDDD compliance starts July 2029. That's a longer runway than the original 2025/2026 deadlines, but it isn't indefinite. Use the extra time to build supplier data infrastructure, refine questionnaires, and pilot due diligence processes — rather than shelving the work until the deadline is close again.

4. Track National Transposition

Member States transpose EU directives into domestic law, and some historically go further than the EU floor (so-called "gold-plating"). If you operate across multiple EU markets, don't assume the EU-wide thresholds are the whole story locally.

5. Keep the Underlying Commercial Pressure in Mind

Investor expectations, customer contract clauses, and market reputation don't reset just because a company falls outside the new legal thresholds. Many organizations will keep collecting supplier ESG data voluntarily because their own customers or investors expect it — law or no law.