Editor's note: This article originally covered the uncertain state of EU ESG legislation following the April 2025 "stop-the-clock" vote. That uncertainty is now resolved. The EU's Omnibus I package has been negotiated, voted through, and entered into force. This update replaces speculation with the final rules — new thresholds, new timelines, and what they mean in practice for Procurement, Sourcing, and Sustainability teams.
For over a year, professionals in Procurement, Sourcing, and Sustainability sat in a kind of regulatory limbo. In April 2025, the European Parliament voted to delay and simplify two flagship sustainability laws, the Corporate Sustainability Reporting Directive (CSRD) and the Corporate Sustainability Due Diligence Directive (CSDDD), but exactly how much would change was still up for negotiation.
That negotiation is over. On 24 February 2026, the Council of the European Union gave final approval to the Omnibus I Directive, published as Directive (EU) 2026/470 in the Official Journal on 26 February 2026. It entered into force on 18 March 2026. The scope, timelines, and obligations of both directives are now fixed in law, not a stop-gap, but the new baseline procurement teams need to plan around.
Here's how we got here, what actually changed, and what it means for the people managing supplier relationships day to day.
CSRD grew out of the EU's 2014 Non-Financial Reporting Directive, expanding sustainability disclosure into something closer to financial-reporting rigor. It introduced double materiality, companies must report both how ESG issues affect them and how their activities affect people and the planet, backed by detailed European Sustainability Reporting Standards (ESRS).
Because most of the underlying data (supplier emissions, labor conditions, sourcing practices) sits with suppliers, CSRD reporting obligations land squarely on Procurement's desk, even though the directive itself is "just" a reporting law.
CSDDD takes aim at the actions behind the reports: identifying, preventing, and mitigating human rights and environmental harm across the value chain, with enforcement teeth, administrative fines and liability exposure for failing to act. In practice, this means supply chain mapping, supplier audits, contractual ESG clauses, and remediation processes, all core Procurement functions.
Together, CSRD (transparency) and CSDDD (accountability) were designed to work in tandem. The Omnibus process has reshaped both, but hasn't eliminated either.
| The Timeline: |
|
| February 2025 |
The European Commission proposes the Omnibus I "simplification package," aiming to narrow the scope and soften the obligations of CSRD and CSDDD. |
| April 2025 |
The European Parliament fast-tracks and adopts a "stop-the-clock" directive, delaying implementation timelines while the substantive Omnibus negotiations continue. |
| December 2025 |
The Council and Parliament reach a provisional political agreement in trilogue; Parliament formally adopts the compromise text on 16 December 2025. |
| 24 February 2026 | The Council of the EU gives final approval to the Omnibus I Directive. |
| 26 February 2026 |
The directive is published in the Official Journal as Directive (EU) 2026/470. |
| 18 March 2026 |
The directive enters into force. |
The final agreement went further in scaling back obligations than the Commission's original 2025 proposal — a reminder that "simplification" kept moving in one direction throughout the process.
In short: both directives now apply to a much smaller pool of the very largest companies than originally intended — but for those companies, the obligations are real, dated, and no longer negotiable.
For companies still in scope of CSRD, the reporting standards (ESRS) have been genuinely pared back:
That last point matters operationally: if your organization sits below the new thresholds, your larger customers now have a legal ceiling on what they can ask of you. If you're above the thresholds and doing the asking, that ceiling applies to you too.
The final CSDDD retains a risk-based due diligence obligation — it hasn't been reduced to a checkbox exercise — but the mechanics have shifted:
The final text hasn't settled the debate, just moved it from "will this happen" to "was this the right call." Business and legal groups broadly describe the outcome as a workable recalibration that gives companies room to build sustainable data infrastructure without a rushed compliance sprint. Civil society groups and some lawmakers see it differently — several have characterized the final package as prioritizing competitiveness over the original directives' human rights and environmental ambitions, while acknowledging that a risk-based due diligence obligation, however narrowed, is still on the books.
Both things can be true at once: the legal requirement is smaller and later than originally planned, and it still represents a binding, enforceable EU standard for the companies it covers.
The planning question has changed from "how do we prepare for an uncertain deadline" to "do we fall inside or outside this now-final scope — and what follows from that."
Run your own headcount and turnover (and your parent company's, if applicable) against the final thresholds — 1,000 employees / €450M turnover for CSRD, 5,000 employees / €1.5B turnover for CSDDD. Many companies that were gearing up in 2024 are now out of mandatory scope entirely.
If you supply into a company that is in scope, expect continued (if now capped) ESG data requests as part of their own due diligence and reporting obligations. The value chain cap limits what they can ask — it doesn't eliminate the request.
CSRD transposition lands March 2027; CSDDD compliance starts July 2029. That's a longer runway than the original 2025/2026 deadlines, but it isn't indefinite. Use the extra time to build supplier data infrastructure, refine questionnaires, and pilot due diligence processes — rather than shelving the work until the deadline is close again.
Member States transpose EU directives into domestic law, and some historically go further than the EU floor (so-called "gold-plating"). If you operate across multiple EU markets, don't assume the EU-wide thresholds are the whole story locally.
Investor expectations, customer contract clauses, and market reputation don't reset just because a company falls outside the new legal thresholds. Many organizations will keep collecting supplier ESG data voluntarily because their own customers or investors expect it — law or no law.
The rug-pull feeling many Sustainability and Procurement professionals experienced in 2025 has given way to something more useful: certainty, even if it's a smaller and later version of what was originally proposed. The final Omnibus I Directive tells you exactly who's in scope, when obligations start, and what they require.
For most Procurement teams, the work itself hasn't changed direction — collecting reliable supplier data, understanding where risk actually sits in the supply chain, and being able to act on what you find are still the fundamentals of resilient sourcing. What's changed is that you now have a fixed legal timeline to plan against, instead of a moving target.