Governance Frame

Research

← All briefings

Governance Frame Europe — July 2026: CSRD After Omnibus I and the Revised ESRS

54aac838-9094-4de5-ac24-993672505cbc

Executive Summary: EU sustainability reporting is being simplified—not abandoned. Omnibus I narrowed who must report; the Commission’s 3 July 2026 revised ESRS further reduce mandatory datapoints. Entities that remain in scope still need governed materiality decisions, reliable source data, clear ownership, internal controls, and assurance-ready evidence. Readers should track what is enacted, what is adopted but awaiting Official Journal publication, and what applies only from later financial years.

I. Exposure Vector

A multinational’s ESG working group hears that “CSRD was cancelled” or that “double materiality is gone.” Both slogans are governance hazards.

The July 2026 questions are sharper:

  • Are we still in mandatory CSRD scope after Omnibus I thresholds and transition rules?
  • If yes, which ESRS version applies to which financial year—and is early application of the revised standards available?
  • Has the revised ESRS delegated act been published in the Official Journal and entered into force, or is it adopted but pending that step?
  • What voluntary standard applies to smaller value-chain companies receiving data requests?
  • Who owns materiality judgments, datapoint controls, and assurance readiness inside the enterprise?

Omnibus I (Directive (EU) 2026/470) entered into force in March 2026 and revises the CSRD/CSDDD implementation path toward simplification and narrowed mandatory scope. [1]

On 3 July 2026, the European Commission adopted delegated acts comprising revised ESRS and voluntary reporting standards tied to that simplification programme, with a substantial reduction in mandatory datapoints relative to the first set of ESRS. Application timing for the revised standards is generally oriented to financial years beginning on or after 1 January 2027, with transitional/early-application options described in Commission and firm analyses of the adoption package. [2][3]

Until Official Journal publication and entry into force formalities are complete, treat the revised ESRS as adopted but verify in-force status before asserting binding application dates in legal memoranda.

II. Quantitative Context

LayerStatus signal (verify at publication)Governance meaning
CSRD as amended by Omnibus IIn force as legislation (member-state transposition clocks still matter)Recheck scope thresholds and wave timing
Revised ESRS delegated actAdopted 3 July 2026; confirm OJ publication / entry into forceNew datapoint baseline for in-scope reporters
Datapoint reductionCommission communications cite large percentage reductions in mandatory datapointsLess volume ≠ no controls
Voluntary / value-chain cap toolsAvailable for smaller companies under the simplification packageLimits trickle-down data demands beyond the voluntary set

Avoid false precision: do not invent a company-level “cost saving” percentage from EU-wide datapoint reduction claims. Translate simplification into a controlled gap analysis: which disclosures drop, which remain, who owns remaining data.

III. What Modern GRC Must Enforce

Keep five layers distinct

#LayerDo not conflate with
1Enacted CSRD requirements (as amended)Soft guidance blogs
2Omnibus I legislative changesESRS technical standards
3Revised ESRS delegated act textPolitical agreement summaries alone
4OJ publication / entry into force / FY application datesAdoption press dates
5Voluntary reporting options for smaller companiesMandatory in-scope duties

Control requirements for entities still in scope

Failure modeControl requirement
“We’re out of scope” without documented threshold analysisWritten scope memo with employee/turnover tests and counsel review
Materiality workshop without evidence trailRetain process, inputs, decisions, exclusions, and approvers
Datapoint collection via unmanaged spreadsheetsSource systems, owners, controls, and change history
Assurance treated as a year-end scrambleMap remaining datapoints to control owners early
Value-chain requests ignore the voluntary capAlign supplier questionnaires to permitted voluntary content

Recommended newsletter depth (operating checklist)

  • Scope determination under Omnibus I
  • FY mapping for current vs revised ESRS
  • Materiality governance (including climate where still mandatory unless immateriality is evidenced)
  • Datapoint inventory: retired / retained / new
  • Assurance and internal control readiness
  • Supplier data strategy under voluntary standard / value-chain cap

Less data still requires governed evidence. Institutional programmes consolidating sustainability datapoints alongside other GRC evidence often discover that the scarce resource is ownership clarity—not narrative drafting.

IV. Verification Protocol

  1. Confirm Omnibus I identity and entry-into-force posture from primary EU legislative texts or reputable legal summaries citing OJ citations. [1]
  2. Confirm Commission adoption of revised ESRS on 3 July 2026 from Commission or major firm alerts that quote the adoption acts. [2][3]
  3. Before promotion, re-check Official Journal publication and application dates—do not treat adoption as automatic in-force status.
  4. Reject “CSRD cancelled” and “double materiality abolished” framings unless a primary text expressly supports the claim (it does not, on current public analyses).
  5. Keep AI Act, DORA, and SEC cyber disclosure out of this newsletter’s lead subject.

Key Takeaways

  • Omnibus I and revised ESRS reduce burden; they do not remove governance for entities that remain in scope.
  • Separate legislation, delegated standards, OJ formalities, and financial-year application.
  • Materiality, data ownership, controls, and assurance evidence remain the operating core.

V. Sources & Citations