Omnibus I approved: what’s next for Luxembourg on sustainability reporting and due diligence?

Context

On 16 December 2025, the EU Parliament approved Omnibus I, introducing significant changes to the CSRD and the CS3D. These changes reflect the outcomes of trilogue negotiations and will reshape compliance strategies for companies across the EU and beyond. For Luxembourg businesses, the implications are particularly relevant given the confirmed delay in national implementation.

CSRD – new scope and what it means

With Omnibus I, the “Wave” distinction will disappear, and CSRD applicability will now depend solely on updated thresholds. The CSRD will now apply to EU companies exceeding both thresholds of i) more than 1,000 employees and ii) net annual turnover above EUR 450 million on a consolidated basis. Non-EU companies will be in scope if they generate over EUR 450 million in turnover in the EU and have an EU-based subsidiary or branch with turnover above EUR 200 million.

This adjustment has immediate consequences for the reporting waves. Member States have the option to exempt old “Wave 1” companies that do not meet the new thresholds for FY2025 and FY2026. Many old “Wave 2” companies, which were originally preparing to start reporting in 2026, will now fall out of scope entirely.

For Luxembourg businesses, CSRD reporting will not be mandatory for FY2025. The current bill of law specifies that it enters into force on the first day of the month following publication in the Luxembourg Official Journal. Undertakings whose financial year ended before entry into force are not required to report for that year but may do so voluntarily.

The new updates clarify value chain information request limits, as entities with fewer than 1,000 employees may refuse requests that go beyond the voluntary ESRS (VSMEs).

CSRD content changes

Beyond scope, Omnibus I introduces important changes to reporting content. The EU Commission will adopt a delegated act within six months to simplify the ESRS by reducing data points, prioritising quantitative disclosures and clarifying materiality. The standards will move toward decision-useful information, helping companies report what truly matters to stakeholders rather than following prescriptive checklists. There is now an explicit emphasis on fair presentation, aligned with IFRS S1, and no data points will be required outside the scope of materiality.

The double materiality assessment (DMA) will be streamlined through clearer guidance, reduced documentation requirements and better alignment with audit needs. Reliefs and proportionality mechanisms will ease requirements for value-chain data, allowing reasonable estimates and phased-in expectations. Companies with fewer than 1,000 employees can refuse to provide information beyond voluntary ESRS, and omission rights are confirmed for commercially sensitive or legally protected information.

Finally, limited assurance remains the chosen approach, with the EU Commission expected to adopt assurance standards by 1 July 2027.

EU Taxonomy simplification

As proposed by the EU Commission in the initial Omnibus I proposal, companies with turnover below EUR 450 million are no longer required to report on Taxonomy.

Furthermore, entities are now exempt from assessing Taxonomy eligibility and alignment for activities that are not financially material (e.g. those representing less than 10% of turnover).

As per the content of the reporting, the do no significant harm (DNSH) criteria have been simplified, and reporting templates have been streamlined, reducing the number of required data points by nearly 70%.

CS3D – a Directive for the largest players

CS3D’s scope has been drastically narrowed. Only EU companies with more than 5,000 employees and EUR 1.5 billion global turnover, and non-EU companies with EU turnover above EUR 1.5 billion, will remain subject to due diligence obligations. For franchising and licencing models, only companies with turnover above EUR 275 million and royalties exceeding EUR 75 million will remain in scope. Approximately 1,500 companies across the EU are expected to qualify.

The timeline has also shifted significantly: Member States must implement Omnibus I by 26 July 2028, and compliance will be required from July 2029. Although this extended period gives companies time to embed due diligence into governance frameworks, preparations should still start now.

Omnibus I clarifies that due diligence applies across the entire “chain of activities”, but companies should prioritise direct business partners. Indirect partners are assessed only on a case-by-case basis where there is objective evidence of risk or circumvention. To reduce burdens, companies must refrain from requesting unnecessary information from SMEs or entities outside the Omnibus I scope. Due diligence assessments will be required every five years, rather than continuously. Other notable changes include the removal of the obligation to publish a climate transition plan and the absence of an EU-harmonised civil liability regime—enforcement will be left to Member States.

What comes next?

Following the approval of Omnibus I, the EU legislative process moves to formal adoption by the Council of the EU and publication in the Official Journal of the EU, after which Member States must implement the revised CSRD and CS3D into national law. In Luxembourg, the current CSRD bill will need to be amended to reflect the new thresholds and reliefs. Entry into force is expected in the first half of 2026, meaning FY2025 reporting will not be mandatory. For CS3D, implementation is required by July 2028, with compliance starting in July 2029. Companies should monitor national developments closely and prepare governance frameworks to align with the updated EU sustainability regime.

What should companies do now?

Companies that no longer meet the revised thresholds should reassess their compliance roadmap and pivot resources toward broader sustainability priorities rather than mandatory reporting. For “Old Wave 1” entities, confirming scope is critical, as those exempt can leverage transition relief for FY2025 and FY2026 while considering voluntary reporting as a market positioning exercise. Non-EU groups should revisit applicability under the new criteria and monitor subsidiary requirements closely. Organisations that remain in scope should anticipate ESRS simplification and use the extended timeline to embed CS3D obligations into long-term governance and risk frameworks, ensuring readiness well ahead of 2029.

Authors : Sara Garcia Toledano and Rocco Mezzatesta