Post-Omnibus: Who Still Has to Report Under CSRD in 2027 (and Who Just Got a Customer Instead of a Regulator)

If your company got a CSRD engagement letter from its auditor back in 2024, it's natural to assume that obligation just keeps rolling forward. For a lot of companies, it doesn't. The Omnibus I Directive rewrote CSRD scope from the ground up, and for many businesses the practical result isn't "you're free of ESG reporting" — it's "you now answer to a customer instead of a regulator."

This article works through exactly who is still required to report under CSRD from 2027, who has dropped out, what happens if you were already reporting, and — the part that actually matters day to day — what replaces the obligation for companies that exit scope but still sell to, borrow from, or supply companies that stay in it.

What Changed: Omnibus I in One Paragraph

The Omnibus I Directive entered into force on 18 March 2026. Among other changes, it replaced CSRD's old tiered rollout — separate thresholds and start dates for different sizes and types of company — with a single, higher threshold that determines who reports, and it pushed the whole timeline back so the new rules take effect for financial years beginning on or after 1 January 2027. A separate, earlier "stop the clock" mechanism had already paused the rollout for companies due to start reporting in 2026 and 2027, before Omnibus I then permanently removed most of them from scope altogether.

The Old Wave System, Briefly

Before Omnibus I, CSRD phased in by company type and size, roughly like this:

• Wave 1 — large public-interest entities (listed companies, banks, insurers) with more than 500 employees, already reporting since financial year 2024.
• Wave 2 — other large undertakings meeting at least two of: more than 250 employees, €50 million net turnover, or €25 million balance sheet total, originally due to start with financial year 2025, then delayed to financial year 2027 under the stop-the-clock mechanism.
• Wave 3 — listed SMEs and certain small financial undertakings, originally due to start with financial year 2026, delayed to financial year 2028.
• Wave 4 — non-EU companies generating more than €150 million turnover in the EU with an EU subsidiary or branch generating more than €40 million turnover.

That wave structure is now gone. Omnibus I replaced it with one unified test.

Is My Company Still in Scope? The New CSRD 1,000-Employee Threshold

From financial years beginning on or after 1 January 2027 — meaning the first reports under the new rules are filed in 2028 — CSRD applies only to:

• EU undertakings with more than 1,000 employees on average and net annual turnover above €450 million — both conditions have to be met, regardless of whether the company is listed, a bank, an insurer, or otherwise classed as a public-interest entity.
• Non-EU companies generating more than €450 million turnover in the EU, provided they also have an EU subsidiary or branch generating more than €200 million turnover.

Listed SMEs and financial holding undertakings are fully exempt from CSRD under the new rules, regardless of size — the old wave 3 category has effectively been eliminated rather than just delayed. Estimates of the scope reduction vary by source, but several put it at somewhere between 80% and 90% of previously in-scope companies — one detailed estimate puts the number of companies leaving CSRD scope at roughly 42,000.

One timing detail worth being precise about, since it's the exact kind of thing people get wrong: "2027" here refers to the financial year the new rules first apply to, not the calendar year the reports get published. A company with a calendar-year financial year that's newly out of scope stops being required to report starting with its FY2027 report — which, if it were still in scope, would be filed in 2028. If your company reports on a non-calendar financial year, the same “beginning on or after 1 January 2027” rule applies to when that year starts, not the calendar year it ends in.

What Happens If You Were Already Reporting (Wave 1) and Now Fall Below the Threshold

If your company has been filing CSRD reports since FY2024 as a large public-interest entity, but doesn't clear the new 1,000-employee and €450 million turnover bar, you don't exit immediately. The general rule is that these companies continue reporting under the existing CSRD/ESRS requirements — with the various "quick fix" reliefs Omnibus I also introduced — for FY2025 and FY2026, meaning reports filed in 2026 and 2027. The obligation then lifts starting with FY2027, filed in 2028, once the new scope rules take over.

There's one variable worth checking locally: Omnibus I allows individual EU Member States to grant an earlier, optional transitional exemption covering FY2025–2026 for companies that fall out of scope under the new thresholds. This isn't automatic or EU-wide — it depends on whether your Member State has chosen to legislate it, so if you're a borderline Wave 1 company, it's worth asking your auditor or checking your national transposition of the directive rather than assuming either outcome.

You Just Got a Customer Instead of a Regulator

Here is the part that matters most in practice: falling out of CSRD scope does not mean sustainability data requests stop arriving. If you supply, borrow from, or otherwise do business with a company that stays in CSRD scope, that company still needs value-chain sustainability data from you to complete its own reporting — the request just moves from a legal reporting mandate you owe a regulator, to a commercial request from a customer or lender.

That shift is not unregulated, though. The same Omnibus I reform that redrew CSRD scope also introduced the value chain cap, which limits exactly what a CSRD-obligated customer or bank can ask a smaller counterparty for — in practice, a ceiling defined by the VSME standard's "necessary" disclosures. We cover that mechanism in detail, including the specific carve-outs where a customer can still ask for more, in our guide to the VSME value chain cap, and the full list of what that ceiling actually contains, data point by data point, is in our VSME Basic Module guide.

In other words: exiting CSRD scope trades an open-ended regulatory obligation for a capped, standardised one. That's usually a meaningfully smaller lift — the VSME Basic Module is built to be proportionate for exactly this situation — but it's not nothing, and companies that treat it as nothing tend to be the ones scrambling when the first post-Omnibus customer questionnaire actually lands.

A Quick Gut-Check: Do You Still Have to Report in 2027?

Run through these in order:

• 1. Are you an EU-incorporated undertaking? If not, check the non-EU test instead (more than €450 million EU turnover, with an EU subsidiary or branch above €200 million turnover).
• 2. Does your undertaking average more than 1,000 employees? If no, you're out of scope from FY2027, subject to the Wave 1 transition rules above if you were already reporting.
• 3. Is your net annual turnover above €450 million? Both this and the employee threshold have to be true — falling short on either one takes you out of scope.
• 4. Are you a listed SME or financial holding undertaking? If so, you're exempt regardless of size under the new rules.
• 5. If you answered yes to the relevant employee and turnover thresholds: you're still in scope. If you were already reporting, that continues without a gap; if you're newly crossing the threshold, your first report under the new rules covers FY2027, filed in 2028.

If step 2 or 3 took you out of scope, the practical next step isn't to close the file — it's to check whether any of your customers or lenders are still in scope, since a bank assessing non-financial risk or a large customer building its own value-chain disclosures may still come asking, just through the capped, VSME-based channel rather than a regulatory one. Our guide to responding when customers demand supplier sustainability data and our introduction to the VSME standard cover what to do when that request actually arrives.

Sustainly's VSME workflow is built for exactly this handoff — companies that no longer face a CSRD deadline but still need a credible, reusable answer for the customers and banks that do.