The EU Omnibus cut 90% of CSRD. But look at what it refused to cut

The EU’s Omnibus I Directive removed roughly 42,000 companies from CSRD scope and cut ESRS datapoints by around 60%. Most of the coverage has been about what was lost.

But a more revealing question is what survived. Double materiality, the principle that a company’s effect on people and the environment counts in its own right.

This piece sets out precisely what changed, what did not, and how the surviving principle should be interpreted. When nothing compels you to publish a social impact figure, the credibility of that figure becomes entirely yours to establish.

Did the EU Omnibus just kill mandatory social impact reporting?

If you lead ESG or sustainability at a large company, you have spent two years tracking the EU Omnibus through stop-the-clock, the quick fix, the trilogue and the vote. And now somebody internally is asking: does any of this still apply to us?

Under sustained political pressure the EU:

• Cut Corporate Sustainability Reporting Directive (CSRD) scope by roughly ninety per cent
• Cut the total number of datapoints by around seventy per cent
• Abandoned binding sector-specific standards
• Dropped the planned move to “reasonable assurance”

But it defended double materiality — the principle that your effect on people and the environment counts in its own right, and not only where it shows up in enterprise value.

What the EU Omnibus dropped from CSRD and CSDDD

Directive (EU) 2026/470 came into force on 18 March 2026. It amended both the CSRD and the Corporate Sustainability Due Diligence Directive (CSDDD).

• On scope, the CSRD now applies only to companies with more than 1,000 employees and more than €450m net turnover. It will apply for financial years beginning on or after 1 January 2027. Around ninety per cent of the roughly 50,000 companies the original design would have caught are now out.
• On content, the European Commission adopted the revised European Sustainability Reporting Standards by delegated act on 3 July 2026. Every voluntary datapoint is deleted and the mandatory ones cut by around 61%. Together that takes the total from roughly 1,073 to around 320. Limited assurance remains the ceiling: the planned move to reasonable assurance has been removed.
• On the value chain, companies of 1,000 employees or fewer become “protected undertakings”. This bestows a legal right to decline any sustainability data request beyond the voluntary SME standard. Contract clauses attempting to override that are unenforceable. The CSDDD itself now reaches only companies above 5,000 employees and €1.5bn turnover, from 26 July 2029.

That is a serious retreat, and it is reasonable to read it as one.

But Double Materiality survived the EU Omnibus

A topic is reportable if it is financially material to the company, or if the company’s impact on people and the environment is material. That second test is why the CSRD asks about your effect on a community, and not only the community’s effect on your balance sheet.

It is also the most contested point of divergence between the EU and the rest of the world. The global investor-facing standards, including the ISSB baseline the UK’s own SRS follows, work on financial materiality alone, so under those regimes your social disclosures rest on your own methodology.

Much of the social framework built on it survived too:

• ESRS S1 to S4 — own workforce, workers in the value chain, affected communities, consumers and end-users — remain in place
• The ESRS require reporting on positive material impacts, not only adverse ones. The due diligence directive concerns itself with harm, the reporting standard with the good you do

The EU spent two years cutting. What it protected was the principle that your effect on people is a reportable fact in its own right.

The EU Omnibus didn’t remove the demand for credible, defensible social data

If you are still in scope, the datapoints that used to define your social number have just been cut from under you. If you are not, the mandate may have gone but the audience has not. Banks still ask in lending, investors in due diligence, large customers in procurement, public buyers in bids. Candidates apply the same test — around forty per cent of Gen Z and millennial workers say they have turned down an assignment, project or employer on ethical grounds — and so do customers, eighty-eight per cent of whom treat brand trust as important or a deal-breaker.

None of them will take the claim on trust any longer. An activity figure — five thousand volunteering hours — reads as marketing; an outcome with evidence attached reads as fact.

The obligation to report went. The liability for what you say did not. A figure you cannot evidence carries legal and reputational risk whether or not a directive asked for it, and that risk sits with whoever’s name is on the report.

A mandate is a form of borrowed credibility. When it is withdrawn, the credibility does not transfer to you automatically. You have to build your own.

Until now, part of the weight behind your numbers was structural: a directive specified the datapoint, a standard defined it, an assurance provider looked at it. Take those props away and your reader is left with one question: why should I believe this?

There is a real upside. You are no longer filling in someone else’s fields: you can report on what you are genuinely proud of, in the structure that fits what you do. Most sustainability teams have wanted that for years. The catch is that employees and customers will only believe the result if the burden of credibility, now entirely yours, is actually carried.

GRI, SDGs, etc: Why disclosure frameworks are not enough

The instinct at this point is a good one: if we are reporting voluntarily, anchor to the frameworks that survived. Use the ESRS social standards as a checklist of topics, and the revised S1 as a starting point. That will get you a long way. It will not get you to a defensible number.

The major frameworks — the ESRS, the global investor standards, GRI and the SDGs — are disclosure architectures. They are extremely good at telling you what to say, in what order, at what level of detail. But they are silent on three things you need before you can say anything at all.

They do not tell you how to establish what changed

For example, ESRS S1-12 asks about training and skills; it does not tell you what your training programme did to anyone’s employability. S3 asks about affected communities; it does not tell you what your community investment altered in that community. Reporting an activity and reporting an outcome are fundamentally different, and only one of them answers the question anybody actually cares about.

They do not tell you how to attribute

If a young person you mentored finds work, some of that is your programme, some of it is the labour market, and some of it is them. A defensible number needs a rule for that boundary. No disclosure standard supplies one.

They do not give you common units

Volunteering is measured in hours, giving in pounds, training in headcount, wellbeing in survey scores. Four incommensurable scales, methodologies and definitions of success, and no way to answer the question leadership actually asks: which of these had the most impact?

The same problem runs sideways. Every region and brand collects to its own definitions, on its own template, so the group figure adds up things that were never the same measurement.

This is why one annual report often holds two visibly different standards of evidence. The environmental half has a methodology, defined boundaries, an evidence trail and an assurance opinion. The social half typically has a headline figure from a spreadsheet somebody rebuilt in the fortnight before the deadline.

A company can be fully compliant with the CSRD or with GRI and still be unable to say what value it is creating from what it spends, or defend the number.

Compliance and defensibility were never the same thing. The EU Omnibus as simply removed the cover that made it possible to confuse the two.

What a defensible social number needs

If no regulator is standing behind your social figures, something else has to. No regulator has mandated a standard for social outcome measurement, so the organisations whose data survives an auditor, an investment committee or a sceptical board tend to have six things in common — most of which move work earlier in the cycle rather than adding to it.

Six Tests:

• Stated attribution logic. What changed, whose life is different for, and what would have happened anyway (“deadweight”). Written down, applied consistently and available to anyone who asks — including where a charity partner delivered the activity, in which case the rule is yours to set, not theirs.
• Proxy values you did not invent. Converting outcomes into common units requires monetary equivalents, whose credibility rests on provenance: values traceable to published sources a sceptic can check, not proprietary multipliers you are asked to accept.
• Evidence attached at point of entry. The photograph, document, testimonial, held against the metric it supports rather than filed separately or assembled afterwards. Can a headline figure traces back to a source an auditor will accept? Did it get there without anyone chasing the person who holds it?
• Validation as data arrives. Rule-checks at the moment of entry rather than a cleanup before the deadline, which means collecting where the data already lives: HR, finance, ERP, volunteering and grant systems, by integration or file upload. The same logic applies outside your walls, once suppliers of 1,000 employees or fewer can lawfully decline your request: make contributing effortless, with no login and no charge to them.
• Governance independent of vendor. A methodology owned and reviewed by people with no commercial interest in the answer is a stronger claim than one that is a product feature. Ask who can change the values and who has to agree.
• Framework mapping as output, not input. Collect against outcomes and evidence, then map to the ESRS, GRI, the SDGs etc at the presentation layer. Multi-framework reporting should not require multi-framework data collection. When the standards shift again you re-map rather than re-collect. Audiences work the same way: a board briefing, an investor appendix and an employee update are templates over one dataset.

The voluntary reporter’s advantage

Seventy-three per cent of investors say sustainability metrics should be assured to the same standard as a financial statement, and seventy-six per cent trust that information more once it has been assured. Those expectations did not disappear when the Omnibus cut the system’s scope.

There is a second return, and it usually wins the internal argument: data built this way is not only reportable, it is manageable. Outcomes on a common unit can be ranked, tracked year on year, forecast and benchmarked, so a programme that is not working shows up as a number rather than a feeling.

It is also the answer to the question the CFO is about to ask, which is why we are still funding this now nobody makes us. Here is what the programme changed, here is the rule we used to claim it, here is the evidence behind every figure, and here is the value against what it cost.

At Thrive we build that layer on the Impact Evaluation Standard, governed independently of us: a steering committee decides what a proxy value is, and the methodology is published. More than £12bn of social value has been reported through it across 25+ countries, valued against published proxy values rather than our own, with over a thousand validation rules running as data is entered.

The case for measuring your social impact properly never rested on a regulation, and the Omnibus has just demonstrated it.

If you’d like to find out more about how Thrive can help you meet the six tests that defensible data demands, get in touch today.

Q&A