CSRD after the Omnibus: who has to report and what changes for SMEs
Thresholds, dates and the value chain cap: what the Omnibus Directive provides and why ESG requests to SMEs are not going away.
With Directive (EU) 2026/470, known as the Omnibus, the CSRD applies only to companies that exceed both 1,000 employees and €450 million in net turnover. Most Italian SMEs fall outside the direct obligation, but not outside requests for data: banks and large customers keep asking for it, and those requests now have a precise scope, set by the voluntary VSME standard.
What the Omnibus Directive is
The Omnibus is the simplification package with which the European Union revised the CSRD (Corporate Sustainability Reporting Directive) and the Corporate Sustainability Due Diligence Directive (CSDDD). It was published in the Official Journal of the EU on 26 February 2026 and has been in force since 18 March 2026. Member States must now transpose it into national law.
The stated goal is to reduce administrative burden. According to estimates released during the negotiations, about 80% of the companies originally in scope are no longer subject to the obligation.
Who has to report after the Omnibus
The new scope is based on two thresholds that must both be exceeded, at individual company or group level:
- more than 1,000 employees on average during the financial year;
- more than €450 million in net turnover.
For non-EU groups, what counts is EU turnover above €450 million, with a European subsidiary or branch above €200 million.
| Aspect | Before the Omnibus | After the Omnibus |
|---|---|---|
| Size thresholds | Two out of three criteria: more than 250 employees, €50 million turnover, €25 million total assets | Both: more than 1,000 employees and more than €450 million turnover |
| Listed SMEs | Included, with simplified rules | Outside the obligation |
| Requests to suppliers | No explicit limit | Cap set by the voluntary standard for SMEs |
The new dates
Large companies in the so-called second wave, which were due to start with the 2025 financial year, had already obtained a two-year postponement through the 2025 “stop-the-clock” directive. Those that remain in the new scope report from the 2027 financial year, with the first report published in 2028.
First-wave companies that no longer exceed the new thresholds may benefit from a transitional exemption for the 2025 and 2026 financial years, depending on how each Member State transposes the directive.
In parallel, the Commission simplified the ESRS, the standards that companies in scope must apply, significantly reducing the number of required data points. The new standards apply from the 2027 financial year, with the option to adopt them as early as 2026.
The value chain cap: the VSME becomes the limit
This is the change that affects SMEs most directly. The Omnibus introduces a value chain cap: a company in scope cannot demand from suppliers and customers with fewer than 1,000 employees information beyond what the voluntary standard provides for. The supplier has the right to refuse requests that go further.
The reference standard is derived from the VSME published by EFRAG. The Commission adopted it as a delegated act on 3 July 2026, and the cap applies to value chain requests from the 2027 financial year. In practice, the VSME becomes the maximum measure of what a large customer can ask of you, and also the format in which it makes sense to respond.
What really changes for an SME
For almost all SMEs the obligation does not change: there was none before and there is none now. What changes is the context in which requests arrive:
- banks continue to ask for ESG data to assess creditworthiness, as explained in the guide on ESG and access to credit;
- large customers that remain within the CSRD scope must collect data from their value chain, starting with Scope 3 emissions;
- public tenders reward those who document environmental criteria;
- the limit of what they can ask of you now has a precise name: the VSME.
The practical consequence: if you have an up-to-date VSME report, you can answer almost every request with the same document. If you don’t, you risk filling in a different questionnaire for each counterpart, as happens with bank ESG questionnaires.
What to do now
- Check your position. Count average employees and turnover at group level: if you are below the thresholds, the CSRD obligation does not apply to you.
- Map who asks you for data. Banks, lead customers in your supply chain, contracting authorities: note what they ask for and by when.
- Prepare the VSME Basic module. It covers energy, emissions, waste, water, workforce and business conduct, which is the core of almost every request.
- Start from the documents you already have. Utility bills, fuel invoices, FIR and HR data contain most of the numbers you need.
- Respond with the report, not the questionnaire. When a request goes beyond the scope of the VSME, you can now say so with a legal basis.
The Omnibus reduces the number of companies subject to the CSRD, not the demand for ESG data. For an SME, the most efficient move is to have a VSME report ready: it is the format large customers can ask for and the limit beyond which they cannot go.
