CSRD and CSDDD after Omnibus I: Who is still in scope in 2026?

Transitioning from voluntary reporting to mandatory compliance

The CSRD emerged as a mandatory response to the structural limitations of the 2014 Non-Financial Reporting Directive (NFRD). Under the NFRD, approximately 11,700 large public-interest entities were subject to loose non-financial disclosure rules, which resulted in highly fragmented, incomparable, and often superficial ESG data. To address these deficiencies and support the European Green Deal, the European Commission designed the CSRD (Directive (EU) 2022/2464) to integrate sustainability reporting directly into the corporate management report, putting it on par with traditional financial auditing.

The CSRD mandates compliance with the detailed European Sustainability Reporting Standards (ESRS), developed by EFRAG. By expanding the reporting criteria to include all large private undertakings, the directive’s reach was structured to scale up to an estimated 50,000 companies operating within the EU market. The primary objective is to eliminate greenwashing by requiring independent, limited assurance of sustainability disclosures to provide verified, comparable ESG metrics.

Parallel to this disclosure-driven regime, the CSDDD (Directive (EU) 2024/1760) was enacted in May 2024 as an operational governance pillar. While the CSRD mandates transparency, the CSDDD requires concrete action. It obligates in-scope companies to establish robust due diligence processes to identify, prevent, mitigate, and bring to an end adverse impacts on human rights and the environment across their own operations, those of their subsidiaries, and throughout their upstream and specific downstream chains of activities. This dual-track regulatory approach ensures that disclosure and active risk mitigation function as mutually reinforcing mechanisms within the European market.

The updated CSRD scoping and wave structure

As designed, the CSRD applies a phased application schedule, commonly structured across four distinct waves. However, to account for significant high-inflation environments, the European Commission adjusted the underlying financial size thresholds of the Accounting Directive via Delegated Directive (EU) 2023/2775.

To qualify as a "large undertaking" under the revised rules, an entity must exceed at least two of the following three criteria on its balance sheet date:

• Balance sheet total: €25 million (increased from the original €20 million).

• Net turnover: €50 million (increased from the original €40 million).

• Average number of employees: 250 (unchanged).

The finalized, phased implementation timeline for CSRD is organized as follows:

The finalized, phased implementation timeline for CSRD is organized to transition companies systematically into full compliance over four distinct waves.

For non-EU parent companies, Article 40a of the CSRD establishes a consolidated global reporting obligation if the third-country group generates a net turnover of more than €150 million in the EU for each of the last two consecutive financial years, and has either a large EU subsidiary, a listed EU subsidiary, or an EU branch with a net turnover exceeding €40 million. Determining whether a global group triggers these criteria requires an exhaustive, cross-border analysis of group structures and regional revenue allocations, making structured coordination essential.

The finalized CSDDD structure and its planned application

The CSDDD was formally adopted in mid-2024 after intensive legislative negotiations that substantially raised the application thresholds from earlier drafts. Under the final text of Directive (EU) 2024/1760, the directive establishes a phased compliance timetable based on company size and global turnover, applying to both EU-incorporated companies and non-EU companies generating significant revenue within the Union:

• Group 1 (Phased in starting July 26, 2027): Applies to EU companies with more than 5,000 employees and a net worldwide turnover exceeding €1.5 billion, as well as non-EU companies generating more than €1.5 billion in EU net turnover.

• Group 2 (Phased in starting July 26, 2028): Applies to EU companies with more than 3,000 employees and a net worldwide turnover exceeding €900 million, as well as non-EU companies generating more than €900 million in EU net turnover.

• Group 3 (Phased in starting July 26, 2029): Applies to EU companies with more than 1,000 employees and a net worldwide turnover exceeding €450 million, as well as non-EU companies generating more than €450 million in EU net turnover.

• Franchise and Licensing Model Thresholds: Companies that do not meet the standard thresholds but have entered into industrial, franchising, or licensing agreements in the EU in exchange for royalties exceeding €22.5 million are also captured, provided their net global or EU turnover exceeds €80 million.

For in-scope entities, CSDDD demands the operationalization of comprehensive due diligence policies, the implementation of grievance mechanisms, and the establishment of a contractually backed risk-mitigation system throughout their value chain. Because these requirements depend on local national transpositions, multinational organizations face a fragmented compliance environment during the current transposition phase.

Balancing administrative burdens and corporate competitiveness

During late 2023 and early 2024, the European corporate community and several Member States expressed mounting concerns regarding the cumulative administrative and financial burden imposed by the EU’s green transition regulatory package. Business federations warned that overlapping timelines, highly detailed reporting requirements under the initial ESRS drafts, and complex supply-chain traceability mandates under CSDDD could damage the global competitiveness of European enterprises.

In response, the European Commission committed to a broader regulatory streamlining initiative, aiming to reduce corporate reporting obligations by 25% without dismantling the core environmental and social objectives of the Green Deal. This political compromise led directly to two major adjustments: the inflation-indexed adjustment of the Accounting Directive thresholds (which removed thousands of mid-sized entities from the "large" category under CSRD) and the substantial upward revision of CSDDD employee and turnover triggers during final trilogue negotiations.

The Stop-the-Clock Directive and technical postponements

To provide corporate legal and compliance teams with sufficient preparation time, the EU adopted the "Stop-the-Clock" Directive (Directive (EU) 2024/1306) in April 2024. This amending act did not delay the primary reporting timeline for EU companies already in scope of the first or second CSRD waves. Instead, it targeted the development of specialized reporting frameworks.

Specifically, Directive (EU) 2024/1306 postponed the adoption deadline for sector-specific ESRS and the dedicated ESRS for non-EU parent companies (under Article 40a) by two years, shifting the target date from June 30, 2024, to June 30, 2026. This technical delay allows EFRAG to focus on implementing the initial sector-agnostic standards and provides non-EU groups with a more stable, clear set of guidelines before their reporting obligations begin in respect of financial year 2028.

National transposition of the CSDDD across Member States

Following its formal publication in the Official Journal of the European Union, the CSDDD entered into force on July 25, 2024. This initiated a strict two-year window for Member States to transpose the directive into national legislation, with a deadline of July 26, 2026.

In 2026, corporate legal departments find themselves in a complex, fragmented landscape. Because the CSDDD is a directive and not a regulation, Member States maintain flexibility during transposition, resulting in varying domestic definitions of liability and enforcement.

For companies operating in multiple European jurisdictions, this regulatory fragmentation is a major challenge. Assessing compliance against a patchwork of national transposition acts cannot be performed via a single, uniform checklist. It requires a coordinated, multi-jurisdictional approach that links corporate headquarters with local legal specialists who understand the precise statutory requirements of each specific market.

Revised thresholds for EU undertakings

As of 2026, the CSRD's revised financial thresholds are fully in effect across the EU. Large undertakings are no longer defined by the old €40 million turnover and €20 million balance sheet metrics. Instead, the inflation-adjusted limits govern scoping assessments, requiring corporate groups to carefully recalculate their status.

While these raised thresholds have excluded approximately 20% of the companies that would have been captured under the original draft limits, the inclusion of all large private entities still represents a massive expansion of regulatory scope. Companies must monitor these figures over two consecutive financial years to determine if they trigger or fall below the statutory reporting boundaries.

Non-EU parent scoping and the EU turnover threshold

Under Article 40a of the CSRD, the threshold for third-country parent groups remains firmly anchored at an EU-generated net turnover of €150 million. If a global parent group generates more than €150 million within the EU for two consecutive years, it triggers global reporting obligations if it has:

1. At least one subsidiary within the EU that qualifies as a "large undertaking" under the revised €50M/€25M/250-employee criteria, or is a listed SME; or

2. An EU branch that generated a net turnover exceeding €40 million in the preceding financial year.

Under this structure, the ultimate non-EU parent is required to publish a consolidated sustainability report covering the group's global operations, prepared in accordance with the dedicated non-EU ESRS or equivalent standards. If the non-EU parent does not provide this information, the EU subsidiary or branch is legally responsible for obtaining and publishing the report, creating a major corporate risk if information-sharing channels are not established.

Value chain disclosures and limitations on information requests

Recognizing that in-scope companies must report on their upstream and downstream value chains, EFRAG and the European Commission introduced mechanisms to protect smaller suppliers from being overwhelmed by complex data requests.

• Three-Year Value Chain Grace Period: For the first three years of their CSRD reporting, companies may omit detailed value chain metrics if the necessary data is not available, provided they explain their current data-collection limitations and outline their transition plans.

• The Value Chain Cap: Under the ESRS, the data an in-scope company can request from out-of-scope value chain partners is capped. A reporting entity cannot demand more granular data than what is set out in the Simplified Voluntary SME Sustainability Reporting Standard (VSME).

Adjusted implementation timetable across waves

The adjusted, definitive timetable for CSRD implementation is now clear and structured, requiring companies to execute their compliance strategies based on their designated wave:

• Wave 1 (FY 2024 reporting in 2025): Public-interest entities with more than 500 employees that were already subject to the NFRD.

• Wave 2 (FY 2025 reporting in 2026): All other large EU undertakings and parent companies of large groups (exceeding two of the three €50M/€25M/250-employee criteria).

• Wave 3 (FY 2026 reporting in 2027): Listed SMEs (excluding micro-enterprises), small and non-complex credit institutions, and captive insurance undertakings.

• Wave 4 (FY 2028 reporting in 2029): Non-EU parent companies generating more than €150 million in EU turnover, reporting via their large or listed EU subsidiaries or branches.

Expected impact and final CSDDD thresholds

The final text of the CSDDD represents a hard-fought political compromise. The thresholds were substantially increased to target only the largest corporate groups, reducing the number of directly affected EU companies from an estimated 16,000 down to approximately 5,500.

Despite this narrower focus, the CSDDD's systemic impact remains vast. The companies in scope represent the largest actors in key global industries, including energy, agriculture, apparel, financial services, and heavy manufacturing. These "global champions" will pass down their due diligence requirements contractually to their suppliers, meaning that even out-of-scope mid-market companies must prepare to meet CSDDD due diligence and audit expectations to maintain their commercial relationships.

Implementation deadlines and the phased roll-out

The transposition of the CSDDD into national laws by July 26, 2026, initiates a staggered compliance timeline based on corporate size and net turnover:

For non-EU enterprises, the geographic trigger is based solely on net turnover generated within the European Union, rather than headcount. This prevents foreign companies from avoiding compliance by using lean domestic structures or outsourcing their local operations.

Risk-based due diligence and climate transition plans

The CSDDD does not require companies to eliminate all environmental and social risks instantly. Instead, it mandates a proportional, risk-based approach in line with the UN Guiding Principles and OECD Guidelines. Under Article 5, companies must prioritize their due diligence based on the severity and likelihood of potential adverse impacts, focusing their resources where the risks are most significant.

Additionally, Article 22 of the CSDDD retains a key requirement: in-scope companies must adopt and implement a climate change mitigation transition plan. In-scope companies must adopt and implement a climate change mitigation transition plan aligned with the 1.5°C global warming target.

Crucially, to prevent duplicate reporting, Article 22(8) provides that if a company complies with the climate transition plan disclosure requirements under Article 19a or 29a of the CSRD (specifically through ESRS E1-1), it is automatically deemed to have complied with the adoption obligation under the CSDDD. This highlights the close operational link between the two directives.

Civil liability and penalty regimes under national law

Under Article 29 of the CSDDD, Member States must establish a civil liability regime within their national laws. This allows victims (including individuals, trade unions, and civil society organizations) to bring damages claims before national courts for harm caused by a company’s intentional or negligent failure to comply with its due diligence obligations.

Additionally, Member States are responsible for setting up independent supervisory authorities to monitor compliance and issue administrative penalties. Key enforcement aspects include:

• Turnover-Based Fines: Financial penalties must be effective, proportionate, and dissuasive, with the maximum limit set at no less than 5% of the company's net worldwide turnover in the preceding financial year.

• Public Accountability: Regulatory decisions and penalties will be made public ("named and shamed"), creating significant reputational risks.

• Local Variations: Because enforcement is managed at the national level, companies must navigate varying litigation standards and procedural rules across EU Member States.

Overlaps and divergences between CSRD and CSDDD

The CSRD and CSDDD are designed to function as two halves of a single, integrated regulatory framework, but they operate through different legal mechanisms:

• CSRD (Information Lever): This directive is primarily a transparency and reporting tool. It requires companies to disclose how sustainability issues affect their business performance (outside-in perspective) and how their operations impact society and the environment (inside-out perspective)—a framework known as double materiality.

• CSDDD (Action Lever): This directive is an operational and risk-management tool. It mandates that companies actively investigate, monitor, and mitigate adverse impacts within their operations and supply chains.

While a company might report on its supply-chain risks under the CSRD, the CSDDD requires it to actively address those risks through contract adjustments, supplier audits, or, if necessary, responsible disengagement.

Streamlining climate transition planning

The integration of climate transition planning under both directives illustrates how they work together to streamline corporate compliance. Rather than forcing companies to maintain separate strategies, the EU framework aligns the disclosure and action requirements:

• The CSDDD requires the adoption and execution of a climate transition plan (Article 22).

• The CSRD (via ESRS E1-1) requires the detailed disclosure of that plan's metrics, targets, and funding allocations.

By using the CSRD report as the primary compliance filing, companies can avoid duplicative reporting. However, this integrated approach requires close coordination between corporate sustainability offices, risk management teams, and legal departments to ensure that stated climate targets are backed by concrete corporate actions.

Value chain data limits and due diligence reporting

Under the CSRD, in-scope companies must disclose their due diligence policies and actions regarding environmental and human rights issues (specifically under ESRS S1 through S4). For companies also subject to the CSDDD, these disclosures will be driven by the due diligence processes established under the CSDDD.

However, companies must carefully balance these requirements with the value chain cap. When gathering data for their CSRD disclosures, companies cannot demand unlimited information from out-of-scope suppliers; they must respect the limits of the VSME standard. This means companies must design targeted data-collection processes that focus on high-risk areas, rather than using broad, unstandardized questionnaires that place an unnecessary burden on their supply chains.

Practical mapping of the 2026 active perimeter

In 2026, the CSRD has entered its most critical phase of expansion. Large EU private undertakings and parent companies of large groups (Wave 2) are currently collecting and organizing their data for financial year 2025, preparing to publish their first audited, ESRS-compliant disclosures.

At the same time, Wave 1 companies (large PIEs with over 500 employees) are publishing their second round of disclosures, while listed SMEs (Wave 3) are beginning to set up their internal tracking systems ahead of their FY 2026 reporting requirements. Wave 1 companies are currently publishing their second round of disclosures, while listed SMEs begin setting up their internal tracking systems.

For global groups with operations in Europe, 2026 is a key planning year. Even though non-EU parent reporting (under Article 40a) does not begin until financial year 2028, these organizations must use this time to map their regional revenues and determine whether their EU subsidiaries or branches will trigger consolidated global reporting obligations.

Preparing for the CSDDD during the transposition phase

While the first direct compliance wave for CSDDD does not begin until July 2027, 2026 is a critical year for corporate preparation:

1. National Transposition Laws: With the transposition deadline of July 26, 2026, Member States are currently enacting their own national due diligence laws. This creates a fragmented regulatory environment that companies must monitor closely.

2. Contractual Flow-Downs: Large Group 1 companies (with over 5,000 employees and €1.5 billion in turnover) are already updating their supplier codes of conduct and contract templates to prepare for their 2027 deadlines. This means that smaller, out-of-scope suppliers are already facing indirect compliance pressures.

3. Gap Analyses: Companies should use 2026 to conduct thorough gap analyses of their existing due diligence processes, mapping their value chains and identifying potential high-risk areas before formal enforcement begins.

Sectoral and geographic compliance nuances

The practical impact of these directives varies significantly by industry and region:

• High-Risk Sectors: Under the CSDDD, companies operating in resource-intensive or globally extended industries (such as textiles, agriculture, mining, and metal manufacturing) must implement highly detailed supply-chain tracking, as these sectors are more vulnerable to environmental and human rights risks.

• Financial Institutions: The CSDDD applies a tailored scope to regulated financial undertakings, focusing their due diligence obligations on their own operations and upstream value chains, while excluding downstream investment and lending portfolios for now. However, under the CSRD, these institutions must still disclose the climate and social impacts of their investment portfolios, creating a distinct set of compliance challenges.

• Geographic Challenges: Non-EU companies (particularly those based in the US or UK) often underestimate their exposure to these directives. A group may operate through multiple small subsidiaries in Europe, believing it is out of scope, only to find that its combined EU revenue triggers Article 40a of the CSRD or the non-EU thresholds of the CSDDD.

Strategic implications for multinational groups and legal teams

The changes to CSRD and CSDDD thresholds require multinational groups to perform rigorous re-scoping reviews. Organizations cannot rely on general, high-level assessments; they must analyze their corporate structure entity-by-entity to determine precisely which subsidiaries are in scope, when their obligations begin, and how local national laws will apply.

Because Member States are transposing these directives with local variations, managing compliance is a complex, cross-border process problem. A standardized, one-size-fits-all approach is rarely sufficient. Companies must coordinate their central compliance strategies with local legal experts who understand the specific statutory requirements, liability risks, and enforcement landscapes of each individual market.

Integrating corporate functions for unified compliance

To manage these requirements efficiently, companies must break down the traditional walls between corporate legal, compliance, finance, and sustainability departments:

By aligning these teams, companies can ensure that their CSDDD due diligence activities directly support their CSRD disclosures, creating an integrated, audit-ready compliance process that reduces duplication and administrative costs.

Leveraging technology and expert multi-jurisdictional legal coordination

Given the high volume of documents, multi-tiered corporate structures, and varied national laws involved, managing CSRD and CSDDD compliance purely through manual processes is increasingly impractical. Many global organizations are turning to advanced technology to streamline these workflows.

This is where Anywhere.legal provides a vital, operational process solution:

• A Centralized Ecosystem: Anywhere.legal serves as a secure, centralized digital environment specifically designed to coordinate complex, multi-jurisdictional legal and compliance situations. It connects internal corporate teams with a vetted international network of local legal and tax specialists.

• Secure AI Workflow Efficiency: Anywhere.legal provides a vital operational process solution by connecting internal corporate teams with a vetted international network of local legal and tax specialists. Within the platform, secure AI-enabled tools are used to automate time-consuming administrative tasks. These tools can parse corporate organizational charts, analyze large volumes of supplier contracts, perform initial regulatory scoping, and help structure multi-country legal briefs.

• Vetted Human Expert Judgment: Crucially, Anywhere.legal operates on a hybrid model. Secure AI tools are used for initial data processing, scoping, and workflow efficiency, but they never replace definitive human legal judgment. Every AI-assisted analysis and brief is handed over to vetted local experts within the network, who validate the findings, ensure alignment with local national laws, and deliver binding legal opinions.

• Transparent Cost Scoping: By combining AI-driven preparation with a structured network of local specialists, Anywhere.legal provides clear, upfront cost scoping and transparent pricing. This eliminates the unpredictability often associated with traditional, fragmented multi-country legal reviews.

Planning questions for corporate boardrooms

• 1. How do we confirm our precise CSRD and CSDDD status in 2026?
  Perform a formal, consolidated scoping review. Calculate your global and EU-specific revenues and employee headcounts against the adjusted thresholds, and map your corporate structure to identify which specific EU subsidiaries or branches trigger direct obligations.

• 2. What are the immediate risks of ignoring CSDDD transposition in 2026?
  Because Member States are transposing the CSDDD during 2026, companies that wait until formal enforcement begins in 2027 risk falling behind. Early transposition laws may introduce local compliance mandates, and failure to prepare supplier contract updates could disrupt key commercial relationships.

• 3. How can we leverage our CSRD data to simplify CSDDD compliance?
  Align your internal data systems so that the sustainability metrics and value chain information gathered for your CSRD disclosures directly feed into your CSDDD due diligence tracking, ensuring consistency and reducing administrative duplication.

Scenario A: an EU bank with global operations

An EU-headquartered banking group with 40,000 employees and a net worldwide turnover of €20 billion, operating multiple subsidiaries both within the EU and globally.

CSRD Status: Firmly in scope under Wave 1. As a large public-interest entity previously subject to the NFRD, the bank must publish its audited CSRD report in 2026 (for FY 2025) using the full set of sector-agnostic ESRS.

The banking group is in scope under Phase 1 starting in July 2027, as it comfortably exceeds the statutory limits of 5,000 employees and a 1.5 billion euro global turnover.

The bank must integrate its climate transition plan disclosure (under ESRS E1-1) with its due diligence obligations under Article 22 of the CSDDD. Because the CSDDD excludes downstream portfolios for now, the bank’s due diligence will focus on its own operations and upstream service providers, while its CSRD reporting must still cover the broader, downstream impacts of its investment and lending activities.

Scenario B: a mid-sized listed industrial with 600 employees

An EU-incorporated manufacturing company listed on a regulated market, with 600 employees, a net turnover of €48 million, and a balance sheet total of €22 million.

CSRD Status: In scope under Wave 3 (as a listed SME). Because its turnover (€48M) and balance sheet (€22M) fall below the adjusted "large undertaking" thresholds (€50M/€25M), it does not qualify for Wave 2. It must report for FY 2026 (with publication in 2027) using the simplified LSME standards, unless it chooses to exercise its formal opt-out option until FY 2028.

The manufacturing company remains entirely out of scope of direct CSDDD obligations because its corporate size falls below the minimum threshold of 1,000 employees.

Although out of scope of the CSDDD, the company is a key supplier to several large EU industrial groups that are subject to the directive. To maintain these commercial relationships, the company must be prepared to provide basic sustainability metrics and agree to contractual due diligence clauses, leveraging the CSRD's voluntary VSME standard to prevent excessive, non-standardized data demands from its clients.

Scenario C: a US tech multinational with strong EU sales

A US-headquartered technology group with 12,000 employees globally and a total global turnover of €10 billion. In the EU, it generates €200 million in net turnover through two subsidiaries: EU Subsidiary A (a distribution hub generating €180 million) and EU Subsidiary B (a sales office generating €20 million).

CSRD Status: In scope under Wave 4 (Article 40a). The group's combined EU turnover (€200 million) exceeds the €150 million third-country parent threshold, and EU Subsidiary A qualifies as a "large undertaking" under the adjusted €50M/€25M/250-employee criteria. The ultimate US parent must publish a consolidated global sustainability report starting in respect of financial year 2028 (with publication in 2029).

The group is not subject to direct CSDDD due diligence obligations as its EU-generated turnover remains below the 450 million euro threshold.

The group must design a reporting strategy that aligns its US and global sustainability reporting with the European ESRS requirements. Because the US parent is responsible for the global report, the group must establish robust, cross-border data collection channels between its US headquarters and its EU subsidiaries, ensuring that all disclosures are fully verified and audit-ready.

High-value operational risk and solution matrix

To assist corporate compliance officers and legal counsel, the following matrix outlines key operational risks associated with CSRD and CSDDD implementation in 2026, paired with practical, structured process solutions.

Conclusion and next steps

By 2026, the implementation of the CSRD and CSDDD has entered a critical, practical phase. The adoption of inflation-adjusted thresholds and the CSDDD's revised boundaries have focused these directives on the largest corporate actors, but their systemic impact on global value chains remains extensive. For multinational companies, compliance is no longer a future planning exercise; it is an active, cross-border workflow challenge that demands a highly structured operational response.

Success in this environment requires a clear understanding of your precise regulatory scope, the alignment of internal legal and sustainability teams, and the implementation of robust, audit-ready data tracking systems. By combining advanced technology with trusted, human legal expertise, companies can navigate this complex regulatory transition smoothly—ensuring compliance, managing risk, and maintaining their competitive advantage in the European market.

Need international legal help? Get in touch with us via Anywhere.legal.