The EU Omnibus reforms: Reshaping corporate sustainability obligations

On 13 October 2025, the European Parliament's Legal Affairs Committee (JURI) voted to approve significant changes to the EU's Corporate Sustainability Reporting Directive (CSRD) and Corporate Sustainability Due Diligence Directive (CSDDD) as part of the Omnibus I simplification package. 

The revised rules will, if accepted, significantly reduce the number of companies required to report on sustainability, with only companies exceeding 1,000 employees and €450 million net annual turnover subject to mandatory sustainability reporting. 

For due diligence obligations under CSDDD, the threshold would rise to companies with over 5,000 employees and €1.5 billion net annual turnover. Negotiations on the final legislative text are expected to commence on 24 October 2025, with trilogue negotiations scheduled through November and December.

The big picture

The European Commission published its first Omnibus package on 26 February 2025 to simplify and streamline reporting requirements, including changes to the CSRD, EU Taxonomy and CSDDD.

The move came after growing concerns that sustainability reporting requirements were putting European companies at a competitive disadvantage. With 17 votes for, six against and two abstentions, the Legal Affairs Committee approved its position on these changes.

This vote marks a significant shift from the ambitious scope originally planned for these directives. The key question is whether this represents sensible simplification or a step backwards on environmental and social commitments. 

Who's affected now?

The most striking change is the dramatic reduction in companies facing mandatory sustainability obligations.

The Commission estimates that their proposals will reduce the number of companies in scope of CSRD by 80%, while the Council's position may represent a 70% reduction in the number of companies within scope of the CSDDD.

CSRD changes

MEPs want to reduce the scope to cover only those companies with over 1,000 employees on average and a net annual turnover above €450 million. The Council and Parliament negotiating positions may represent a 90% reduction from the original framework.

For non-EU companies, the EU net turnover threshold is increased to €450 million, and the net turnover threshold for an EU branch is increased to €50 million. Many multinationals with European operations may now fall outside mandatory reporting requirements.

For firms no longer covered by the rules, reporting would be voluntary, in line with Commission guidelines. However, to prevent large companies from shifting their reporting duties onto smaller business partners, these would not be allowed to request information beyond the voluntary standards, setting a 'cap' on data requirements. This 'value chain cap' protects smaller enterprises from disproportionate demands.

Third country companies (non-EU) who had been subject to CSRD reporting if they had an EU based turnover of more than €150 million and a qualifying “large” subsidiary or branch that that generated €40 million are now only caught by CSRD if these amounts are €450 million and €50 million, respectively, but the applicable deadlines have not changed and remain at financial year 2028 to be reported in 2029.

CSDDD changes

According to MEPs, due diligence rules should only apply to large EU businesses with more than 5,000 employees and a net yearly turnover above €1.5 billion, and to foreign businesses with a net turnover in the EU above the same threshold. This dramatically narrows the directive's scope, excluding the majority of companies. Only the very largest corporations will face mandatory due diligence obligations.

The employee threshold requirements do not apply to non-EU companies, which are within the scope of the CSDDD if they meet the EU-based net turnover threshold.

For Wave 1 (non-EU companies with net EU turnover of €1.5+ billion), the compliance date is delayed by one year to 26 July 2028. For Wave 2 (non-EU companies with net EU turnover of €900+ million), the compliance date is unchanged at 26 July 2028. For Wave 3 (non-EU companies with EU turnover of €450+ million in the EU), the compliance date is unchanged at 26 July 2029.

The proposal also removes the EU-wide civil liability regime (subject to a review of effectiveness in 2030) and shifts enforcement to member states.

Supply chain impact

The reforms fundamentally change how companies must approach their supply chains, moving from comprehensive mapping to targeted, risk-based assessment.

Risk-based approach

Instead of systematically asking for information from their business partners, MEPs want companies to adopt a risk-based approach, whereby they only ask for the necessary information where there is a prospect of an adverse impact in their business partners' activities. In the case of firms outside the scope of the rules, this would be possible only as a last resort.

The JURI compromise text proposes that companies first conduct a "scoping" exercise based on information that "is already reasonably available" (without requesting information from business partners), to identify whether adverse impacts have or might occur. After scoping, the company is only required to assess the most likely and severe adverse impacts, giving priority to direct partners.

Requesting information from business partners should only occur where necessary, and only as a last resort for partners with fewer than 5,000 employees. In all cases requests should be "targeted, reasonable and proportionate".

Indirect suppliers

The Commission's proposals would limit the requirement to conduct due diligence along an undertaking's value chain to only its direct (tier 1) business partners. Companies would only be required to look beyond their direct business relationships where they have "plausible information" of an objective character that suggests an adverse impact at the level of an indirect business partner.

The Council has replaced this concept with a more precise definition: "Information that objectively has a reasonable likelihood of being true". This includes credible data from government bodies, baseline studies, third-party impact assessments, NGO reports, local community grievances, and academic research.

Companies will need to develop systems for identifying risk indicators that might trigger deeper investigation of indirect suppliers. The Council's broader interpretation of 'objective and verifiable information' means that in-scope companies may still be expected to investigate indirect business partners in many more situations than initially anticipated.

Protecting smaller companies

The Commission proposes to prevent in-scope companies from requesting information from their smaller value chain partners (those with fewer than 1,000 employees) that goes beyond the information required under the voluntary reporting standards. This addresses concerns that large companies would cascade their reporting obligations down the supply chain.

However, the Commission notes that in-scope undertakings would still be able to collect from such companies any additional sustainability information that is commonly shared between companies in the same sector, which introduces some ambiguity in sectors where detailed sustainability data sharing is standard practice.

For smaller companies below the new thresholds, the situation is mixed. While they're relieved of mandatory reporting, they may still face information requests from larger partners (within the cap's limits). The question is whether voluntary reporting becomes a competitive necessity if customers, investors, or other stakeholders continue demanding sustainability information.

What happens next?

Trilogue negotiations

The three main EU institutions (Parliament, Council, and Commission) will enter into Trilogue negotiations to reach a provisional agreement on a legislative proposal acceptable to both Parliament and Council. Given the relative level of alignment between all parties, this process may be finalised by the end of Q4 2025, or the start of Q1 2026.

All three institutions now agree that companies with fewer than 1,000 employees should be exempt from the CSRD, so this core element is unlikely to change. However, the financial threshold remains contested: the Commission has proposed a €50 million turnover threshold, whilst both the Council and Parliament support a significantly higher €450 million threshold.

Implementation timeline

The Stop the Clock Directive requires Member States to transpose the changes into domestic legislation by 31 December 2025 at the latest. For CSRD, in-scope large EU companies now face reporting requirements for financial years starting from 1 January 2027 (with first reports due in 2028), delayed from the previous timeline of 1 January 2025.

For CSDDD, the Stop the Clock Directive postpones the transposition deadline from 26 July 2026 to 26 July 2027, and the first phase of application to in-scope companies is also postponed by one year (from 26 July 2027 to 26 July 2028). According to the Council's Final Position, the application deadline for CSDDD for all in-scope companies should be deferred to 26 July 2029.

The JURI text provides that the Commission will adopt a delegated act as soon as possible, and at the latest six months after the entry into force of the Omnibus I package, to revise the ESRS to substantially reform the standards. Following a public consultation process that ended on 29 September 2025, EFRAG is set to publish the final simplified ESRS by the end of November, ahead of a conference on 4 December.

Looking ahead

The Omnibus reforms represent the most significant recalibration of EU sustainability policy since the European Green Deal was launched. The dramatic reduction in companies subject to mandatory obligations, the shift to risk-based supply chain due diligence, and the protections for smaller enterprises all reflect a fundamental reassessment of how to balance sustainability ambitions with economic competitiveness.

For companies now outside the scope of mandatory requirements, the reforms bring welcome relief from complex compliance obligations. But they also create uncertainty. Will voluntary reporting become the de facto standard? Will customers and investors continue demanding the same transparency regardless of legal requirements? How do you respond to an unreasonable demand?

For the largest companies remaining in scope, the reforms offer some simplification, particularly in supply chain due diligence. The shift from comprehensive mapping to targeted, risk-based assessment should reduce administrative burdens. However, these companies will need sophisticated systems for identifying risk indicators and determining when deeper investigation of indirect suppliers is warranted.

The coming months will be critical as trilogue negotiations determine the final shape of these reforms. While broad consensus exists on core elements, important details remain to be resolved.

We will be monitoring these developments closely and consider how different potential outcomes might affect sustainability strategies and compliance programmes and provide updates on the position in our monthly retail law roundup.