Omnibus I is final: clarity for businesses on sustainability obligations

	FY2024	FY2025	FY2026	FY2027	FY2028
EU regime	CSRD old Wave 1 applies (financial years starting between 1 January 2024 and 31 December 2026). Former NFRD entities in scope.	Under Article 3 of Omnibus I, the original Wave 1 scope applies for financial years starting between 1 January 2024 and 31 December 2026. However, for FY2025 and FY2026, Member States may exempt undertakings or issuers that do not exceed EUR 450 million in net turnover or 1,000 employees (on a consolidated basis where applicable). The threshold test is disjunctive: failing to meet either threshold suffices for exemption. From FY2027, only undertakings exceeding both thresholds fall within scope, regardless of prior Wave 1 status.	Same transition exemption available as FY2025.	From FY2027 onwards, only companies exceeding both thresholds are subject to mandatory sustainability reporting.	For third-country undertakings, the net turnover threshold in the EU is raised to EUR 450 million, and the subsidiary or branch net turnover threshold is set at EUR 200 million. Third-country parent undertakings which are financial holding undertakings whose subsidiaries’ business models and operations are independent of one another may choose not to publish a sustainability report under Article 40a.
Luxembourg regime	No CSRD implementation — no mandatory CSRD obligation. Former Wave 1 entities subject to NFRD and EU Taxonomy obligations only. Voluntary alignment with CSRD standards possible.	No CSRD implementation for FY2025 — no mandatory CSRD obligation. Former Wave 1 entities must produce an NFRD- and EU Taxonomy-compliant report and may voluntarily align with CSRD standards.	Omnibus I-aligned national law expected in Q2 or Q3 2026. No retroactive application for FY2025. Former Wave 1 companies fall under the new rules from FY2026. Whether Luxembourg exercises the transition exemption for sub-threshold entities remains to be confirmed.	Former Wave 2 companies exceeding both thresholds fall under the new rules from FY2027. CSRD implementation deadline: 19 March 2027.	CS3D implementation deadline: 26 July 2028. CS3D compliance applies from 26 July 2029.
Applicable ESRS	Voluntary: 2023 ESRS (Commission Delegated Regulation (EU) 2023/2772). Mandatory: NFRD + EU Taxonomy.	Voluntary: 2023 ESRS. Mandatory (old Wave 1): NFRD + EU Taxonomy. Voluntary standard for SMEs (VSME) available under Commission Recommendation (EU) 2025/1710.	ESRS 2.0 to be adopted by EU Commission delegated act within six months of entry into force of Omnibus I (expected H2 2026). Sector-specific ESRS empowerment removed; EU Commission may provide sector-specific guidance instead. Voluntary: VSME.	ESRS 2.0 in force. Formal voluntary ESRS (VSME delegated act) to be adopted by 19 July 2026.	ESRS 2.0 in force. VSME delegated act in force.
Assurance standards	No harmonised EU limited assurance standard. In practice, assurance providers may refer to the CEAOB guidelines on the application of ISSA 5000 as a reference framework pending adoption of EU standards.	No harmonised EU limited assurance standard. Assurance providers may refer to the CEAOB guidelines on the application of ISSA 5000 as a reference framework. Limited assurance applies where an undertaking voluntarily aligns with CSRD.	Limited assurance remains the applicable standard. The deadline for harmonised limited assurance standards has been postponed to 1 July 2027. The requirement to adopt reasonable assurance standards has been removed. In the CEAOB guidelines on the application of ISSA 5000 as a reference framework, assurance providers may refer to the interim.	EU Commission to adopt limited assurance standards (delegated acts) no later than 1 July 2027, covering engagement planning, risk consideration and conclusions. Harmonised standards expected to apply for FY2027 reports.	Harmonised EU limited assurance standards fully operative. Audit firms need only designate at least one key sustainability partner approved as a statutory auditor in the Member State concerned.

CS3D

Scope narrowed to the largest companies, with effects across the chain of activities

EU companies must now exceed both 5,000 employees and EUR 1.5 billion in net worldwide turnover to fall within scope of CS3D. Third-country undertakings are captured where EU turnover exceeds EUR 1.5 billion. A targeted carve-in applies to franchising or licensing arrangements where royalties exceed EUR 75 million and net worldwide turnover exceeds EUR 275 million (or, for third-country undertakings, where those thresholds are met in the EU). The implementation deadline is 26 July 2028, with compliance required from 26 July 2029.

While the direct obligations under CS3D now apply only to the very largest companies, Omnibus I ‘s effects extend well beyond that circle. Companies forming part of the chain of activities of in-scope entities may face information requests, contractual assurance requirements and corrective measures. An understanding of the revised framework is therefore relevant for a broad range of undertakings, including those not directly subject to CS3D as amended by Omnibus I.

Key amendments introduced in several other notable areas

The key substantive changes introduced by Omnibus I to the CS3D framework are as follows:

• Identification of adverse impacts: Omnibus I introduces a two-step approach of i) a scoping exercise based solely on reasonably available information, followed by ii) an in-depth assessment in the areas where adverse impacts were identified as most likely and most severe.
• Proportionate information requests: information requests to business partners must be necessary and targeted. For business partners with fewer than 5,000 employees, companies may only request information where it cannot reasonably be obtained by other means.
• Use of digital solutions and initiatives: companies may rely on digital solutions, industry and multi-stakeholder initiatives as appropriate resources for identification and assessment purposes.
• Monitoring: periodic reassessments of due diligence measures are required at least every five years, or without undue delay after a significant change occurs.
• Climate transition plan: the obligation to adopt and implement a climate transition plan (former Article 22) has been repealed.
• Civil liability: the EU-harmonised civil liability regime has been removed. Companies will be liable under applicable national law, and Member States must ensure that victims have a right to full compensation where a company is held liable for a failure to comply with due diligence requirements.
• Penalties are capped at 3% of net worldwide turnover.
• Suspension of business relationships: before suspending a business relationship as a last-resort measure, companies must assess whether the adverse impacts of suspension would be manifestly more severe than the impact being addressed. Where that is the case, the company is not required to suspend and must report its duly justified reasons to the supervisory authority.

CSRD

New changes to scope

From financial year (FY) 2027, only undertakings exceeding both 1,000 employees and EUR 450 million in net turnover are subject to mandatory sustainability reporting at individual level. The same thresholds apply on a consolidated basis for parent undertakings of groups. For third-country undertakings, the net turnover threshold in the EU is raised to EUR 450 million, and the subsidiary or branch net turnover threshold is set at EUR 200 million (Article 40a(1) of Directive 2013/34/EU, as amended). Third-country parent undertakings which are financial holding undertakings whose subsidiaries’ business models and operations are independent of one another may choose not to publish a sustainability report under Article 40a. Member States may exempt sub-threshold entities for FY2025 and FY2026.

What the new scope means for Luxembourg

In Luxembourg, the CSRD has not yet been implemented. For FY2025, old Wave 1 entities[1] must comply with Non-Financial Reporting Directive (NFRD) and EU Taxonomy requirements and may voluntarily align with CSRD standards. An Omnibus I-aligned national law is expected by June 2026. Under Omnibus 1, old Wave 1 applies for financial years starting between 1 January 2024 and 31 December 2026, and Member States may exempt sub-threshold entities for FY2025 and FY2026. From FY2027, only undertakings exceeding both thresholds (EUR 450 million net turnover and 1,000 employees) are subject to mandatory reporting. The Member States must implement the CSRD amendments by 19 March 2027. Whether and how Luxembourg exercises the transitional exemption for sub-threshold entities remains to be confirmed.

[1] “Old Wave one” refers to the original first group of CSRD in‑scope companies—large PIEs previously subject to the NFRD, reporting for FY2024.

In August 2025, the Commission de Surveillance du Secteur Financier (CSSF) published its fact-finding report that reviewed 2024 sustainability reports: CSRD – 1st Year of Reporting by Issuers: Results of a Review of Corporate Practices (CSSF Report). The CSSF Report found that almost 60% of issuers voluntarily followed full ESRS requirements, with 63% of those obtaining limited assurance, and that reports improved significantly compared to previous years. With regard to double materiality, the CSSF encouraged comprehensive presentations, and suggested that issuers strengthen their assessment processes by more clearly defining entity-specific topics, applying stricter thresholds and better documenting materiality determinations. As regards supervisory approach, the CSSF confirmed that “[t]he first-time application of ESRS is a learning curve for all stakeholders and hence, application of the CSSF’s supervision actions will be proportionate and realistic”. Key changes for below-threshold undertakings

Undertakings below the new thresholds may report voluntarily. This aligns with a broader market trend: the ECB staff opinion on the revised ESRS supports the voluntary use of ESRS 2.0 as a preferable alternative to the VSME, noting that the materiality-based approach provides built-in proportionality for undertakings of varying size and complexity (see ECB staff opinion on the revised ESRS, February 2026). The EU Commission must adopt voluntary ESRS (VSME) by 19 July 2026; until then, companies may follow Commission Recommendation (EU) 2025/1710.

Undertakings with fewer than 1,000 employees are “protected undertakings” with a statutory right to refuse information requests that exceed the voluntary standards. Reporting undertakings must inform protected undertakings of this right and may rely on a self-declaration from value chain partners to determine protected undertaking status, without being required to verify the declaration, unless they know or can reasonably be expected to know that it is manifestly incorrect. These protections apply only to CSRD reporting and do not affect obligations under the Sustainable Finance Disclosure Regulation (SFDR), EU Taxonomy, sector-specific financial legislation or CS3D. Notably, the legal empowerment for the EU Commission to adopt binding sector-specific ESRS has been removed. The EU Commission may instead provide non-binding sector-specific guidance to facilitate the application of ESRS within a given sector.

A delegated act adopting the ESRS 2.0 is expected within six months of entry into force of Omnibus I (expected H2 2026). The ESRS 2.0 will remove less important data points, prioritise quantitative disclosures, clarify the materiality principle and improve alignment with financial services legislation and global standards.

Undertakings may omit information that would seriously prejudice their commercial position, qualifies as trade secrets or classified information, or must be protected under EU or national law. Each omission must be disclosed and reassessed annually.

Additional exemptions and reliefs under the amended CSRD:

• Financial holding undertakings: where a parent undertaking is a financial holding undertaking whose subsidiary undertakings’ business models and operations are independent of one another, it may choose not to include consolidated sustainability information in its consolidated management report (Article 29a(7a) of Directive 2013/34/EU, as amended). This option is strictly limited to cases where the parent does not involve itself directly or indirectly in the management of the subsidiary undertakings, without prejudice to its rights as a shareholder.
• Exemption for subsidiaries of reporting groups: the exemption from individual sustainability reporting available to subsidiary undertakings whose parent undertaking reports at consolidated level also applies to public-interest entities subject to Article 19a (Article 19a(10)) and to public-interest entities subject to Article 29a (Article 29a(9)).
• Relief for mergers and acquisitions: where the composition of a group changes during the financial year due to acquisitions or mergers, the parent undertaking may postpone sustainability reporting for newly acquired or merged undertakings to the subsequent financial year. Where a subsidiary leaves the group during the financial year, the parent undertaking may exclude that subsidiary’s sustainability information from the consolidated management report for that year. In either case, the parent undertaking must indicate any significant event affecting the relevant subsidiary that has an effect on the group’s sustainability impacts, risks or opportunities (Article 29a(4a)).

What comes next?

Omnibus I enters into force on 18 March 2026. Member States must implement the CSRD amendments by 19 March 2027 and the CS3D amendments by 26 July 2028. In Luxembourg, an Omnibus I-aligned implementation law is expected by Q2 or Q3 2026. CS3D compliance applies from July 2029. Companies should monitor national developments and begin aligning their frameworks accordingly.

What should companies do now?

Undertakings below the new thresholds should reassess their compliance plans and consider voluntary reporting as a means of maintaining stakeholder confidence and competitive positioning. Those remaining in scope should prepare for ESRS 2.0 and begin integrating CS3D due diligence requirements into their governance and risk management frameworks ahead of July 2029. Third-country groups should re-evaluate applicability under the revised thresholds and monitor subsidiary- and branch-level obligations.

Author: Sara Garcia