EU Omnibus Package: Key Changes Proposed by the Commission on ESG Reporting and Due Diligence

Introduction

On 26 February 2025, the European Commission proposed a series of amendments to the requirements for ESG reporting and due diligence under CSRD, the Taxonomy Regulation, and CS3D. These proposals are part of a broader package of proposed measures to respond to concerns about EU competitiveness, by simplifying the ESG regulatory framework to reduce administrative burdens for companies and facilitate implementation.¹

More specifically, this note addresses three proposed measures: (1) a directive to amend the substantive requirements of CSRD, the Taxonomy Regulation and CS3D (“substantive directive”); (2) a directive to delay the entry into application of reporting and due diligence obligations under CSRD and CS3D (“delay directive”); and (3) a delegated act to amend reporting obligations under the Taxonomy Regulation (the “proposed Taxonomy delegated act”).

The Commission also announced, on 26 February, that it will propose changes to CSRD’s European Sustainability Reporting Standards (ESRS). These changes will reduce the number of mandatory datapoints, clarify ambiguities, and enhance consistency with other EU laws. These changes will be adopted no later than six months after the substantive directive enters into force.

Timeline for implementation of proposals

For the proposed substantive directive and delay directive, the Commission’s proposal launches the ordinary EU legislative process. The two directives will ultimately be adopted by the Council of the European Union (the Council) and European Parliament (the Parliament). Each of these institutions will now propose changes to the proposals, before the final texts of the directives are adopted.

The substantive directive will likely involve lengthy negotiations within the Council and the Parliament, and then between these two institutions and the Commission. Adoption can be expected towards the end of 2025 or in early 2026, with transposition into EU Member State national law within 12 months.

For the delay directive, passage will be smoother and faster, likely within three-six months, with transposition this year.

The proposed Taxonomy delegated act is open for public consultation until 26 March, and will then be adopted by the Commission alone.

In this Sidley Update, we explain how the three proposed measures will, if adopted, change the requirements under CSRD, the Taxonomy Regulation, and CS3D.

CSRD

Scope and timeline

The Council mandated the Commission to make proposals to reduce sustainability reporting burdens by 25%. In its proposal, the Commission explains that, through its proposed amendments, the number of companies subject to sustainability reporting will be reduced by about 80%. The 20% of companies that will remain subject to CSRD will face fewer reporting requirements, as explained below.

EU companies

To reduce the number of subject companies, the proposal entirely eliminates CSRD reporting obligations for “small”- and “medium”-sized (SME) companies; and it eliminates reporting for many “large” companies, by adding that EU companies will have to report only if they have at least 1,000 employees (as well as either turnover of €50+ million or assets of €25+ million).

The Commission proposes that these subject large companies begin reporting in 2028 on their activities in the financial year starting on or after 1 January 2027. For companies that remain subject to CSRD, this will typically delay first reporting by two years.

Non-EU groups with significant activity in the EU

In some circumstances, CSRD currently requires sustainability reporting in relation to parent companies established outside the EU, when they have a large subsidiary or branch office in the EU (“non-EU parent companies”), provided that the global corporate group of the non-EU parent has consolidated EU turnover of €150+ million. The Commission also proposes to eliminate reporting for many of these non-parents, by tripling the EU turnover threshold to €450 million. However, no 1,000 employee threshold has been added for a large subsidiary or branch office in this category. For non-EU companies, EU turnover is likely used as an additional criterion to narrow scope because, according to the CS3D preamble, it establishes a territorial connection to the EU, whereas many employees of a non-EU company would be located outside the EU.

The Commission does not propose to delay the timeline for non-EU parent reporting: parent companies would report in 2029 on their activities in the financial year starting on or after 1 January 2028.

Double materiality

This aspect of CSRD remains unchanged. Under the proposals, subject companies will still have to report on the impact they have on people and the environment, and the financial risks and opportunities they face from sustainability matters, like climate change. The Commission said that, in the revised ESRS, it will provide clearer guidance on how to apply the materiality principle to ensure that companies only report material information, which will add clarity and ensure consistency.

Reporting on the value chain

The proposals significantly reduce the burden on third party EU and non-EU companies (i.e., non-subject companies) to provide sustainability information to subject companies, when such third parties are part of the value chain of subject companies (e.g., suppliers). In particular, subject companies will not be able to seek any information from companies in their value chain with less than 1,000 employees, with two exceptions. Subject companies will be able to seek information: (1) specified in certain voluntary reporting standards, which the Commission proposes for companies not subject to CSRD; and (2) sustainability information commonly shared between companies in the sector concerned. Absent company-specific value chain information, subject companies will have to use estimations consistent with the ESRS based on other information available to them.

Sector-specific reporting standards

The Commission proposes to abolish the requirement for it to adopt sector-specific reporting standards, to avoid increasing the number of mandatory datapoints.

Assurance

Under the current version of CSRD, subject companies must secure a limited assurance opinion on their CSRD report, with this requirement moving to reasonable assurance over time. The Commission proposes to eliminate the requirement to move to reasonable assurance. Further, while the Commission proposes to retain the requirement for it to adopt standards for limited assurance, it proposes to abolish the deadline for it to do so.

Taxonomy Regulation

There are no changes proposed to the Taxonomy Regulation itself. However, the changes to the scope of CSRD reporting will have a knock-on impact on the scope of Taxonomy reporting. Further, the Commission proposes two sets of changes to the Taxonomy reporting requirements: (i) a significant exception to mandatory Taxonomy reporting, through an amendment to CSRD in the substantive directive; and (ii) important changes to the content and form of Taxonomy reporting, through the proposed Taxonomy delegated act.

Scope

Under Article 8 of the Taxonomy Regulation, large companies and groups, and certain SMEs, subject to CSRD reporting must undertake Taxonomy reporting. If the proposals to reduce the scope of CSRD reporting are adopted, by excluding SMEs and large companies with fewer than 1,000 employees (see above), this will reduce, correspondingly, the number of companies subject to Taxonomy reporting.

Exception to mandatory Taxonomy reporting

For companies that remain subject to Taxonomy reporting (i.e., large companies with more than 1,000 employees), the Commission proposes to create a significant exception to the mandatory character of Taxonomy reporting. Specifically, Taxonomy reporting would remain mandatory solely for large companies subject to CSRD that have more than €450 million in turnover. In other words, for subject companies that do not meet this turnover threshold, Taxonomy reporting will be voluntary under an “opt in” regime.

Under the “opt in” regime, Taxonomy reporting will be required only if the company chooses to claim that its activities qualify, fully or partially, as environmentally sustainable under the Taxonomy Regulation. If no such claim is made, Taxonomy reporting is not required for these companies.

If a company chooses to opt into Taxonomy reporting, it will also face lighter disclosure requirements that include only the Taxonomy alignment of its turnover and capital expenditure (CapEx), with reporting on operating expenditure (OpEx) becoming optional. Furthermore, under the voluntary regime, reporting on partial Taxonomy alignment will also be permitted.

Taxonomy Delegated Act

The Commission has also announced its intention to adopt the proposed Taxonomy delegated act that would introduce important changes to the content and form of Taxonomy reporting. It has invited comments by 26 March on the proposed delegated act, which would amend the current rules, set forth in three Commission delegated acts related to the Taxonomy Regulation: (i) the Disclosures Delegated Act; (ii) the Climate Delegated Act; and (iii) the Environmental Delegated Act. The Commission is expected to adopt the proposed Taxonomy delegated action Q2 2025.

Key changes to the content and form of Taxonomy reporting include:

• 10% de minimis threshold: Nonfinancial and financial undertakings do not need to assess Taxonomy eligibility and alignment of economic activities below a 10% de minimis threshold of financially materiality. This materiality threshold is met when the cumulative value of the activity (turnover, CapEx, or OpEx KPI) is below 10% of the relevant KPI’s denominator.
• 25% de minimis OpEx threshold: For non-financial undertakings only, there is also a 25% de minimis threshold on OpEx KPI reporting of an economic activity, if the cumulative turnover of the activity is below 25% of the turnover KPI’s denominator (note that reporting on turnover and CapEx for the economic activity would still apply).
• Simplification of reporting templates: For non-financial undertakings, the Commission proposes to simplify Taxonomy reporting through one reporting template, which summarises and simplifies the original three templates. The new template is intended to include solely decision-useful information and removes certain datapoints, such as information on non-eligible activities, information per objective, an information on the “do no significant harm” (DNSH) criteria. The Commission proposes certain additional simplifications concerning financial and non-financial undertakings, concerning, for example, the “per activity” information for taxonomy-aligned activities and the separate templates on performance and exposures to fossil gas and nuclear activities. The European Commission estimates that the proposed simplification of templates will reduce the number of required datapoints by almost 70% for nonfinancial undertakings, and by almost 90% for credit institutions.
• Do no significant harm (DNSH): Full compliance with DNSH criteria is a necessary condition for an economic activity to be considered Taxonomy-aligned. However, the Commission also acknowledges that the DNSH criteria have been considered overly complex and difficult.

As a first step to simplification, the proposed Taxonomy delegated act includes certain clarifying amendments to the DNSH criteria regarding the environmental objective “Pollution prevention and control.” These amendments include clarifying the application of certain exemptions to the DNSH criteria resulting from EU environmental laws.

The delegated act notes that the Commission will continue to carry out a systematic and thorough review of all DNSH criteria for other objectives to make them simpler and more usable.

CS3D

Scope and Timeline

In the final stages of adopting CS3D last year, the EU significantly narrowed the proposed scope of the law to: (1) EU companies with more than 1,000 employees and worldwide turnover of more than €450 million; and (2) non-EU companies with EU turnover of more than €450 million. The Commission does not propose to change these CS3D scoping rules.

However, the Commission does propose to delay the application of CS3D, at least for certain subject companies that would otherwise be subject to CS3D starting July 2027 (under the original CS3D Wave 1). Under the delay directive, the Commission seeks the following:

1. Wave 1: from 26 July 2028, CS3D would apply to EU companies with 3,000+ employees and €0.9+ billon worldwide net turnover; and to non-EU companies with €0.9+ billon EU net turnover; these companies would be expected to report on their CS3D activities for the financial year starting on or after 1 January 2029, with reporting in 2030. For the larger companies in this category, this is one year later than originally planned and, for others, it implies no change.
2. Wave 2: Starting 26 July 2029, CS3D would apply to all other subject EU and non-EU companies; these companies would be expected to report on their CS3D activities for the financial year starting on or after 1 January 2030, with reporting in 2031. This date remains unchanged from the original CS3D text.

To give subject companies time to prepare for implementation, the Commission’s deadline for the adoption of general due diligence guidelines is advanced to 26 July 2026.

Harmonization

The Commission seeks to expand the extent of harmonization across EU Member States regarding core aspects of due diligence (in particular, the duties to identify, assess, and address adverse effects, and to provide for a complaints and notification mechanism). However, the Commission also acknowledges that EU law cannot prevent EU Member States from introducing more demanding social, human rights and environmental protections, if they wish to set a higher level of protection. Thus, although the Commission pushes for greater harmonization across the EU, it cannot prevent “gold plating” by the Member States.

Value chain obligations regarding indirect business partners

CS3D currently requires that companies subject to CS3D: (1) conduct a mapping exercise to identify general areas where adverse effects are most likely to occur; followed by (2) an in-depth assessment of those areas. Both steps apply in respect of the company’s own operations, its subsidiaries and, where related to its chains of activities, those of its business partners (both direct and indirect). Companies have raised concerns about practical challenges in meeting these requirements due to the complexities of value chains. In response, and finding inspiration in the German Supply Chain Act, the Commission proposes to reduce – but not to eliminate – a company’s due diligence obligations with regard to indirect business partners.

First, the mapping exercise must still be conducted with respect to a company’s business partners in its chain of activities, including indirect suppliers. However, to reduce the burden on smaller companies, a subject company is limited in the information that it can seek from business partners with fewer than 500 employees. The information requested from these business partners should, in principle, not exceed the information specified in voluntary reporting standards the Commission proposes for companies not subject to CSRD. Nevertheless, where additional information is necessary (e.g., there is an indication of likely adverse impacts or the voluntary CSRD reporting standards do not cover relevant adverse impacts) and that information cannot otherwise reasonably be obtained, the company may seek information from a smaller business partner.

Second, a subject company is no longer required to conduct an in-depth assessment beyond its direct business partners, unless the company has “plausible information” indicating adverse impacts (e.g. human rights and environmental problems) with indirect business partners. This means that a company does not need to proactively look for problems with indirect business partners, but, at the same time, it cannot turn a blind eye when it should know about problems, for instance through the media, NGO reports, or complaints. In that event, a company must assess and address the problems.

In addition, a company must ensure that its direct business partners enforce compliance with the company’s code of conduct with its business partners, a practice known as “contractual cascading” up the chain of activities.

Climate transition plan (CTP)

Under the current CS3D, a company must “adopt and put into effect” a CTP aligned with the Paris Agreement 1.5o C temperature goal. The Commission proposes to delete the words “put into effect” and add that a CTP must include “implementing actions” that aim to ensure, through best efforts, the goals of the plan. The preamble of the substantive directive indicates that the CTP must describe implementing actions “planned and taken.”

The other CTP-related obligations in CS3D remain unchanged – the CTP must still be updated annually, including implementing actions, in light of progress towards its goals. The Commission explains that the changes secure a better alignment with the CSRD disclosure requirements on climate change.

Stakeholder engagement

CS3D currently requires subject companies to engage with a broad range of stakeholders. To make stakeholder engagement more proportionate, the Commission proposes to amend the definition of stakeholder , limiting it to the company’s employees, the employees of its subsidiaries and its business partners, their representatives (including trade unions), and individuals and communities (or their representatives) whose rights and interests are or could be directly affected by the business of the company, its subsidiaries and its business partners. Stakeholder engagement is no longer required, for instance, with consumers and civil society organizations.

Further, the Commission proposes to limit the steps of the due diligence process at which a company must engage with stakeholders (i.e., identification, development of enhanced action plans, and when designing remediation measures), and that any such engagement can be limited to “relevant” stakeholders that have a link to the specific stage of the due diligence process being carried out (i.e., engagement need not include all stakeholders at all stages). Stakeholder engagement is not required when suspending a business relationship, or when developing indicators for monitoring the effectiveness of the due diligence measures.

Termination of business relationships

The duty to terminate business relationships as a measure of last resort is modified. Instead, when actual or potential adverse effects that cannot be prevented or mitigated occur, companies shall: (1) refrain from renewing or extending business relationships in the chain of activities connected with the impact; (2) if permitted by the relevant law governing the business relationship, adopt and implement an enhanced prevention plan without undue delay, if there is a reasonable expectation the plan will succeed; and (3) suspend the business relationship with respect to the activities concerned.

Monitoring

In terms of monitoring their own due diligence efforts, companies will have to re-assess the adequacy and effectiveness of their measures every five years (instead of every year). However, ad hoc assessments will be required without undue delay after significant changes occur, if there are reasonable grounds to believe that the company’s due diligence efforts are inadequate or ineffective or new risks of adverse impacts.

Civil liability and penalties

The Commission proposes to remove the current CS3D requirement for EU Member States to create uniform rules on civil liability for damage caused by a failure to conduct the required due diligence. At the same time, the preamble of the substantive directive notes that international and EU law require that victims have effective access to justice in national law. Thus, the proposals recognize that civil liability may arise under national law. In the event that a company is found liable, the proposed revisions require victims to have a right to full compensation (but not punitive damages). The proposals eliminate the requirement for EU Member States to allow victims to be represented by trade unions or NGOs, although, again, national law could permit such actions. The consequence of these changes is that civil liability will become more of a patchwork across EU Member States, depending on the rules in place in each Member State.

On administrative penalties, the Commission proposes to eliminate the current minimum cap (5% of worldwide turnover). However, penalties must still be effective, proportionate, and dissuasive, and based on a series of listed factors (e.g., nature and gravity). The Commission also proposes to develop, in collaboration with EU Member States, EU-wide guidelines on appropriate administrative penalty levels.

Review clause for financial services

Finally, the clause in CS3D regarding the Commission’s planned review on the extension of additional sustainability due diligence requirements to regulated financial undertakings such as credit institutions and investment firms (i.e., to incorporate their downstream financial services and investment activities) is deleted, to allow further time to assess the implementation of the revised CS3D framework.

¹ See “The future of European competitiveness,” September 2024; Budapest Declaration on the New European Competitiveness Deal, 8 November 2024.