CSRD Omnibus 2026: What the EU Reform Changes for SMEs
4 min Read Time
On 18 March 2026, the EU Omnibus Amending Directive entered into force. It reduces the number of companies subject to the Corporate Sustainability Reporting Directive (CSRD) across Europe – from roughly 50,000 to approximately 5,000. For German SMEs, this means: Companies with fewer than 1,000 employees or less than €450 million in annual revenue are exempt from mandatory sustainability reporting. At the same time, a new protective shield emerges for SMEs in supply chains.
The Key Takeaways
- The EU Omnibus Directive (Directive 2026/470) entered into force on 18 March 2026. Around 90 percent of companies previously subject to CSRD reporting fall outside its scope (EUR-Lex).
- New thresholds: Only companies with more than 1,000 employees and more than €450 million in net turnover must report (cumulative, not alternative).
- New SME protection: Companies with fewer than 1,000 employees may lawfully reject ESG data requests that exceed the voluntary VSME Standard (supply-chain protection).
- 🇩🇪 Germany has until 19 March 2027 to transpose the rules into national law. The original CSRD transposition was already overdue (deadline was July 2024).
- The CSDDD (Corporate Sustainability Due Diligence Directive) has also been revised: New threshold is 5,000 employees and €1.5 billion in turnover. Roughly 70 percent fewer companies are now affected.
What the Omnibus Directive Changes
Directive 2026/470 was published in the EU Official Journal on 26 February 2026 and entered into force 20 days later. It reflects a political course correction: The European Commission recognized that the original CSRD framework placed disproportionate burdens on SMEs. The Federation of German Industries (BDI) called it a “once-in-a-generation opportunity” for targeted reform.
The numbers speak clearly. Before reform, around 50,000 companies across Europe were required to report – approximately 15,000 in Germany alone. Under the Omnibus Directive, that number shrinks to roughly 5,000 EU-wide. Industry estimates suggest around 1,500 German companies will remain in scope – a 90 percent reduction.
The New Thresholds in Detail
The pivotal change concerns the reporting thresholds. Previously, a tiered system applied: Wave 1 covered listed companies with over 500 employees; Wave 2, large enterprises; and Wave 3, capital-market-oriented SMEs. The Omnibus Directive replaces this with a single, cumulative threshold.
Reporting is now mandatory only if both criteria are met simultaneously: more than 1,000 employees on average per year and more than €450 million in net turnover. A company with 2,000 employees but only €300 million in turnover falls outside the scope. A company with €800 million in turnover but only 500 employees does not qualify either. The “AND” linkage is decisive.
Wave 3 – for capital-market-oriented SMEs – has been fully abolished. For parent companies headquartered in third countries, the threshold is set at more than €450 million in net turnover generated within the EU in each of the last two financial years.
The VSME Standard: A Protective Shield for SMEs
The Omnibus Directive introduces a novel protection concept: supply-chain safeguards. Companies with fewer than 1,000 employees are classified as “protected entities.” They hold a legally enshrined right to reject ESG data requests that exceed the voluntary VSME Standard.
The Voluntary SME Standard (VSME), developed by the European Financial Reporting Advisory Group (EFRAG), comprises around 100 data points across two modules: a core module covering fundamental ESG disclosures, and an extension module for sector-specific supplementary information. By comparison, the full European Sustainability Reporting Standards (ESRS) contain over 1,000 data points.
In practice, this means: If a major corporation asks its supplier – with 300 employees – to complete a comprehensive ESG questionnaire containing 500 data points, the supplier may lawfully decline the request. The supplier must comply only with the VSME Standard. The corporation cannot claim contractual breach.
„Now that the European Parliament has adopted its position, it is crucial that the relief principle be consistently pursued in the upcoming trilogue negotiations. Europe needs a practical, proportionate solution.”
Achim Dercks, Deputy Managing Director, DIHK (April 2025)
CSDDD: The Supply Chain Due Diligence Directive Is Also Softened
The Omnibus Directive reforms not only the CSRD but also the Corporate Sustainability Due Diligence Directive (CSDDD). The revised thresholds are: more than 5,000 employees and more than €1.5 billion in annual turnover. Previously, the thresholds stood at 1,000 employees and €450 million.
Three key obligations have been eliminated: the requirement to publish a climate transition plan, the EU-wide civil liability regime, and the obligation to terminate business relationships as a last resort. The maximum fine has been reduced from 5% to 3% of global net turnover. CSDDD compliance will apply only from financial year 2030 onward.
For SMEs, this means double relief: Neither direct CSRD reporting obligations nor CSDDD due diligence duties apply to companies falling below the new thresholds. Germany’s national Supply Chain Act (LkSG) will accordingly need to be amended.
Timeline: When Do What Rules Apply?
The transition period is complex. Here are the key dates relevant to German companies:
Effective immediately (since 18 March 2026): The Omnibus Directive is binding EU law – but still requires national transposition. Until then, existing German law formally remains in force. However, the “Stop-the-Clock” Directive of April 2025 had already postponed all deadlines by two years. Consultants advise affected companies falling below the new thresholds to defer sustainability reporting for now.
By 18 September 2026: The European Commission must adopt revised European Sustainability Reporting Standards (ESRS) as a delegated act. Data points are expected to shrink by at least 57%.
By 19 March 2027: Germany must transpose the CSRD provisions into national law. To date, Germany has failed to implement the original CSRD on time (deadline: July 2024). With the Omnibus reform, the federal government gains a second chance to draft an adapted bill.
Financial year 2027: First reporting obligation under the new regime – for companies still within scope. Reports will be due in 2028.
By 26 July 2028: Deadline for national transposition of the CSDDD amendments. Compliance date for companies: July 2029. First CSDDD reports: from financial year 2030.
Checklist: What SMEs Should Do Now
The Omnibus reform brings relief – but still demands action. These five steps help clarify next steps:
- Review thresholds: Do you have more than 1,000 employees and more than €450 million in turnover? Only if both apply do CSRD obligations persist. Assess at both individual and group level.
- Evaluate ongoing ESG projects: If you fall below the thresholds, reassess whether existing reporting initiatives remain necessary. Voluntary reporting under the VSME Standard can still make strategic sense – especially for firms serving international customers.
- Familiarize yourself with the VSME Standard: VSME is becoming the de facto standard for supplier disclosures. With ~100 modular data points, proactively adopting it signals professionalism to major customers.
- Scrutinize ESG questionnaires critically: If a major customer requests data beyond the VSME scope, you now hold a legal right to refuse. You no longer need to complete proprietary ESG questionnaires with 500 data points.
- Monitor national implementation: The federal government has until March 2027. Until then, prior law formally applies – but the “Stop-the-Clock” Directive has already shifted practical deadlines.
Conclusion: Relief – Yes. Green Light – No
The Omnibus reform marks the largest course correction in European sustainability regulation since the CSRD’s adoption. A 90% reduction in affected companies, a statutory shield for SMEs, and scrapped liability rules under the CSDDD – all represent genuine relief for SMEs.
But relief is not a green light. ESG requirements won’t vanish – they’ll simply become more proportionate. Major customers, banks, and investors will continue demanding sustainability data. The difference? Now there’s a legal framework preventing SMEs from becoming unpaid data suppliers to corporations. The VSME Standard is that framework. Those who know it hold a competitive advantage.
Frequently Asked Questions
As a company with 500 employees, am I still subject to CSRD reporting?
No – provided you do not also generate more than €450 million in net turnover. The Omnibus Directive (Directive 2026/470) mandates that both criteria be met cumulatively: more than 1,000 employees and more than €450 million in turnover.
What is the VSME Standard – and must I apply it?
The Voluntary SME Standard is a voluntary sustainability reporting framework developed by EFRAG, comprising ~100 data points. You are not required to apply it. But it serves a protective function: If a major customer requests ESG data beyond the VSME scope, you may lawfully reject the request.
What happens to Germany’s Supply Chain Act (LkSG)?
The LkSG will need revision once Germany transposes the CSDDD amendments (deadline: July 2028). CSDDD thresholds rise to 5,000 employees and €1.5 billion in turnover. The maximum fine drops from 5% to 3% of global net turnover.
When does the new law take effect in Germany?
The EU Directive has been in force since 18 March 2026 – but still requires national transposition. Germany has until 19 March 2027. Meanwhile, the “Stop-the-Clock” Directive has already pushed practical reporting deadlines back by two years.
Should I still report voluntarily?
If you supply CSRD-reporting corporations or rely on bank financing tied to ESG criteria, voluntary reporting under the VSME Standard makes sense. Effort remains manageable (~100 data points versus >1,000). For purely regional B2B firms, priority is lower.
Further Reading
- CSRD Reporting Obligation: What the CFO Needs to Know Now – Strategic CFO Perspective (Digital Chiefs)
- DORA and NIS2 Simultaneously: Regulatory Double Burden – Regulatory Context (SecurityToday)
- Data Governance in SMEs: Practical Review of the DGG – Related Governance Topics (MyBusinessFuture)
More from the MBF Media Network
- Sovereignty-Washing: Why EU Data Centres Don’t Guarantee Data Sovereignty – Cloud Regulation Today (cloudmagazin)
- NIS2 in Germany: What Companies Need to Know – Compliance Overview (SecurityToday)
Header Image Source: Jack Sparrow / Pexels
