What the CSRD Omnibus actually changed

The short version: if your company does under €450M in annual turnover and employs fewer than 1,000 people, you are very likely no longer required to file under the Corporate Sustainability Reporting Directive at all. The Omnibus I package, adopted by the European Commission in 2025, raised the scope thresholds, pushed the reporting timeline back by years, and capped how much data large reporters can demand from their smaller suppliers. If you run a mid-market company and you've been quietly dreading a CSRD deadline, the law moved the deadline, and probably moved you out of scope entirely.

Before Omnibus, CSRD applied to a much wider band of companies, including many with a few hundred employees and under €50M in revenue, depending on listing status. That threshold is gone. Per BDO's analysis of the revised scope, in-scope companies now need more than 1,000 employees and more than €450M in net annual turnover. Non-EU parent groups are pulled in only if they generate more than €450M in EU-sourced revenue, a detail confirmed by Normative's breakdown of the revised thresholds and relevant to any US company with a sizable European subsidiary.

The timeline also moved. Large EU companies now start reporting in 2028, covering fiscal year 2027 data. Companies that fall under the "non-scheduled" group start in 2029, covering FY2028. That's a multi-year delay from the original rollout, and it means a lot of the urgency that drove ESG software purchases in 2023 and 2024 has evaporated for most mid-market buyers. PwC's guidance for US companies is worth reading if you have European operations, since exposure through a subsidiary is still the most common way a US-headquartered company gets pulled into CSRD obligations it didn't expect.

For reference, the law itself hasn't changed in substance: it still requires double materiality assessment (financial materiality plus impact materiality), third-party limited assurance, and XHTML digital tagging for submission to the European Single Access Point. The European Commission's official CSRD page lays out the 12 European Sustainability Reporting Standards and the full data point list, which still runs past 1,000 individual disclosures for companies that remain in scope. If you're out of scope, none of that mechanical complexity is your problem anymore. What's left is a much smaller, much more specific question.

If you're not in scope, why is a customer still sending you an ESG questionnaire

Because the company sending it is probably still in scope, and CSRD requires them to report on their value chain, not just their own four walls. A large retailer or industrial buyer that still clears the €450M/1,000-employee bar has to disclose Scope 3 emissions and supply chain sustainability data under the ESRS standards, which means they have to go collect that data from their suppliers. That's you, even though the law never touches you directly.

This is the real pain point for a $5M to $50M company right now, and it's distinct from CSRD compliance itself. Sweep's explainer on CSRD scope covers this value-chain mechanic well, though like most vendor content it still assumes the reader is shopping for a platform. Omnibus added a real protection here: the VSME (Voluntary SME) standard functions as a value-chain data cap, meaning a large reporter is not supposed to demand more from a small supplier than the VSME's simplified, voluntary disclosure set covers. If a customer's questionnaire is asking for the full ESRS treatment, that's worth pushing back on directly. Most aren't; most are asking for a reasonable subset: energy use, basic emissions estimates, supplier code of conduct attestation, maybe a few governance questions. We've seen this pattern play out identically in other fragmented-compliance situations: a mid-market company gets treated by an incoming request as if it needs enterprise-grade infrastructure, when the actual ask is a handful of data points pulled from systems that already exist. It's the same shape of problem we described when a utility client was reconciling billing data scattered across a dozen disconnected systems: the data exists, it's just never been asked for in one place before.

What ESG reporting software is actually built for

Platforms like Workiva, IBM Envizi, Persefoni, Watershed, Diligent, and Coolset are built for companies that have a recurring, audited, multi-framework disclosure obligation and need to produce it every year under scrutiny. That's a specific job: ingest emissions data across Scope 1, 2, and 3, map it to ESRS or GRI or TCFD taxonomies, run it through a materiality assessment workflow, generate an auditable trail for the third-party assurance provider, and output a tagged filing. Gartner's category definition for ESG management and reporting software describes exactly this: continuous data collection, framework mapping, and audit-ready output, aimed at a reporting cycle that repeats annually and gets checked by an external assurance firm.

That is genuinely hard software to build in-house, and it's the right purchase for a company that's actually in CSRD scope, or subject to similar mandatory frameworks like California's SB 253, or managing GHG disclosures across dozens of subsidiaries with investor-grade assurance requirements. The pricing reflects that complexity. These platforms routinely run into six figures annually once you include implementation and the assurance integration work, which tracks with CPC data on this keyword cluster: "carbon accounting software" clicks cost advertisers up to $56.57, among the highest in the ESG keyword set, a signal of how much budget actually chases this category. The problem is that none of that machinery is relevant to a company answering three or four supplier questionnaires a year with simplified VSME-style data. Buying a Workiva-class platform to answer a vendor questionnaire is like buying a data warehouse to answer one SQL query a quarter. It solves a problem you don't have yet, if ever.

Should you buy, build something lighter, or just answer the questionnaire manually

Run the decision on four variables: how many questionnaires you get per year, whether they're recurring from the same customers or one-off, whether any of them require third-party assurance, and how many internal systems hold the answer.

If you're fielding one or two questionnaires a year from customers who aren't demanding assurance, a spreadsheet and a designated owner is the right answer. Don't buy anything. Pull utility bills, fuel records, and supplier attestations by hand, document your methodology once, and reuse it. This is true even if the questionnaire looks intimidating; most SME-facing ESG requests post-VSME are deliberately scoped down.

If you're getting questionnaires from five or more customers a year, with overlapping but not identical data asks, and the same three or four people in finance or operations are manually re-answering slightly different versions of the same questions every quarter, that's a real recurring cost, even without a mandatory framework behind it. This is the zone where a lightweight, owned data pipeline beats both the spreadsheet and the enterprise platform. We've built the same kind of thing for financial consolidation problems where a company crossed a complexity threshold without crossing a revenue threshold; the structure of the decision is nearly identical to what we laid out in our piece on when financial consolidation software breaks down past five entities.

If you actually are in CSRD scope post-Omnibus (check the €450M/1,000-employee thresholds carefully, including EU-subsidiary revenue if you're US-headquartered), or you're voluntarily pursuing GRI or another assurance-grade framework because investors or a parent company require it, that's when an enterprise ESG reporting software purchase is the right call. Annual, audited, multi-framework reporting with a legal filing deadline is exactly the job those platforms exist to do.

The real cost driver isn't the software, it's where your data lives

Every ESG questionnaire response comes down to the same four or five data categories: energy consumption, fuel use, waste and water if applicable, supplier attestations, and basic governance policy confirmations. None of that data is exotic. It's usually sitting in utility bills, an ERP system, a fleet management tool, and a folder of supplier contracts, none of which talk to each other. This is the same structural problem we keep running into across completely different industries: the bottleneck is never the reporting layer, it's data fragmentation underneath it. We saw it with a 1M+ SKU e-commerce catalog where the real fix wasn't a bigger PIM platform, it was connecting the systems that already held the product data. ESG questionnaire response has the same shape. The company that spends $40,000 on a carbon accounting platform and still manually hunts down utility PDFs every quarter hasn't fixed the problem; they've added a UI on top of it.

What a lighter, owned solution looks like in practice

For a mid-market supplier fielding a handful of recurring ESG questionnaires, the practical build is small: a pipeline that pulls utility and fuel data on a schedule, normalizes it against standard emissions factors, pulls supplier attestations from wherever they're stored, and assembles a structured answer set that maps to the common questionnaire formats (CDP-style, VSME-aligned, or a customer's proprietary template). No annual license, no assurance workflow you don't need, no vendor lock-in on a platform sized for a Fortune 500 reporting cycle. This is the same category of build-first decision companies face across compliance-heavy areas generally, including ones running parallel EU obligations at the same time. If your team is also tracking the EU AI Act's compliance deadlines alongside CSRD exposure, the overlap is worth mapping once rather than solving each regulation in isolation, since the underlying problem (data scattered across systems, needed in a structured format on demand) repeats.

Where this goes next

None of this requires guessing. A short diagnostic, looking at questionnaire volume, data source count, and whether assurance is actually required, tells you in a week whether you need software, a lightweight data pipeline, or just a better spreadsheet owner. If you're working through this decision, this is exactly what Genta AI Solutions' Discovery phase maps out before any build conversation happens, and we're happy to compare notes. For a broader view of how we think about diagnosing data problems before recommending a platform purchase, our enterprise AI page covers the approach in more detail.

Frequently asked questions

What does CSRD stand for and who does it actually apply to now?

CSRD stands for the Corporate Sustainability Reporting Directive, the EU law governing mandatory sustainability disclosure. Post-Omnibus, it applies to companies with more than 1,000 employees and more than €450M in annual turnover, or non-EU groups generating more than €450M in EU revenue, per BDO's scope analysis. Most mid-market companies fall outside this.

What changed with the CSRD Omnibus, is CSRD still mandatory?

CSRD is still mandatory for companies that remain in scope, but Omnibus raised the thresholds significantly and delayed the timeline. Large in-scope companies now report starting in 2028 on FY2027 data, and non-scheduled groups start in 2029, a multi-year push from the original schedule described by the European Commission's official CSRD page.

Do US companies need to comply with CSRD?

Only if a US company has EU operations that clear the revised thresholds, specifically more than €450M in EU-generated revenue through a subsidiary or group entity, as PwC's guidance for US companies explains. A US parent with no qualifying EU presence has no direct CSRD obligation.

My company is too small for CSRD, why is a customer asking for ESG data?

Because your customer is likely still in CSRD scope and must report Scope 3 (value chain) emissions, which requires collecting data from suppliers like you. The Omnibus-introduced VSME standard caps how much a large reporter can demand from smaller suppliers, so the request should be scoped down, not a full ESRS-style disclosure.

Do we need ESG reporting software, or can we handle a questionnaire without one?

If you're answering a handful of questionnaires a year with no third-party assurance requirement, a spreadsheet and a documented methodology is enough. Enterprise ESG reporting software earns its cost when you have a recurring, audited, multi-framework disclosure obligation, which describes companies still in CSRD scope, not most suppliers answering customer requests.