CSDDD & CSRD after the Omnibus: what really applies in 2026

What are the CSRD and the CSDDD?

The CSRD (Corporate Sustainability Reporting Directive, Directive (EU) 2022/2464) is the EU directive on sustainability reporting: large companies must report on environmental, social and governance matters according to uniform standards (ESRS). The CSDDD (Corporate Sustainability Due Diligence Directive, Directive (EU) 2024/1760) is the EU supply chain directive: very large companies must identify, prevent and remedy human rights and environmental risks in their chains of activities. Both were significantly narrowed by the Omnibus I Directive (EU) 2026/470, in force since 18 March 2026.

The core message for the mid-market: this probably does not affect you directly. Your corporate customers, yes. And they pass it down.

Who is affected?

CSRD (reporting), after the Omnibus:

• Companies with more than 1,000 employees and more than €450 million net turnover. Previously the obligation applied from 250 employees; according to the Commission’s estimate, around 80 % of the originally covered companies drop out.
• Not affected: everyone else, including listed SMEs that were due to report from 2026.

CSDDD (due diligence), after the Omnibus:

• Companies with more than 5,000 employees and more than €1.5 billion worldwide net turnover (previously 1,000 employees and €450 million). The Commission expects around 6,000 instead of around 13,000 companies EU-wide.
• Not affected: the entire mid-market. EU-wide civil liability and the obligation to adopt a climate transition plan were deleted.

Indirectly affected: suppliers of the obliged companies. The CSDDD requires corporations to include their direct business partners and, where there are plausible indications, to look deeper into the chain. For you that means: sign the code of conduct, complete the self-assessment, deliver evidence, possibly allow audits. The directive protects smaller business partners: obliged companies should only request information from them that is genuinely needed beyond the voluntary reporting standard, and bear the cost of independent verification at SMEs.

What applies from when?

Germany had not transposed the original CSRD in time; the transposition act is now being aligned with the Omnibus version. Until then, German companies remain under the Commercial Code (HGB) with the existing non-financial statement.

Which concrete obligations arise?

For companies directly in scope:

1. CSRD: sustainability report in the management report according to ESRS 2.0, materiality assessment, external limited assurance, digital tagging.
2. CSDDD: risk analysis of the chain of activities, prevention and remediation measures, complaints procedure, effectiveness monitoring, public reporting. Supervision by national authorities with turnover-based fines.

For the mid-market as supplier:

1. Be able to answer requests: self-assessments on human rights, working conditions, environment, code of conduct, grievance mechanism.
2. Hold evidence: certificates, policies, audit results, incidents and how they were handled.
3. Know your own supply chain: because corporations dig deeper when there are indications, and you need the answer from your suppliers.
4. Know the limits: what customers may request from suppliers with up to 1,000 employees for their CSRD reports from financial year 2027 is capped by the Value Chain Cap of the voluntary standard VS.

Common misconceptions

• Reacting to old thresholds. Many companies started CSRD projects in 2024 and 2025 because they would have been in scope from 250 employees. That obligation is gone. Anyone reporting voluntarily should use the VS, not the full ESRS.
• Filling in corporate questionnaires unchecked. Customers often ask for data they may no longer request. The Value Chain Cap gives you the right to decline excessive requests.
• Writing off the CSDDD. It arrives in 2029 for the corporations. Their procurement departments are preparing supplier processes now. The cascade starts before the obligation.
• Dismissing ESRS 2.0 as minor. The standard was heavily simplified, but materiality assessment, value chain disclosures and assurance remain. Suppliers delivering data should know which data points are left.

How SCRM Guard helps

The CSRD/CSDDD radar on the platform shows you which of your customers fall under the obligations and which requests are justified. Your self-assessments, code of conduct confirmations, certificates and incidents sit structured in one place, so you answer customer questionnaires from the system instead of collecting anew each time. For your own supply chain, event monitoring delivers the indications corporations expect from you.

In the full service we answer customer requests with you, build the evidence folder and keep you informed about changes to thresholds, standards and deadlines. And we tell you which requests you may decline.

Sources

• Directive (EU) 2026/470 (Omnibus I), Official Journal of the EU (26 Feb 2026)
• Directive (EU) 2024/1760 (CSDDD), EUR-Lex (05 Jul 2024)
• European Commission: CSRD delegated acts (ESRS 2.0, C(2026) 5010) (03 Jul 2026)

This page is an editorial briefing for procurement and compliance teams in mid-sized companies, not legal advice. We check deadlines and thresholds against primary sources; the review date is shown at the top of the page.