If you are trying to understand where you stand with the CSRD, the honest starting point is this: almost everything you may have read about it before 2025 has changed, and almost everything written about it in the last twelve months risks oversimplifying what those changes mean.

Yes, the scope has been dramatically narrowed. Yes, reporting timelines have been pushed back. Yes, the disclosure standards themselves have been gutted and rebuilt — roughly two-thirds lighter than originally drafted. But the conclusion that many boards have drawn — CSRD is dead, stand down — is not merely wrong. It is the single most expensive misreading of the current European regulatory landscape available.

Here is the reality. The CSRD remains the most comprehensive mandatory sustainability reporting regime in the world. Wave 1 companies are already reporting under it, with their disclosures sitting inside audited management reports, digitally tagged, and subject to independent assurance. Double materiality — the framework's intellectual core — survived the political storm untouched. And the majority of large companies that were preparing for first reports in 2026 now report in 2028 instead, which converts a compliance panic into a genuine strategic gift for anyone paying attention.

This guide covers what the CSRD is, how the Omnibus package rewrote it, who reports and when, what survived the cuts, what the changes mean for value chains and non-EU businesses, and — as with our ASRS guide — why handing your sustainability reporting process to a general-purpose AI tool is a shortcut with a bad ending, and what the correct operating model looks like instead.

Part 1: What the CSRD Actually Is

The legislative foundation

The Corporate Sustainability Reporting Directive (CSRD) entered into force in January 2023, replacing the Non-Financial Reporting Directive (NFRD). Where NFRD covered roughly 11,700 large EU companies with broad-brush reporting requirements, the CSRD was designed to extend rigorous, standardised, assured sustainability reporting to as many as 50,000 companies worldwide once fully phased in — including non-EU groups with significant European operations.

The architecture has two layers:

• The CSRD itself — the directive, which establishes who must report, where the information sits (inside the annual management report, not a separate voluntary brochure), the assurance requirement, and the digital tagging obligation.

• The European Sustainability Reporting Standards (ESRS) — the delegated regulation that specifies what must be reported, developed by EFRAG. The first set, adopted as Commission Delegated Regulation (EU) 2023/2772, comprises cross-cutting standards (ESRS 1 General Requirements and ESRS 2 General Disclosures) plus topical standards covering climate (E1), pollution, water, biodiversity, resource use, workforce, value chain workers, communities, consumers, and business conduct.

The ESRS are legally binding technical standards, not guidance. They specify exact datapoints, disclosure structures, and presentation requirements. Because they live in a delegated regulation rather than a directive, they take effect directly across all Member States once adopted — a detail that matters for planning, because there is no per-country divergence on the standards themselves, only on transposition and sanctions.

Three design features distinguish the CSRD from everything that preceded it:

1. Double materiality. Companies must assess every sustainability topic through two lenses: impact materiality (how the company's activities affect people and the environment) and financial materiality (how sustainability risks and opportunities affect the company's financial position, performance, and cash flows). A topic requires disclosure if it is material under either lens. This is a genuinely different intellectual framework from pure financial reporting — and, as we shall see, it is the part of the CSRD that politics could not touch.

2. Assured reporting. Sustainability information must be subject to limited assurance by an independent auditor from the first year of application — the same assurance concept that applies to a company's financial statements, albeit at a lower intensity for now. The sustainability statement is not marketing collateral. It is audited narrative.

3. Digital tagging. Disclosures must be prepared in a structured electronic format (XBRL tagging), machine-readable, and published within the management report. Sustainability data has entered the structured-data supply chain — which changes what "good reporting" means from an editorial exercise to a data engineering discipline.

The catch: jurisdiction by jurisdiction enforcement

The CSRD is a directive, meaning it requires transposition into national law by each Member State — with Member States holding discretion over sanctions. Enforcement intensity, penalty regimes, and supervision vary meaningfully between Berlin, Paris, Amsterdam, and Warsaw. Member States must transpose the Omnibus I amendments into national law by March 2027, and progress across the 27 Member States is uneven. For multinational groups, that means the practical compliance picture is a patchwork, not a monolith.

Part 2: The Omnibus Overhaul — What Actually Changed

Understanding CSRD in 2026 requires understanding the Omnibus I package, the European Commission's simplification initiative proposed in February 2025 and now enacted law. The timeline runs:

• February 2025: The Commission proposes the Omnibus package to simplify the CSRD, the Corporate Sustainability Due Diligence Directive (CSDDD), and the EU Taxonomy.

• April 2025: The "Stop-the-Clock" Directive is adopted, postponing CSRD reporting by two years for Wave 2 companies (first reports moved from 2026 to 2028, covering FY2027) and for Wave 3.

• July 2025: The Commission adopts "Quick Fix" amendments to the ESRS, letting Wave 1 reporters that began with FY2024 hold the line on their 2024-level reporting for FY2025 and FY2026, rather than ratchet up.

• December 2025: The European Parliament approves the Omnibus I package.

• February–March 2026: The Omnibus directive is published in the Official Journal and enters into force in mid-March 2026, with Member State transposition due by March 2027.

The Omnibus is contested terrain — supporters in the Commission frame it as competitiveness-driven burden reduction; critics, including NGOs and trade unions, call it a deregulatory rollback. Both readings agree on the mechanics. Four changes matter most:

1. Scope: dramatically narrowed

Under the revised CSRD, mandatory reporting now applies only to undertakings exceeding both:

• more than 1,000 employees, and

• more than €450 million in net turnover.

The original CSRD's staged waves of listed SMEs, smaller non-EU groups, and mid-sized companies have fallen away. Analyses of the final thresholds suggest that roughly 90% of the companies originally expected to come into scope fall out of it — with mandatory reporting now concentrated on the largest European undertakings, estimated at somewhere around 7,000–10,000 companies rather than 50,000.

2. Timelines: two years of runway — then convergence

For non-EU groups — including, notably, US-headquartered multinationals — the revised threshold requires more than €450 million in net EU turnover plus an in-scope EU subsidiary or an EU branch above the prescribed turnover level, with first reporting due in 2029 on FY2028 data under the dedicated N-ESRS standards, which are being developed by EFRAG to mirror the simplified ESRS.

3. The ESRS: simplified, substantially

EFRAG was tasked with rewriting the standards themselves. The resulting Simplified ESRS — the "ESRS 2026" revision — delivers:

• a ~61% reduction in mandatory datapoints (from roughly 1,100 to approximately 430);

• the elimination of voluntary datapoints altogether — around 70% of total datapoints removed;

• all topical disclosures, including climate (E1), now fully subject to materiality — removing the original rule that climate disclosures were mandatory regardless of the materiality assessment;

• deletion of the sector-specific ESRS mandate;

• relaxed value chain data requirements, with companies no longer required to obtain direct primary data from smaller counterparties where the value-chain cap applies;

• a subtle but consequential philosophical shift: reporting designed around material, decision-useful information rather than mechanical compliance completeness.

The Simplified ESRS apply to FY2027 (first reports in 2028), with optional early adoption for FY2026. The Commission was required to finalise the delegated act during 2026 — with the standards now locked or in final stages depending on when you read this — meaning in-scope companies can now plan against a settled technical framework.

4. Assurance: capped at limited — indefinitely

The original CSRD envisaged a migration from limited assurance to reasonable assurance over time. The Omnibus removed that escalator. Limited assurance remains mandatory from the first year of reporting, and the Commission is directed to adopt the limited assurance standards by July 2027 — with no transition to reasonable assurance in the revised framework. Your sustainability statement will be assured, but the ceiling is now defined.

What did not change

Strip away the noise, and the load-bearing structure is intact:

• Double materiality is fully mandatory — the Omnibus preserved it as the methodological core of the regime.

• Disclosure obligations, governance expectations, and assurance persist for in-scope companies.

• Digital tagging (XBRL) preparation is still required.

• The reporting sits in the management report, carrying directors' responsibility.

• Capital markets still demand decision-useful sustainability data — European investors, banks, and counterparties built their data infrastructure around CSRD formats and are not unwinding it because the scope narrowed.

As the more sober post-Omnibus analyses put it: the simplification changes the how, not the why. It does not repeal the regime; it concentrates it.

Part 3: What This Means for Your Business — Four Postures

The smart way to read your position is by posture, not by nationality.

If you are Wave 1 — already reporting

You are through the worst of it, but you are not coasting. The Quick Fix relief that held your requirements at FY2024 levels for FY2025 and FY2026 expires. When the Simplified ESRS bite for FY2027, your reporting must be re-mapped onto the revised standards — which, counterintuitively, involves real work, because the datapoints that survive are the ones your assurance provider will scrutinise hardest. Meanwhile, some Wave 1 entities that fall beneath the new thresholds may benefit from transitional exemptions for FY2025–2026 depending on Member State choices — worth confirming rather than assuming.

If you are former Wave 2 — the 2028 cohort

You gained two years, and the intelligent use of them is not to pause. Use 2026 as the planning year it has become: confirm your final scoping under the 1,000-employee / €450m thresholds, refresh or conduct your double materiality assessment against EFRAG's implementation guidance, and migrate your data infrastructure from spreadsheets to a governed platform before the assurance clock starts. The companies that treated Stop-the-Clock as a gift of preparation time rather than an invitation to forget will report in 2028 smoothly, and will have spent 2026 and 2027 turning the exercise into strategic intelligence rather than a scramble.

If you fell out of scope — the 90%

You are out of mandatory scope. You are not out of scope. Three forces still pull you toward CSRD-grade data:

1. Commercial pressure from in-scope customers. Your largest customers — the ones that remain in scope — still need value chain data from you to complete their own disclosures.

2. Banks and investors. European lenders and asset managers built CSRD-aligned data expectations into credit and investment processes that do not reset with the directive's scope.

3. The voluntary route. For SMEs facing data requests, the VSME (Voluntary SME standard) provides a proportionate format — and critically, the Omnibus capped what in-scope companies can demand from smaller value chain partners at the VSME's scope. You cannot be asked for the world; but you will be asked for something, and having a credible answer is a commercial advantage.

Choosing to build CSRD-compatible data capability now, voluntarily, is the contrarian-but-correct read of the situation: the regulatory trigger softened, the market trigger did not.

If you are a non-EU parent group

Pay close attention. The N-ESRS track, aligned to the simplified ESRS, is being built for you, with first reporting due in 2029 on FY2028 data for groups above the EU turnover thresholds with qualifying subsidiaries or branches. The design work, data consolidation, and governance establishment that a 2029 deadline requires starts well before the standards are final. Multinationals with meaningful EU revenue should be mapping entity-level data flows against the expected N-ESRS architecture now.

Part 4: What Your Report Actually Requires

Even in simplified form, the core CSRD reporting workflow is substantive. Four elements deserve particular attention from preparers and boards:

The double materiality assessment (DMA). This is the regime's gatekeeping exercise, and the Omnibus left it standing while deleting much around it. Under EFRAG's implementation guidance, the DMA is a documented, evidenced, four-step process: understanding the context, identifying impacts, risks and opportunities (IROs), assessing them from both lenses, and determining which topical disclosures apply. EFRAG's review of the first Wave 1 reports surfaced a pattern of recurrent errors in how companies execute the DMA — which tells you assurance providers and supervisors now know what sloppy looks like. The DMA flows directly into your sustainability statement through ESRS 2 disclosures on your IROs and their interaction with the business model, and it feeds the assurance process. It is the most legally consequential analytical document your sustainability function produces.

Climate disclosures under E1 — now materiality-tested. The removal of climate's exemption from materiality is a double-edged change. On one hand, no topical standard is automatically mandatory. On the other — and boards should hear this clearly — for most businesses, climate is material under the financial lens, the impact lens, or both, so the disclosure requirement survives the materiality test anyway. What changes is that your company must now demonstrate that conclusion with documented analysis rather than inherit it by default. If your conclusion is that climate is immaterial, expect scrutiny. Scenario analysis, transition planning, and GHG inventories remain in the standards for companies where climate is material — which is most of them.

Value chain assessment. The Omnibus relaxed the insistence on primary supplier data and capped requests to smaller counterparties, but in-scope companies must still assess material impacts across their activity chain where relevant. The practical effect is not the end of supplier engagement — it is smarter, risk-based supplier engagement, prioritised by materiality rather than exhaustive questionnaire campaigns.

Structure, tagging, and auditability. The sustainability statement must follow the ESRS presentation structure, be XBRL-tagged, sit within the management report, and survive limited assurance. Every figure must trace to a governed source. The dividing line between organisations that find this manageable and organisations that find it traumatic is almost always the state of their data infrastructure before the process begins.

Which brings us, again, to the question we hear whenever a compliance workload collides with an AI boom: can't we just have an LLM write the sustainability report?

Part 5: Why Using LLMs for Complete Sustainability Reporting Is a Bad Idea

The answer is the same in any reporting region, and arguably more emphatic — because the CSRD's technical requirements make the failure modes worse.

1. The CSRD's data landscape maximises hallucination risk

LLMs generate fluent, confident content — including content with no factual basis. That failure mode is tolerable when drafting marketing copy and catastrophic when drafting assured regulatory disclosures. The input side of sustainability reporting is fragmented by nature: internal reports, supplier submissions, utility invoices, third-party datasets, and financial systems, in inconsistent formats and with pervasive gaps. The GHG Protocol's research holds that 83% of companies struggle to access accurate emissions data, and Scope 3 — value chain emissions that for most companies dwarf operational emissions, with CDP estimating supply chain emissions average 11.4 times higher than operational ones — is where the gaps concentrate.

When source data is incomplete, generative models fill the gaps with plausible fabrications. An LLM asked to complete an incomplete dataset does not decline; it invents. In an ESG context, that produces emissions figures, impact claims, and materiality conclusions that read authoritatively and are not true — and the fluency itself suppresses scrutiny, because well-written falsehoods invite fewer questions than clumsy ones.

2. Assurance and traceability are incompatible with black boxes

The CSRD requires limited assurance from year one and XBRL-tagged, structured output. Assurance means every material figure traces back to a documented source, a defined methodology, and a reproducible calculation. Analysis of the regime — echoed in the regulatory literature on AI in sustainability assurance — identifies precisely the risk categories that generative models carry: data quality risk, reliability and hallucination risk, explainability risk, and bias risk. A technology that cannot cite the provenance of the number in its own sentence, whose outputs are non-deterministic across runs, and whose reasoning cannot be opened for inspection by an auditor is structurally unfit to be the system of record for assured regulatory disclosures. Assurance practitioners do not accept "the model produced it" as evidence.

3. Materiality judgement is not autocomplete

The DMA is the intellectual heart of the CSRD, and it is a judgement exercise: weighing evidence, applying thresholds, documenting reasoning, and concluding which topics are material through which lens. An LLM can mimic the form of a materiality assessment — producing plausible-sounding IRO listings and scoring rationales — without any of the evidentiary grounding, stakeholder input, or defensibility that the assessment exists to provide. And because the ESRS are a moving target (simplified in 2026, with the N-ESRS still in development), a model trained on last year's corpus will confidently apply superseded requirements without flagging that its knowledge is stale.

4. Confidentiality, liability, and the greenwashing enforcement climate

The data feeding a CSRD report — supplier terms, energy contracts, site-level operational data, incident records — is commercially sensitive, and routing it through uncontrolled general-purpose tools creates governance exposure of its own. Layer on the EU's intensifying greenwashing enforcement climate and the corporate accountability framework the CSRD sits inside (misleading disclosure provisions, directors' responsibility, Member State sanctions), and the risk calculus is unambiguous: an AI-generated report that contains a single confident fabrication is not an efficiency gain. It is a liability with paragraph references.

What LLMs are legitimately useful for

Precision matters here, because the critique is not of the technology — it is of its placement. Properly supervised, generative AI earns its keep at:

• Drafting and editing narrative sections — first-pass text that a qualified professional verifies and owns.

• Summarising dense standards and guidance — with confirmation against the official source.

• Supporting structured retrieval — helping teams navigate the ESRS, subject to checking against the current text.

In every legitimate use, the model proposes and a qualified human disposes. The model never originates data, never computes a reportable figure, and never touches the audit trail.

Part 6: The Correct Operating Model — Platform Plus Science

The division of labour that satisfies the CSRD's architecture:

A purpose-built platform gives you the single source of truth, versioned methodologies, and traceability that limited assurance demands — the difference between an audit that passes and an audit that expands. Scientific expertise — internal or external — supplies the judgement the standards presume: which topics are material and why, how to weight evidence, how to select and interpret climate scenarios, how to translate physical and transition exposure into financially material terms, and how to defend every conclusion in front of an assurance provider and, ultimately, a supervisor. And accountable humans own the disclosure, because that is where the regime places responsibility — with the board.

Software manages the data. Scientists interpret the risk. Humans own the disclosure. Collapse those layers — most commonly by asking a language model to be all three — and the structure fails exactly when it is examined.

Part 7: Your Action Plan by Posture

In scope and reporting (Wave 1)

1. Map your existing disclosures against the Simplified ESRS before they apply, and plan the re-mapping now rather than in FY2027.

2. Tighten the DMA. EFRAG's review of first reports identified recurring weaknesses — ensure yours is documented to survive heightened assurance scrutiny, not just to pass year one.

3. Maintain your data infrastructure investment; the compliance baseline is now permanent.

In scope, reporting 2028 (former Wave 2)

1. Confirm final scoping against the 1,000 employees / €450m turnover thresholds — including how Member State transposition treats your structure.

2. Run the DMA now. It is the pacing item — it determines everything downstream and it improves with iteration.

3. Implement a governed data platform in 2026, so that FY2027, your first reporting year, is not also your first year of living with structured data.

4. Design your value chain engagement around the materiality-based approach and the VSME cap — targeted, proportionate, and legally bounded.

Out of scope

1. Decide strategically whether CSRD-grade data capability is a commercial requirement for you (hint: if you sell to large European customers, it is).

2. Prepare to respond to value chain requests using the VSME format — capped, proportionate, and increasingly the lingua franca of European supply chain data requests.

3. Recognise that voluntary ESRS-aligned reporting is a credibility signal to lenders, customers, and acquirers that your competitors cannot fake.

Non-EU parent groups

1. Map EU turnover and entity structures against the revised thresholds and the emerging N-ESRS architecture.

2. Begin the entity-level data consolidation work that a 2029 first report presupposes — retro-fitting group-wide data flows in 2028 is the expensive way to do this.

The Bottom Line

The Omnibus did not kill the CSRD. It concentrated it: fewer companies, fewer datapoints, same intellectual core, same assurance, same permanence. The regime that emerged from the political turbulence of 2025–26 is leaner, more materiality-driven, and — for the companies that remain in its scope or in its gravitational field — more consequential than the version everyone was panicking about in 2024, precisely because the volume of disclosure now buys attention for every datapoint that survives.

The two-year reprieve granted to the 2028 cohort is the rarest thing in regulatory compliance: usable time. The businesses that convert it into governed data, a defensible materiality assessment, and genuine scientific interpretation of their climate exposure will file their first reports quietly and turn the machinery to strategic use. The businesses that hear "delay" and stop will discover in 2028 what every Wave 1 company learned in 2025: the deadline was never really about the deadline. It was about whether your data existed.

Do it properly. A governed platform for the data. Scientific expertise for the interpretation. Accountable humans for the disclosure. And general-purpose AI kept in its lane — a drafting assistant, never a reporting engine.

Because a sustainability statement that cannot survive assurance isn't simplified. It's exposed.

See Where You Stand Before 2028

Terran Industries' Climate Health Check is the fastest way to see your climate risk in financial terms — a high-level assessment across all 7 Lex Pillars that identifies your highest areas of exposure and financial risk, mapped against the disclosure expectations of the CSRD, the ESRS, ASRS, and the ISSB baseline. No jargon. No obligations. Just clarity.

The reporting regimes keep changing. Your exposure doesn't wait for them to settle.

Sources & further reading: the CSRD and the Omnibus I Directive as published in the Official Journal of the EU (early 2026); Commission Delegated Regulation (EU) 2023/2772 (first ESRS set) and the Simplified ESRS delegated act (2026); EFRAG implementation guidance on materiality assessment and EFRAG's revised ESRS technical advice; the Stop-the-Clock Directive (April 2025) and the ESRS "Quick Fix" amendments (July 2025); EU Taxonomy and CSDDD provisions as amended by the Omnibus package; analysis from PwC, Deloitte, BDO, Grant Thornton, and Latham & Watkins on post-Omnibus scope and timelines; GHG Protocol and CDP research on emissions data access. This article provides general information, not legal, financial, or compliance advice — the post-Omnibus landscape varies by Member State, and boards should seek advice specific to their circumstances.