What changes for SMEs under the new European ESG legislation

What will change for SMEs under the new European ESG legislation: ESG reporting obligations, deadlines and what to do now to be prepared.

Since the start of 2025, the European Union has rewritten a good part of the sustainability reporting rules. The Omnibus package drastically reduced the number of companies required to report and pushed several deadlines back, and as a result many managers are left unsure whether their company still has to do anything. This article gives a direct answer on what has changed, who is covered, when the rules apply and what an SME should do now, even without a formal obligation.

In short

✓The CSRD now applies to companies with more than 1,000 employees and more than €450M in turnover. The vast majority of SMEs fall outside its direct scope.
✓Being outside the law does not stop requests for data: large clients and banks continue to ask suppliers and credit customers for ESG information.
✓The VS (Voluntary Standard, formerly VSME) is the voluntary European framework applicable to companies not covered by the CSRD (up to 1,000 employees) and is used to answer those requests in an organised way.
✓Sector rules such as the EUDR and the CBAM reach companies of any size that import or trade in covered products.

What is the CSRD and why is it talked about so much?

The CSRD (Corporate Sustainability Reporting Directive) is the European directive that requires certain companies to publish a sustainability report with detailed information on their environmental, social and governance performance.

It is not new; it came into force in 2023. But its impact has widened progressively and, in 2025, the European Union significantly simplified its scope through the so-called Omnibus package. This revision cut the number of companies covered by around 90%, a substantial change that eased direct regulatory pressure on many organisations.

What the CSRD requires companies to report is organised around the three ESG dimensions:

Environment

Carbon emissions, energy and water consumption, waste management, impact on biodiversity.

Social

Working conditions, occupational health and safety, diversity, human rights in the supply chain.

Governance

Decision-making structure, business ethics, risk management, transparency and also innovation, which European regulation recognises as a component of good governance and organisational resilience.

Reporting follows the ESRS (European Sustainability Reporting Standards), the technical standards that set out exactly what to disclose and how.

What changed with the Omnibus package

The Omnibus amended three central pieces of European ESG legislation: the CSRD (the sustainability reporting directive), the CSDDD (the value chain due diligence directive) and the CBAM (the carbon border adjustment mechanism). The changes to the CSRD and the CSDDD have been approved, and Member States have until March 2027 to transpose the revised CSRD into national law and until July 2028 for the CSDDD.

Instrument	What changed	Who is covered
CSRD	Around 90% fewer companies in scope, 61% less mandatory data in the ESRS, the end of sector standards and only limited assurance audits.	More than 1,000 employees and more than €450M in turnover
CSDDD	A risk-based approach, focused on direct suppliers, and maximum fines of 3% of worldwide turnover.	More than 5,000 employees and more than €1.5 billion in turnover
CBAM	An annual threshold of 50 tonnes for most goods, which exempts around 90% of importers.	Importers of steel, cement, aluminium and fertilisers above 50 tonnes a year

In July 2026, the European Commission adopted the simplified ESRS and the VS (Delegated Regulation (EU) 2026/1560). The scrutiny period of the Parliament and the Council ended in September without objections, and the new ESRS become mandatory for financial years starting on or after 1 January 2027. Another relevant change for SMEs: smaller listed companies, which made up the former wave 3, are no longer covered.

Is my company covered?

The answer depends on three simple questions: how many employees you have, what your turnover is and whether you import or trade in products covered by sector rules.

More than 1,000 employees and more than €450M

The CSRD applies directly. Large unlisted companies make up wave 2, starting in financial years from 2027, with a first report in 2028.

Up to 1,000 employees

There is no direct reporting obligation under the CSRD, including for smaller listed companies.

Any size, with imports or sensitive products

The EUDR and the CBAM may apply, regardless of size.

Without a direct obligation, the pressure continues

The CSRD no longer covers most SMEs, but the companies that remain in scope need data from their supply chain in order to report. The law limits what they can demand: from a supplier with up to 1,000 employees, they can only ask for what is in the VS, from the 2027 financial year. They can ask for more, but the supplier has the right to refuse, and those who refuse risk losing the client or a tender. See how to respond to these requests in Clients demanding ESG? How to turn an obligation into an opportunity.

European banks follow the same logic and include ESG criteria in credit risk analysis, which makes organised information a concrete factor in access to financing. The VS covers both cases, with two modules: the Basic, with 11 disclosure requirements, and the Comprehensive, with 20 disclosure requirements.

For a complete guide to the standard, read the article VS (formerly VSME) explained: a practical guide for SMEs.

Regulatory timeline

The deadlines below reflect the information available in November 2026 and may still change in national transposition.

When	What happens	Who is affected
Since 2024	Wave 1 is already reporting under the CSRD.	Large listed EU companies
30 Dec 2026	The EUDR starts to apply.	Medium-sized and large operators
March 2027	Deadline for Member States to transpose the revised CSRD.	All Member States
2027	The VS, already available, starts to limit data requests to SMEs, and purchases of CBAM certificates begin, relating to 2026 emissions.	Small companies that report and covered importers
30 Jun 2027	The EUDR starts to apply.	Micro and small companies
Financial year 2027	Wave 2 and the simplified ESRS become mandatory, with reporting in 2028.	Large unlisted companies
2028	Wave 4 and transposition of the CSDDD, in July.	Non-EU companies and Member States
July 2029	The CSDDD starts to apply.	More than 5,000 employees and €1.5 billion

Sector rules that reach small companies

The EUDR, the European deforestation regulation, applies to any operator, however small, that places on the EU market timber, cocoa, palm oil, coffee, soy, rubber or cattle, and products containing them. For medium-sized and large companies, the obligations start on 30 December 2026 and, for micro and small ones, on 30 June 2027. The Commission published its review in May 2026 without changing these dates, so anyone working with these products should start identifying suppliers and origins now.

The CBAM affects those who import steel, cement, aluminium or fertilisers above 50 tonnes a year. Below that threshold, the company is exempt, but it may still receive requests for emissions data from clients or suppliers that are above it.

What to do now

None of these measures requires consultancy or major investment, and all of them serve both the manager who wants to decide and the coordinator who will carry them out.

Confirm your situation

Record the number of employees, the turnover and the products you import or trade, and compare them with the thresholds above.

Find out what you will be asked for

Talk to your clients and your sales team to understand what ESG information they will demand, and ask the bank which criteria it uses in credit analysis. Gather the questionnaires you have already received.

Gather the baseline data

Energy consumption, Scope 1 and 2 emissions, waste, number of employees, workplace accidents (with reference to ISO 45001, where applicable) and internal policies already cover a large part of the VS Basic module.

Adopt the VS as your framework

By starting with the Basic module, you answer several requests with a single database, instead of filling in a different questionnaire for each client.

Appoint an owner and set a calendar

A person with reserved time and an annual review date stop the subject from sitting idle until the next urgent request.

Book your ESG assessment

Find out what applies to your company, what data you already have and which steps to take first. The Sustanya team helps turn the new legislation into a simple plan, tailored to your SME.

Book an ESG assessment