In March 2026, a lot of people in sustainability breathed out. The Omnibus package passed into law (EU Directive 2026/470) and lifted the CSRD threshold to more than 1,000 employees and over €450M in turnover.
In practice, around 80% of companies that were getting ready to report walked out of scope. SMEs were dropped. Wave 2 got pushed to 2028. In Portugal and Spain, where the directive hasn’t even been transposed, the whole thing sits in limbo.
Some teams closed the file and filed the work away. That’s the mistake.
The obligation didn’t disappear. It changed sender. It used to come from Brussels — now it comes from below you in the supply chain. The large companies still in scope need Scope 3 data from their suppliers, which means yours. The banks that price your credit against climate risk are asking for the same numbers. Your large customers are putting them in their procurement specs. Omnibus did introduce the "protected undertaking" status, which lets a small supplier refuse requests that go beyond the voluntary standards — but turning down data requests from your biggest customer is a commercial decision, not a legal one. And almost no one is actually going to make it.
So the regulatory bar dropped; the market bar didn’t. And worse, the market bar got messier. With the simplified ESRS only finalising near September 2026, and everything now subject to materiality, the requests you’ll receive won’t arrive in one neat format. They’ll arrive in ten different ones — one per customer, one per bank.
This is exactly why the annual report was always the wrong frame. If your sustainability data only exists to satisfy an annual filing, you’ll rebuild it every time someone asks: a bank in January, a customer in March, an auditor in June. Each request becomes a project.
If the data lives in operations — measured continuously, with the source attached to every number, ready to export — answering any request stops being a project and starts being a query.
The regulation shrank. The question didn’t. Treat sustainability as an annual PDF and you’ll rebuild it for every request. Treat it as operations and you answer in a click — and get back to the rest of the work.