The Corporate Sustainability Reporting Directive (CSRD) was originally set to require thousands of mid-sized European companies to report on ESG starting with the 2025 financial year, with the first reports due in 2026. Then the Omnibus simplification package landed. The picture in 2026 is materially different from the one anyone was planning for in 2023. This post walks through where things actually stand and what smaller companies still owe.
What CSRD was originally meant to do
CSRD (Directive (EU) 2022/2464) was adopted in late 2022. It expanded EU sustainability reporting requirements from roughly 11000 companies under the older Non-Financial Reporting Directive to an estimated 50000 companies. The reporting standards underpinning it, the European Sustainability Reporting Standards (ESRS), were finalised in 2023 by EFRAG.
The original phasing was four waves:
- Wave 1: Large public-interest companies already covered by NFRD. First reports in 2025 for the 2024 financial year.
- Wave 2: Other large companies meeting two of three thresholds (250+ employees, 50M turnover, 25M balance sheet). First reports in 2026 for FY 2025.
- Wave 3: Listed SMEs. First reports in 2027 for FY 2026, with an opt-out option until 2028.
- Wave 4: Large non-EU parent companies with EU subsidiaries. First reports in 2029.
This is the version most companies prepared for in 2023 and 2024.
What the Omnibus changed
In February 2025, the European Commission published the Omnibus Simplification Package, a wide-ranging proposal to reduce reporting burdens across the CSRD, the Taxonomy Regulation, and CSDDD. Two changes matter most for smaller companies.
“Stop the clock” directive. Directive (EU) 2025/794, adopted in April 2025, postponed waves 2 and 3 by two years. Wave 2 reporting now starts in 2028 for FY 2027. Wave 3 starts in 2029 for FY 2028. The extra time was framed as a chance for companies to align with the revised scope.
Revised scope. A second Omnibus proposal would raise the in-scope threshold from 250 to 1000 employees, taking most of the originally-targeted mid-sized companies out of mandatory reporting entirely. As of mid-2026, the substantive scope changes are still moving through the EU legislative process. The exact final thresholds and timelines may continue to shift before the 2028 reporting date.
CSRD 2026: What this mean for smaller companies
For most smaller companies (under 1000 employees, not listed), the practical answer in 2026 is: no mandatory CSRD reporting this year. The postponement removed the FY 2025 reporting trigger. The scope revision, if adopted as proposed, would remove the obligation entirely for companies with fewer than 1000 employees.
But “no mandatory reporting” is not the same as “no reporting at all”. Three pressures still apply.
1. Trickle-down data requests
Large companies still subject to CSRD (Wave 1) need ESG data from their value chain. They will ask their smaller suppliers to provide it. If you sell to a Wave 1 company, expect a sustainability questionnaire or a request for specific ESG metrics, regardless of your own reporting obligations.
2. Bank and insurer ESG data requests
Banks and insurers are themselves subject to ESG reporting and risk-management rules. Many now ask SME clients for ESG data as part of credit reviews, insurance underwriting and loan applications. This pressure exists independently of CSRD scope changes.
3. Voluntary reporting and the VSME standard
EFRAG published the Voluntary Sustainability Reporting Standard for SMEs (VSME) in late 2024. It is shorter than the full ESRS and is designed for companies outside the mandatory scope. Adopting VSME voluntarily lets a smaller company answer client and bank ESG questions consistently, without committing to the full CSRD framework.
What to do in 2026 if you’re a smaller company
Three practical steps that hold up regardless of how the Omnibus lands:
1. Map who is asking you for ESG data. Make a list of clients, banks, insurers and any other counterparty that has sent a sustainability questionnaire in the last 12 months. This is your real audience for any reporting work, not the EU directly.
2. Start with VSME-light. Pick the handful of metrics most relevant to your business and your sector: energy use, waste, employee count, gender breakdown, and carbon footprint estimate. Track them annually. You can expand later if the scope changes.
3. Document the actions you’re already doing. Most smaller companies already run cleanup days, donate to environmental causes, manage waste sorting and offset emissions through partner programmes. These actions count in ESG reporting if you record them. Keep receipts, photos, and impact reports.
For example, sponsorships through Pick N’ Plant come with a URL impact report that documents kilograms cleaned, trees planted, GPS coordinates and CO2 estimates. See a live example here. The report is the kind of evidence ESG questionnaires ask for.
What to avoid
Two traps. First, don’t over-commit to a reporting framework that may not apply. Some consultancies are still selling full CSRD-readiness packages to companies that are likely out of scope under the revised Omnibus. Read the scope rules before spending.
Second, don’t under-document real action. The companies that come out of this transition well are the ones that have been quietly running cleanups, tracking waste and funding tree planting for years, even without a regulatory trigger. The action came first; the reporting fits around it.
Key takeaways
- The Omnibus simplification package postponed CSRD waves 2 and 3 by two years.
- A proposed scope revision would raise the threshold from 250 to 1000 employees. Status still in flux as of mid-2026.
- Most smaller companies have no mandatory CSRD reporting in 2026, but client and bank ESG requests remain.
- VSME (voluntary SME standard) is the practical framework for smaller companies.
- Document the impact actions you’re already running. They count in any ESG conversation.
Document your impact
If you want to add a documented, ESG-credible action to your 2026 reporting story, the Pick N’ Plant page has the formula and example volumes. The deliverable is a URL impact report you can share with clients, banks, and your own team.
