CSRD after the Omnibus deal: what’s in, what’s out, and what’s next

If you have felt a growing sense of fatigue every time a new CSRD threshold was floated over the past months, you are not alone. At some point, the debate seemed to produce more numbers than clarity. 500 employees. 1,000. 1,750. Two out of three criteria. One out of two. Add a delay here, a simplification there, and repeat.

But now, after a long and very political process, we are finally at the point where the outcome is clear.

On 16 December, the European Parliament is set to vote in plenary on the provisional trilogue agreement amending the CSRD as part of the Omnibus package. This vote marks the final political step in the legislative process. While the legal text will still go through formal adoption and publication steps, the substance will not change anymore.

So, with that provisional but final clarity in sight, it is time to take stock: what has actually landed, and what does it mean in practice?

Wave 1: nothing changes for the 2025 annual report

Let’s start with the least exciting, but most important point.

For Wave 1 companies, large public-interest entities already reporting under CSRD, nothing changes for the 2025 annual report that many teams are already working on.

There is no change in scope, no delay, and no simplified ESRS yet. Wave 1 reporters will still report under the current ESRS set for FY 2025. Any expectation that simplification might arrive just in time can be put to rest.

Wave 2: from stop-the-clock to a fundamentally different scope

Wave 2 companies are where the story really starts.

These companies originally would have had to report under CSRD in their 2025 annual report. The earlier stop-the-clock decision already pushed that obligation out. The Omnibus agreement now goes much further.

For many Wave 2 companies, the question is no longer when they have to report, but whether they are still in scope at all.

Final thresholds: no more “two out of three”

One of the most consequential outcomes of the Omnibus deal is the complete replacement of the old two out of three size test.

Under the final compromise, CSRD scope is defined by fixed thresholds:

• More than 1,000 employees, and
• More than €450 million in net annual turnover

Both criteria must be met. The previous mix-and-match approach, combining turnover, balance-sheet total and employees, is gone.

From when does this apply?

These new thresholds apply to companies that would otherwise have entered CSRD under later waves. Combined with the earlier stop-the-clock decision, this means that many companies that were preparing for CSRD reporting will never enter scope, while others will enter later, but under simplified standards.

The net effect is a much narrower CSRD population than originally envisaged.

Fewer companies, but still a large share of market capital

While the number of companies in scope drops significantly, it is important not to misread what this means.

The CSRD still applies to the largest and most economically significant companies, covering a substantial share of EU market capitalization. In other words, the directive becomes more targeted, not irrelevant.

Supply chain reporting: a clear line is finally drawn

Another major source of confusion over the past two years has been value-chain reporting.

The Omnibus agreement introduces an important and very practical clarification: CSRD reporting obligations do not cascade endlessly through the supply chain.

Companies reporting under CSRD are no longer expected to systematically collect ESRS-level data from suppliers and partners that are not themselves in scope of CSRD. Instead, value-chain disclosures can rely on reasonable estimates, existing information and proportionate approaches.

This avoids turning CSRD into a de facto global data-collection exercise, and it is a critical course correction.

Wave 3: removed as a mandatory reporting wave

This brings us to Wave 3.

Listed SMEs, small and non-complex credit institutions, and captive insurers were originally expected to enter CSRD at a later stage. Under the Omnibus agreement, this mandatory wave has been removed entirely.

There is no delayed obligation and no phased entry. For SMEs that still choose to report, for example in response to investor, lender or customer expectations, a voluntary SME standard, the VSME, remains available. But that is a choice, not a legal requirement.

Assurance: limited, and staying that way for now

CSRD continues to require external assurance, but the direction is clearly cautious.

Limited assurance remains the baseline. The previously anticipated automatic move to reasonable assurance is softened, and any future step-up would require additional policy decisions and standards.

For now, assurance requirements align with the broader objective of proportionality.

ESRS simplification: real, but not immediate

In parallel to the Omnibus changes, the ESRS themselves are being simplified. The key nuance is timing.

Wave 1 companies will still report for FY 2025 using the current ESRS. Simplified ESRS are expected to apply from FY 2026 onwards. Wave 2 companies, if and when they enter scope, will do so under these simplified standards.

The simplification focuses on reducing reporting burden while keeping the core principles intact. A detailed breakdown deserves its own article, but the direction is clear.

Non-EU companies: still in scope, but narrowly and explicitly

Non-EU companies with significant business in the EU are still within the scope of CSRD, but the final framework is now much clearer and more targeted.

A non-EU company falls under CSRD if it generates more than €450 million in net turnover in the EU and has a qualifying EU presence through a subsidiary or branch. There is no employee threshold at parent-company level.

Importantly, CSRD does not require a full group-wide sustainability report. Instead, non-EU companies are required to prepare a separate sustainability report covering their EU operations, focused on sustainability impacts, risks and opportunities relevant to the EU footprint.

The timing remains unchanged: first reporting is expected for FY 2028, with publication in 2029.

Stepping back: what does this actually mean?

After all the debates, delays and thresholds, a few things are now clear.

CSRD still affects a large and economically significant part of the market. It remains complex to implement. Data collection, consolidation, assurance and external reporting are still very real challenges for listed companies, large groups and non-EU issuers alike.

At the same time, companies that fall outside the new thresholds will still face pressure to report, even if they are no longer legally required to do so.

The difference is that we now finally know where the legal line is drawn.

One last “final” remark

So yes, this vote marks the final legislative hurdle, even if the legal text still needs to be polished, translated and formally published. That too is very European.

But the substance is settled.
The direction is fixed.
And the ground under CSRD has finally stopped shifting.

Which, after everything, may be the biggest relief of all.