Thinking · Disclosure

CSRD after Omnibus I: which groups still report, and what that asks of a subsidiary outside the EU.

Abhijith Magal · 11 September 2026 · 11 min read

Most of what was written about the Corporate Sustainability Reporting Directive in 2024 and 2025 is now wrong in at least one number. The Omnibus I directive rewrote the scope, abolished the reporting waves, dropped reasonable assurance, deleted sector standards and ordered a rewrite of the reporting standards. Commentary kept pace unevenly, and secondary sources still disagree with each other on the thresholds. This page reads the directive itself.

It is written for a head office anywhere, and for the sustainability, access or HR lead in a subsidiary who is about to be asked for data. The worked example is an operation in India, because that is where this practice sits, but the mechanics are the same for a subsidiary in Brazil, Kenya or Vietnam.

Who is still in scope of the CSRD after Omnibus I?

An EU undertaking, or the parent of an EU group on a consolidated basis, that on its balance sheet date exceeds a net turnover of EUR 450,000,000 and an average of 1,000 employees during the financial year. The directive writes both conditions into Articles 19a and 29a of the Accounting Directive. A company that meets one and not the other is out. Listed small and medium-sized companies are out entirely, and the waves that phased companies in by size no longer exist.

The first cohort, which began reporting on financial year 2024, is limited to three financial years. From financial years starting on or after 1 January 2027, only undertakings above the new thresholds report. Member States may exempt first-cohort companies that fall below them for 2025 and 2026. The directive sets 19 March 2027 as the deadline for Member States to transpose the reporting changes.

When does a group headquartered outside the EU have to report?

When it generates more than EUR 450 million of net turnover in the EU, and has an EU subsidiary or an EU branch with more than EUR 200 million of turnover. Omnibus I raised the first figure from EUR 150 million and set the second at EUR 200 million. The EU subsidiary or branch then has to publish the group's sustainability report. It does not report on its own behalf, which is why the directive says these thresholds need not match the ones for EU groups.

The date that obligation starts is the one set in Article 5(2) of the original CSRD, Directive (EU) 2022/2464: financial years beginning on or after 1 January 2028. Omnibus I adjusted the dates for EU undertakings and issuers and left that one alone. The standard it will be reported against, the separate standard for non-EU groups, has not been adopted. EFRAG, which advises the Commission, put its exposure draft out for a 100-day public consultation from the second half of July 2026 and expects to deliver technical advice to the Commission by the end of January 2027, with the Commission's own consultation and adoption to follow. So a group in this position knows its clock and can read the draft of its questions.

Does the new value-chain cap protect a subsidiary outside the EU?

No, and this is the point most summaries skip. Omnibus I gives "protected undertakings" in the value chain, those with no more than an average of 1,000 employees, a statutory right to decline requests for information beyond the voluntary standard. That protection is for suppliers, distributors and partners. A subsidiary is part of the group, and consolidated sustainability reporting under Article 29a covers the group. The request that reaches a subsidiary comes from inside the boundary, and the cap has nothing to say about it.

So the scope cut helps a mid-sized Indian supplier to a European group, which can now answer from a short voluntary template and decline the rest. It does not help the Indian subsidiary of the same group. That subsidiary will be asked what the group's materiality assessment decides it must report, and the revised standards keep double materiality intact.

The scope shrank. The request to subsidiaries did not.

Where do workforce health and climate land in the revised standards?

Wherever the group's double materiality assessment puts them. The revision was ordered to remove the least important datapoints and prioritise quantitative ones, and Omnibus I deleted the power to adopt sector-specific standards. The own-workforce standard, which covers health and safety, and the climate standard both remain. What they do not do is ask how one affects the other. A group can report injury rates by country and climate risks by site without ever connecting heat at the site to the injury, the absence or the missed shift.

For a group with large operations in hot, flood-exposed or poor-air locations, that connection is exactly where a materiality assessment should find something. When it does, the parent's data request to the subsidiary becomes specific: hours worked above a heat threshold, lost days by site and season, coverage of health benefits for contract workers, reach of community health programmes in a disrupted quarter. Most subsidiaries do not hold those numbers in a form that would survive limited assurance.

What should a subsidiary outside the EU start collecting now?

The numbers the parent will ask for, defined the way the parent will define them, starting with the first reporting year. For an EU group that year begins on 1 January 2027, and the data has to exist from that day. A group running a dry run in 2026 will send its request well before then. Four moves put a subsidiary ahead of it.

• Ask for the materiality resultRequest the group's double materiality outcome for the subsidiary's country and sites. It decides what will be asked. Guessing costs more than asking.
• Fix the workforce boundaryWrite down who counts: permanent staff, contract workers, field teams, distributors' staff. Consolidated reporting follows the group's boundary, and most local registers were built for a different one.
• Tag the seasonRecord lost days, incidents and programme reach by month and site, so a heat or flood quarter shows up as one. Annual totals erase the signal the materiality assessment is looking for.
• Separate the protected from the ownedList which local partners are protected value-chain undertakings and which entities are group subsidiaries. The first may decline, and the second will be asked.

None of this needs a new system. It needs the registers that already exist to be read on the parent's terms. Head office has a climate-health mandate sets out what a defensible answer to the request contains, and what an answer made of activity rather than exposure looks like.

What about groups whose parent sits outside the EU?

They have a year longer and a standard still to come, which makes it tempting to wait. Waiting would be a mistake. The non-EU standard's exposure draft is already out for consultation and is being drafted to follow the revised ESRS, so the revised ESRS and that draft are the best available guide to its shape. A US, Japanese, Swiss or Indian group with more than EUR 450 million of EU turnover can already see the own-workforce and climate disclosures its standard is likely to echo, and can build the subsidiary data now at the cost of one set of definitions rather than two.

For Indian groups the position is reversed. The India operation is the parent. Its own disclosure under India's BRSR is set out in assessment or assurance: what SEBI actually changed in BRSR Core. Where it also crosses the EU tests, the EU report will draw on the same workforce and health registers. One set of definitions serving both regimes is cheaper than two that disagree.

Where is this heading?

Fewer companies report, and the ones that do report more precisely, under limited assurance to standards the Commission must adopt by 1 July 2027. The pressure moves down the group, not out of it. The subsidiaries that will answer well are the ones that treat the first reporting year as a data collection year that has already started, and that record climate disruption as a workforce and access event rather than an operations footnote. That record is the difference between a materiality assessment that finds climate-health exposure and one that cannot see it. The case for why the connection matters is in climate change is a healthcare story, and the European standards themselves are explained in the ESRS explainer.

Questions worth asking after this

What are the CSRD thresholds after Omnibus I?

Directive (EU) 2026/470 limits CSRD reporting to EU undertakings and groups that, on their balance sheet date, exceed a net turnover of EUR 450 million and an average of 1,000 employees during the financial year. Both conditions must be met. Listed small and medium-sized undertakings are removed from mandatory scope.

When does a non-EU parent have to report under the CSRD?

A group headquartered outside the EU is in scope when it generates more than EUR 450 million of net turnover in the EU and has an EU subsidiary or branch with more than EUR 200 million of turnover. The obligation applies from financial years beginning on or after 1 January 2028. The standard for non-EU groups is in exposure draft; EFRAG expects to deliver technical advice on it by the end of January 2027.

Does the CSRD value-chain cap protect subsidiaries?

No. The cap protects undertakings in the value chain with up to 1,000 employees, giving them a right to decline requests beyond the voluntary standard. A subsidiary sits inside the group's consolidated boundary and is covered by consolidated reporting, so the cap does not apply to requests from its parent.

Abhijith Magal

Founder, Syntropy Earth. Nine years across two global pharmaceutical multinationals in patient access and commercial roles, with health-equity work alongside the WHO-Foundation and UNICEF. He works on climate-access: where climate disruption breaks the link between patients and care. More about Abhijith →

This page reads the directive and the Commission's announcements as published. It is not legal or assurance advice. Member State transposition may add detail, and scope decisions should be confirmed with counsel.

Last updated: 24 September 2026