CSRD Omnibus: new thresholds, timeline and who is still in scope

Many mid-sized companies launched a CSRD project in 2024 believing they belonged to "wave 2". The Omnibus package has changed the picture: the mandatory scope now targets very large companies only, but French transposition is not complete and requests for data from customers and banks keep coming. Here is what is settled, what is still pending and what we recommend depending on your size.

Quick answer. The CSRD Omnibus, Directive (EU) 2026/470 published in the EU Official Journal on 26 February 2026, limits the CSRD to companies with more than 1,000 employees and more than €450 million in net turnover. Waves 2 and 3 remain postponed by the "stop the clock" Directive (EU) 2025/794. France must transpose by 19 March 2027.

The CSRD Omnibus directive actually refers to two separate EU texts, adopted ten months apart to simplify the CSRD (Directive (EU) 2022/2464) and the EU due diligence framework (CSDDD). Mixing them up is the first source of error in scope assessments.

The first text is the "stop the clock" Directive (EU) 2025/794 of 14 April 2025, published in the Official Journal on 16 April 2025 and in force the following day. It does not change the substance: it postpones by two years the start date for companies that were due to report for the first time on financial years 2025 or 2026.

The second text is the Omnibus I "content" directive, Directive (EU) 2026/470. The European Parliament voted it on 16 December 2025, the Council gave its final approval on 24 February 2026, it was published in the Official Journal on 26 February 2026 and it entered into force on 18 March 2026. This is the text that redraws the scope.

The new CSRD thresholds cover EU companies and groups that exceed both more than 1,000 employees on average over the financial year and more than €450 million in net turnover, at individual or consolidated level. The two criteria are cumulative: crossing two thresholds out of three is no longer enough.

As a reminder, the former wave 2 covered every "large undertaking" in the accounting sense, meaning one that exceeded two of the following three criteria: 250 employees, €50 million in turnover, €25 million in total assets. A company with 300 employees and €60 million in turnover was in scope; it is now outside the mandatory scope.

Non-EU groups are covered when their net turnover generated in the EU exceeds €450 million and an EU subsidiary or branch generates more than €200 million in turnover. Listed SMEs on a regulated market, which formed wave 3, are removed from the mandatory scope.

The directive also provides a transitional exemption for wave 1 companies (those reporting since financial year 2024) that no longer meet the new criteria, for financial years 2025 and 2026. Whether it applies in France depends on the transposition text.

Our view. The €450 million turnover threshold is the real filter. In mid-sized company files, it is rarely headcount that takes a company out of scope, it is turnover. Run the test at consolidated level and over the last two financial years before drawing a conclusion, especially if the group has recently made an acquisition.

The CSRD has not been abolished but its timeline has shifted: for large companies that remain in scope and did not report in 2025, the first sustainability report covers the financial year starting on or after 1 January 2027 and will be published in 2028. This shift comes from the "stop the clock" directive, which France transposed through Article 7 of Act No. 2025-391 of 30 April 2025.

Wave 1 was never postponed. Public-interest entities with more than 500 employees have been reporting since financial year 2024, with the transitional exemption mentioned above available if they no longer cross the new thresholds.

Reporting standards have been lightened in parallel. On 3 July 2026 the European Commission adopted revised ESRS, which according to the Commission cut mandatory datapoints by more than 60%. They apply to financial years starting on or after 1 January 2027, with early application possible for financial year 2026 once the delegated act has entered into force.

On due diligence, the same Directive (EU) 2026/470 reserves the CSDDD for groups with more than 5,000 employees and more than €1.5 billion in turnover, with application in July 2029 and transposition due by 26 July 2028 at the latest. We cover the cascade effect on suppliers in our article on the DDADUE Act and supply-chain due diligence for SMEs.

French transposition of Omnibus I is not yet complete: the deadline set by Directive (EU) 2026/470 is 19 March 2027 for the CSRD part. Until a French text amends the Commercial Code, existing national law, derived from Ordinance No. 2023-1142 of 6 December 2023 and Act No. 2025-391, remains the legal reference.

The chosen vehicle is a new DDADUE bill (various provisions adapting French law to EU law), presented to the Council of Ministers on 10 November 2025. The Senate adopted it at first reading on 18 February 2026, with amendments that anticipate transposition: higher thresholds, removal of listed SMEs and legal certainty for former wave 1 companies.

At the date of publication of this article, we have not been able to confirm final adoption or promulgation of this text. Check the status of the bill on Légifrance or on the Senate website before any budget decision. This article will be updated at each stage.

The underestimated risk. The gap between EU law and French law is short, but it exists. A mid-sized company with 400 employees is still formally covered by the current French text for financial year 2027 until the transposition act is published. The practical risk is low since transposition must take place before 19 March 2027, but it justifies dating and filing your scope analysis rather than simply deleting the topic from your roadmap.

An SME is not directly subject to the CSRD after the Omnibus: unlisted SMEs never were, and listed SMEs are removed from the mandatory scope. It is, however, still affected indirectly, because its customers, banks and investors keep asking it for sustainability data.

Directive (EU) 2026/470 frames these requests through a "value chain cap": a company subject to the CSRD cannot require a company in its value chain with 1,000 employees or fewer to provide more information than the voluntary reporting standard provides for. According to the Council of the EU, the aim is to limit the trickle-down effect on smaller businesses.

This voluntary standard takes over from the VSME. The Commission had published a recommendation on the VSME on 30 July 2025; on 3 July 2026 it adopted, by delegated act, a voluntary standard based on that recommendation, intended for companies with fewer than 1,000 employees. To put it into practice, our VSME guide for SMEs details the modules and indicators.

Falling outside the mandatory scope does not mean throwing away the work already done. At the firm, we recommend keeping what serves management and funders, and stopping what served only ESRS compliance.

1. Re-run the threshold test at consolidated level, over the last two closed financial years, and keep the dated memo.
2. List the requests you actually receive: customer questionnaires, bank scoring grids, investor due diligence, tenders.
3. Compare these requests with the content of the voluntary standard and identify the gaps.
4. Keep dual-use indicators: energy consumption, scope 1 and 2 emissions, headcount, workplace accidents, training.
5. Suspend purely ESRS workstreams, such as a full double materiality assessment or detailed scope 3 data collection, unless a funder explicitly asks for them.
6. Answer excessive customer requests by pointing to the value chain cap, in writing and tactfully.
7. Schedule a scope review at each year-end closing and at each acquisition.

To structure your answers to key accounts, our article on ESG questionnaires from large customers sets out a method, and the one on banks' ESG requirements covers the financing side.

Points to watch. Three obligations are independent of the CSRD and do not disappear with the Omnibus: the greenhouse gas emissions report above the Environmental Code thresholds, the gender equality index from 50 employees and the economic, social and environmental database (BDESE). What happened to the former non-financial performance statement is covered in our article on the DPEF after the CSRD.

• Average headcount for the financial year calculated at individual and consolidated level
• Consolidated net turnover compared with the €450 million threshold
• Membership of an EU or non-EU group checked
• Listed company or public-interest entity status confirmed
• Scope memo dated, signed and filed
• Status of French transposition checked on Légifrance before each budget decision
• ESG requests received listed and compared with the voluntary standard
• Non-CSRD obligations (GHG report, equality index, BDESE) checked separately

For the general CSRD scope, wave by wave, see our article CSRD: who is affected.

• The CSRD Omnibus rests on two directives: "stop the clock" (EU) 2025/794 for the timeline, (EU) 2026/470 for the scope.
• Only companies with more than 1,000 employees and more than €450 million net turnover remain in the mandatory scope, with a first report in 2028 on financial year 2027.
• Listed SMEs leave the scope; unlisted SMEs were never in it, but are still solicited by their value chain.
• The value chain cap protects companies with 1,000 employees or fewer against requests that go beyond the voluntary standard.
• France must transpose the CSRD part by 19 March 2027 at the latest: check the status of the DDADUE bill before locking in your budget.