CSRD and CS3D reviewed: what changes for businesses under the Omnibus I directive

On 26 February 2026, Directive (EU) 2026/470 of the European Parliament and of the Council of 24 February 2026, also known as the Omnibus I Directive, was published in the Official Journal of the European Union. Among other things, it amends the Corporate Sustainability Reporting Directive (“CSRD”) and the Corporate Sustainability Due Diligence Directive (“CS3D”)^[1].

The Omnibus Directive came into force on 18 March 2026. EU Member States must incorporate the Directive's provisions into national law by 19 March 2027, except for those relating to CS3D, which must be implemented by 26 July 2028.

In this Legal Alert we analyse the main changes introduced and their potential impact on businesses.

Changes to the CSRD

Scope of application

The most notable change to the CSRD is the significant reduction in its scope.

• Only companies with an average of more than 1,000 employees and a net turnover exceeding €450 million on the balance sheet date will be required to report on sustainability. These criteria also apply on a consolidated basis to groups.
• Third-country entities with subsidiaries in the European Union are subject to the sustainability reporting obligation if the third-country group generates more than €450 million in turnover within the Union.
• Furthermore, the materiality threshold for relevant subsidiaries and branches to be directly subject to CSRD obligations has been set at €200 million. Combined with the exclusion of listed small and medium-sized enterprises (SMEs) from the mandatory regime, this amendment substantially reduces the scope of mandatory sustainability reporting.

These amendments are particularly significant because they restrict the scope of the CSRD more than is currently the case in Portugal. This is set out in the Portuguese Commercial Companies Code following the transposition of the previous NFRD (Non-Financial Reporting Directive) ^[2]:

• The commercial Companies Code providesthat large public-interest companies with over 500 employees must publish a sustainability report. A company is classified as ‘large’ if it exceeds two of the following three thresholds: (i) balance sheet total: €25 million (ii) net turnover: €50 million (iii) average number of employees: 250.
• However, the now-approved Directive limits the reporting requirement to large companies with a net turnover exceeding €450 million and more than 1,000 employees, regardless of whether they are of public interest. This means that some Portuguese companies that are currently subject to the sustainability reporting obligation will no longer be.

Limiting the knock-on effect

At the same time, the Directive introduces clear safeguards to limit the knock-on effect on suppliers, particularly SMEs:

• The concept of ‘protected entities’ in the value chain is introduced. These are defined as companies with up to 1,000 employees that form part of the value chain of a reporting entity covered by the CSRD.
• Reporting companies are prohibited from requiring these entities to provide information that exceeds the threshold set out in voluntary standards for SMEs. These protected entities now have the right to refuse requests that exceed this threshold.
• During a three-year transitional period from the date on which they become subject to reporting, reporting companies may rely on a self-declaration of size from the supplier and explain gaps, using reasonable estimates to provide information on the value chain.

This simplification also applies to the ESRS (European Sustainability Reporting Standards) themselves. Within six months of the amendments coming into force, the Commission will adopt a delegated act to reform and simplify the first set of ESRS as follows:

• Removing the least relevant data points.
• Prioritising quantitative metrics over descriptive text wherever possible.
• Distinguishing more clearly between mandatory and voluntary requirements.
• The materiality principle is clarified to avoid ‘tick-the-box’ disclosures.

At the same time, authorisation for mandatory sector-specific standards will be removed and the Commission will only be able to issue sector-specific guidance to facilitate implementation. For SMEs and others not subject to mandatory reporting, the Commission will establish voluntary standards based on the 2025 recommendation and the work of EFRAG (European Financial Reporting Advisory Group), featuring simplified language and modularity.

Auditing

In terms of auditing, the adoption of European limited assurance standards is postponed until 1 July 2027 and the obligation for the Commission to transition to a reasonable assurance model by 2028 is removed. In other words, the level of sustainability auditing will not evolve towards a more assurance based regime, at least in terms of legal requirements.

Transposition

Member States must transpose the CSRD amendments by 19 March 2027.

Changes to the CS3D

Scope of application

Under the CS3D, the relaxation of the rules means they now focus on companies that are very large, with thresholds raised to more than 5,000 employees and €1.5 billion in net turnover.

Specific thresholds for groups with franchising or licensing models have also been adjusted. Furthermore, the possibility of exemption for purely financial holding companies has been clarified, provided that a subsidiary in the EU assumes the duties imposed by the CS3D on their behalf.

Due diligence

The due diligence methodology has been made clearer and more proportionate.

• Companies must begin with a ‘scoping’ exercise based solely on reasonably available information. The aim is to identify where potential adverse impacts on the environment and human rights are most likely to occur and be most severe.
• Covered entities must analyse their own operations, those of their subsidiaries, and those of partners where adverse impacts are most likely and severe, where relevant to the chain of activities.
• The in-depth assessment must focus on these priority areas. Where risks are equivalent across various areas, companies may prioritise those involving direct partners.
• Requests for information from partners should be limited to what is necessary and, in the case of partners with fewer than 5,000 employees, should only be made when the information cannot be obtained by other means.

The directive recognises digital solutions and sectoral or multi-stakeholder initiatives as “appropriate resources” for data collection.

Fines

Enforcement will now be based on a harmonised maximum fine equivalent to 3% of a company’s global net turnover. The Commission will also provide future guidance to assist national authorities in determining the appropriate level of fines. The obligation to calculate fines based exclusively on turnover has been removed.

Climate transition plan

The obligation to adopt a climate transition plan under the CS3D is repealed.

Transposition

Transposition is postponed until 26 July 2028, with application to companies postponed until July 2029. By 26 July 2027, the Commission will issue general due diligence guidelines to support implementation.