CSRD and CSDDD after Omnibus I: who is still in scope, and what the chain is asked.
Directive (EU) 2026/470, known as Omnibus I, narrowed both laws on 24 February 2026. CSRD sustainability reporting now applies to companies above €450 million of net turnover and 1,000 employees. CSDDD due diligence applies from 26 July 2029 to companies above 5,000 employees and €1.5 billion of turnover. Smaller companies in their value chain may refuse CSRD information beyond a capped set.
What Omnibus I changed
Directive (EU) 2026/470 was adopted on 24 February 2026 and published in the Official Journal two days later. It amends both the Corporate Sustainability Reporting Directive and the Corporate Sustainability Due Diligence Directive. It follows Directive (EU) 2025/794 of 14 April 2025, known as «stop-the-clock», which had already postponed the dates of both.
CSRD: who reports, and from when
Individual sustainability reporting is now limited to undertakings that exceed both €450 million of net turnover and an average of 1,000 employees. The same test applies to parent undertakings on a consolidated basis. The wave for listed small and medium-sized undertakings has been deleted, not postponed.
Companies in this group report for financial years starting on or after 1 January 2027. The first wave, large public-interest entities such as listed companies, banks and insurers with more than 500 employees, is now a closed group for the financial years 2024 to 2026. Member States transpose these changes by 19 March 2027.
The power to adopt sector-specific reporting standards has been removed. The CSRD remains corporate reporting: it asks for information about the company, not product-level data.
The value-chain cap
Omnibus I protects companies in the value chain that do not exceed 1,000 employees on average. They have a statutory right to refuse information beyond a capped set when a reporting company asks for it for its CSRD report. The cap does not stop information shared voluntarily or owed under a contract or another law, and it does not affect due-diligence requirements.
CSDDD: who, what and when
The due-diligence directive now applies to EU companies with more than 5,000 employees and more than €1.5 billion of net worldwide turnover, and to non-EU companies with more than €1.5 billion of net turnover in the Union. Member States transpose it by 26 July 2028 and apply it from 26 July 2029. Article 16, on reporting, applies for financial years starting on or after 1 January 2030.
The duties themselves remain: a due-diligence policy, identifying adverse impacts, preventing and remedying them, a complaints procedure, monitoring and communication. Article 22, on the climate transition plan, was deleted. The EU-level civil liability rule of Article 29(1) was deleted too, and penalties are capped at 3% of net worldwide turnover.
Identification now starts with a scoping exercise, a first look at the general areas where adverse impacts are most likely, based on information reasonably available. The recitals state that this does not require identifying impacts entity by entity, that it will as a general rule preclude requesting information from business partners, and that digital solutions and industry initiatives can be appropriate resources.
The data these laws draw on
Neither law asks for a Digital Product Passport. What a company in scope needs is knowledge of its chain: who its direct suppliers are, where production takes place, which facilities hold which social and environmental certificates, until when they are valid, and which documents support each of these facts.
The chain mapped, with a document behind each link. The report stays yours.
Who made what, tier by tier
A company enters the map because another declared that it buys from it, with a document and a date. Tiers are computed from the links, and where nobody has yet been named the gap is drawn, not hidden.
Certificates with their validity
Suppliers upload their certificates and a person confirms what is read from them. Analytics shows in how many countries production takes place, which certificates expire and who has not answered yet. For social certificates, Tramaproof shows which labour criteria they cover, and says that this is not an audit of the site.
Each party sees what was declared to it
A brand sees the suppliers behind what it bought, and nothing about its suppliers' other customers. A supplier never sees another partner's data. Exports follow the same access rules as the screen.
Questions about the CSRD and the CSDDD
Does the CSRD still apply to fashion brands?
To those that exceed both €450 million of net turnover and 1,000 employees on average, for financial years starting on or after 1 January 2027. A company below either threshold is outside individual reporting from the second wave onward.
Can a supplier refuse a customer's CSRD questionnaire?
Within limits. A company that does not exceed 1,000 employees may refuse CSRD information beyond the capped set. The right does not cover what a contract or another law requires, nor due diligence.
When does the CSDDD apply?
From 26 July 2029, to companies with more than 5,000 employees and more than €1.5 billion of net worldwide turnover. Member States transpose it by 26 July 2028. The phased dates of the 2024 text were replaced by this single date.
Does the CSDDD still require a climate transition plan?
No. Directive (EU) 2026/470 deleted Article 22, which required it.
Does Tramaproof produce the CSRD report?
No. Tramaproof holds supply-chain data and the documents behind it: the map of suppliers by tier, their certificates and their answers. The sustainability statement stays with the reporting company and its advisers.