ESG, supply chain, sanctions: what actually applies after Omnibus I in autumn 2026

Three regimes, two directions

On 18 March 2026 the Omnibus I amending Directive (EU) 2026/470 entered into force and softened two regimes at once: CSRD reporting now catches a markedly smaller population, and the CSDDD due-diligence directive was postponed by years and trimmed in substance. In the same year the movement ran the other way elsewhere — with the 20th sanctions package of 23 April 2026 and the 21st package of 23 July 2026, the EU tightened export controls and anti-circumvention noticeably.

For compliance officers that creates an awkward simultaneity. Two topics that were treated as mandatory for years suddenly look negotiable — while a third one, filed by many as a side concern of the export department, now sets shorter and harder deadlines than the other two combined.

CSRD after Omnibus I: smaller population, same substance

Only companies that cross both thresholds report: more than 1,000 employees and more than €450 million net turnover. The "and" is what matters — the criteria are cumulative, no longer a two-out-of-three test. The Commission estimates that this takes around 80 percent of the previously covered companies out of direct scope; listed SMEs are fully exempt and sector-specific ESRS have been discontinued. Non-EU groups are captured through a separate threshold based on turnover generated in the EU.

What remains is not less demanding, just less voluminous. The number of mandatory ESRS datapoints drops by roughly 61 percent — from about 1,100 to around 430 — and all voluntary disclosures are gone. The originally planned step-up from limited to reasonable assurance was deleted: limited assurance is now permanent, and the Commission must adopt harmonised assurance standards by 1 July 2027.

Member States must transpose the CSRD amendments by 19 March 2027; they apply for the first time to financial years beginning on or after 1 January 2027. Wave-one companies that still cross the new thresholds keep reporting without interruption. For those falling out, Member States may provide an exemption for financial years beginning between 1 January 2025 and 31 December 2026 — whether and how is a national decision.

Double materiality: not deleted, promoted to a filter

Double materiality survived the Omnibus. It was not abolished but streamlined methodologically and upgraded at the same time: the materiality principle now explicitly acts as the filter deciding what belongs in the report at all. Run the assessment properly and you report less, not more — non-material content may be left out.

Both directions remain — the company's impact on people and the environment, and the financial effects of sustainability matters on the company. What is new is that a top-down approach is explicitly encouraged: filter down from sector-typical impacts instead of assessing every topic from scratch. Materiality thresholds were sharpened, stakeholder engagement remains required but is simplified for smaller in-scope companies.

• Kept: both materiality directions, the external assurance requirement, and the anticipated-financial-effects test from the climate standard.
• Simplified: top-down approach explicitly permitted, sharper thresholds, more flexibility on aggregation and disaggregation.
• Gone: sector-specific standards, all voluntary disclosures, and the planned move to reasonable assurance.

From the report into risk management — and into internal controls

The most interesting consequence of the Omnibus is not in the scope but in the assurance. Because limited assurance stays, an auditor still looks at the sustainability disclosures — and auditors do not test convictions, they test processes. A materiality assessment that ends as a workshop result in a slide deck cannot be assured. One that documents data sources, thresholds, responsibilities and the reasons for each decision can.

That moves ESG to where banks and insurers have had it for years: into the second line of defence. Double materiality is not a project but a recurring process for identifying and assessing impacts, risks and opportunities — with the same mechanics as an operational risk inventory: collection, assessment, thresholds, escalation, periodic review. The retained anticipated-financial-effects test is the actual bridge: work it out seriously and climate risk sits inside risk management rather than beside it.

Exactly how detailed the internal-control expectations turn out will be decided by the revised ESRS the Commission adopted in July 2026. They are mandatory for financial years from 2027 and may be applied voluntarily a year earlier. Wait for national transposition and you lose precisely the year that was meant for building auditable processes.

The cap on supplier requests — and the gap it leaves open

For mid-sized companies the practically most important change is not a reporting duty but a ceiling. In-scope companies may not require value-chain companies with up to 1,000 employees to provide more sustainability information than the voluntary reporting standard foresees. The cap applies from financial year 2026 and is the legislator's real answer to the questionnaire sprawl of recent years.

It comes with one carve-out, and it is the expensive one: the cap does not cover disclosures on gross Scope 1, 2 and 3 greenhouse-gas emissions. So your large customer may keep asking for emissions data — even if you never become subject to reporting yourself. Failing to produce those numbers does not risk a fine; it risks a tender.

Supply chain: the German LkSG is alive — enforcement is not

The German Supply Chain Due Diligence Act has not been repealed. It formally remains in force, and with it the substantive core duties: risk management, risk analysis, preventive and remedial measures, and the complaints procedure. What changed is enforcement. Since September 2025 the BAFA, on instruction from the Federal Ministry for Economic Affairs, only pursues serious violations, and since November 2025 the digital reporting form has been switched off.

A government bill deleting the reporting obligation in section 10(2) retroactively to 1 January 2023 was approved by cabinet in September 2025 and had its first reading in the Bundestag in January 2026; it has been sitting in committee ever since. In practice the reporting duty has been suspended since autumn 2025 — legally it has not yet been removed.

The federal government's roadmap has been set since 2 July 2026: the CSDDD is to be transposed one to one. As early as autumn 2026 the LkSG's scope is to be narrowed to companies with at least 5,000 employees and more than €1.5 billion worldwide net annual turnover; the act is to be replaced by 26 July 2028 with a new law on international corporate responsibility. At European level the Omnibus softened the CSDDD itself: the climate transition plan obligation and the EU-wide civil liability regime were deleted, and fines are capped at a maximum of three percent of worldwide turnover.

Sanctions and export controls: the counter-movement

While reporting duties shrink, export controls tighten. The 20th sanctions package of 23 April 2026 was the first use of the EU's anti-circumvention mechanism against a third country: Kyrgyzstan is now designated a jurisdiction with systematic and persistent circumvention, and exports of CNC machines and radios there are prohibited. At the same time the list of entities under enhanced dual-use restrictions was expanded — explicitly including addresses outside Russia.

The 21st package of 23 July 2026, in force since 24 July, continues that line: 51 further entities in China and Hong Kong, Türkiye, Kyrgyzstan, India, Kazakhstan and the United Arab Emirates were added to Annex IV. New import bans cover, among others, copper, nickel, lead and precious-metal ores, unwrought zinc, zinc and chromium oxides, tall oil, glassware and car parts — with a wind-down period for pre-existing contracts until 25 October 2026.

The operationally most important duty is older and routinely overlooked: the "No Russia" clause from the 12th package. Anyone exporting certain sensitive goods to third countries must contractually prohibit re-export to Russia and agree adequate remedies for breach — and report any detected breach to the competent national authority. That is not a drafting question for procurement but a reporting obligation with a named addressee.

• Annex I of the dual-use regulation was extended to emerging technologies on 8 September 2025 — classifications from before that date no longer hold.
• Technical-assistance controls extend to third-country nationals inside the EU: access to controlled knowledge is itself an export-relevant act.
• For tanker sales to third countries, Article 3q requires a contractual resale ban plus proportionate due diligence by the seller.
• EU operators may recover damages from claims brought in third countries; Member States must not recognise Russian court decisions under Articles 248.1 and 248.2.

The common denominator is a master-data question

Three regimes, three deadline logics — and at heart the same question: do you know who you are dealing with? The materiality assessment needs the value chain. Due diligence needs the same chain, assessed by risk. Sanctions screening needs the same counterparties, matched against lists, plus the flow of goods.

In most organisations that question is answered three times: once in the sustainability tool, once in the supplier database, once in a spreadsheet owned by the export desk. That is the real cost driver — not the number of datapoints. A shared master record for counterparties, which all three checks plug into, is the one investment that benefits from all three of this year's movements: it survives a smaller CSRD scope, a postponed CSDDD and a 22nd sanctions package alike.