The Disclosure That Didn't Disappear: How the EU Omnibus Is Re-Privatising Sustainability Reporting

The EU's Omnibus I directive frees roughly 80% of companies from mandatory sustainability reporting — but the demand for ESG data is not disappearing, it is migrating from one harmonised public standard to fragmented private gatekeeping by banks, insurers, ratings agencies and large corporate buyers, on a 2026-2028 horizon.

The consensus on the EU's Omnibus I package is that it is deregulation: the Corporate Sustainability Reporting Directive's scope has been cut by roughly 80%, the data points have been slashed, and the ESG reporting burden has been lifted. For companies dropping out of scope, the natural reading is relief. That reading is half right and strategically dangerous. The mandatory public regime has indeed shrunk. But the demand for sustainability data has not; it is simply changing owner. Banks, insurers, ratings agencies, index providers and large corporate buyers still need the data, and they are now the ones asking for it — bilaterally, contractually, and without a common standard. The weak signal beneath the deregulation headline is the re-privatisation of disclosure. The question for the next two years is not whether you must report, but to whom, and on whose template.

Signal Identification

This is a regulatory pivot whose real effect is on market structure. The Omnibus removes the legal obligation but not the underlying information need; it therefore relocates that need from a public, harmonised, audited channel into private channels that are fragmented, bilateral and unstandardised. The signal is the relocation itself — and the new gatekeepers it empowers.

Time horizon: 2-5 years (Omnibus in force March 2026; revised ESRS and voluntary-standard delegated acts adopted H2 2026; private-channel data regime consolidates 2026-2028; national transposition by March 2027) Plausibility band: Medium-High Geographic / Jurisdictional Scope: Primary: the EU (Omnibus I, CSRD/CSDDD, the value-chain cap, the VSME voluntary standard, CRD6). Spillover: third-country firms inside EU value chains, the UK, and globally via ISSB convergence and the financing and procurement reach of EU-domiciled banks and multinational buyers. Sectors exposed: Corporate sustainability and finance functions; banks, insurers and asset managers; ESG ratings and data providers; SMEs in corporate value chains; audit and assurance.

What's Changing

The legal architecture has been permanently narrowed, not merely delayed. As Gibson Dunn set out on 04/03/2026, Amendment Directive (EU) 2026/470 was published on 26 February 2026 and entered into force on 18 March 2026, raising the CSRD threshold to companies with over 1,000 employees and €450m turnover and removing roughly 80% of those previously in scope — with Wave 1 firms below the new thresholds dropping out for FY2025-2026 and transposition due by March 2027.

But the EU simultaneously revealed that it expects the data demand to persist. On 06/05/2026 the European Commission published, alongside its consultation on the revised ESRS, a Q&A on the new "value-chain cap" — a rule barring CSRD companies from requiring value-chain partners of 1,000 employees or fewer to provide more than the voluntary standard. The cap exists precisely because the trickle-down of data requests was expected to continue; and, crucially, it "applies only in the context of fulfilling CSRD reporting obligations" and "does not affect information requests for purposes other than sustainability reporting under CSRD."

Those other purposes are where the demand is concentrating. Green Central Banking reported on 25/02/2026 that banks still need transition plans and ESG data under CRD6 and other legislation even though the corporate obligation was cut; experts quoted warn of "increased fragmentation and reduced accountability," more data gaps, more estimation, and a growing role for specialised private data providers filling the space the public regime vacated.

Capital markets are repricing disclosure in parallel. S&P Global Ratings forecast on 12/03/2026 that the sustainable bond market will consolidate at $800-900bn in 2026, with the focus shifting "from growth to credibility, transparency and measurable outcomes" — even as some US issuers move to conventional bonds specifically to avoid the reporting that labelled debt entails. Disclosure is becoming a private negotiation, priced into financing terms.

Disruption Pathway

The pathway runs in three stages. Through 2026, the public regime is rebuilt smaller: the Commission adopts the revised ESRS and voluntary standard as delegated acts, and out-of-scope companies make a first decision — stand down, or report voluntarily because a customer or lender expects it. Through 2026-2028, the private channels harden: banks operationalise CRD6 data needs, insurers and ratings providers formalise their templates, and large buyers write sustainability clauses into supplier contracts. Beyond 2028, a two-tier equilibrium settles — a slimmed public standard for the largest firms, and a sprawl of private requirements for everyone financed by, insured by, rated by, or selling to them.

Stresses concentrate at four points. First, the mid-sized company now out of scope but inside multiple value chains, facing several non-identical bilateral requests instead of one audited report. Second, the financial institution that must assess transition and physical risk with a thinner public evidence base, and so estimates more and lends more cautiously. Third, the voluntary VSME standard, which becomes the contested floor — pulled up through finance and procurement faster than it was designed to rise. Fourth, comparability itself: with no single harmonised standard binding the mid-market, cross-company and cross-portfolio comparison degrades.

The structural adaptations are already visible in outline. Operationally, large buyers and lenders converge on the VSME as a shared template to contain fragmentation, and a private ESG-data-and-assurance industry expands to curate what the public regime no longer collects. Financially, the cost of the data gap is absorbed as wider risk margins, more conservative capital treatment, and a disclosure premium embedded in financing terms. Politically, expect pressure — from banks and supervisors as much as from NGOs — to re-standardise voluntarily what was just de-standardised by law.

Why This Matters

For boards and CFOs of companies leaving CSRD scope, the decision that needs revising is the instinct to treat the Omnibus as a clean exit. The relevant question is no longer "are we obligated?" but "who in our financing, insurance, ratings and customer base will ask — and can we answer on their terms?" For banks and insurers, the Omnibus is a data-risk event, not a relief: a thinner public evidence base means more estimation and more cautious capital allocation. For sustainability and finance functions, the work shifts from compliance reporting to managing a portfolio of bilateral private requests. And for SMEs, the value-chain cap is a shield only if they know it exists and how to invoke it. The institutions that read the Omnibus as the end of ESG reporting will simply meet it again — fragmented, contractual, and harder to manage.

Decision-action posture for this signal: Prepare — the legal change is settled but the private-channel regime is still forming, leaving a real window to set data strategy and capability triggers before the bilateral requests arrive in volume.

Counter-Argument

The strongest objection is that the EU has deliberately bounded exactly this dynamic. The value-chain cap, as the European Commission explained on 06/05/2026, prohibits CSRD companies from requiring small value-chain partners to provide more than the voluntary standard, and gives those partners a statutory right to decline above-cap requests. On this read, trickle-down is legally contained, the burden genuinely falls, and "re-privatisation" overstates a managed, capped transition that mostly delivers the simplification it promises.

The counter-counter is that the cap's own design concedes the signal. By the Commission's words it "applies only in the context of fulfilling CSRD reporting obligations" — so requests from banks under CRD6, from insurers, from ratings and index providers, and from non-EU buyers fall entirely outside it. Even within CSRD purposes, companies "may still request" above-cap information; the cap channels and labels the demand, it does not extinguish it. A rule built to manage trickle-down is evidence that the drafters expect the demand to keep flowing — just through private pipes.

Implications

Structurally, this looks like durable change rather than transient evolution. The legislative scope cut is permanent, not a delay; the financial-sector data need is hard-wired into prudential rules; and, as Moody's Ratings noted on 21/01/2026, businesses will increasingly disclose sustainability information to stakeholders "including regulators and lenders" while fragmented regulation pushes compliance costs up. When the public obligation contracts but the financing, insurance and procurement demand does not, the gap is filled privately — and private fillings are stickier than public ones, because they are written into contracts and capital models.

This signal is not a claim that the Omnibus achieves nothing — the largest companies do get a genuinely lighter, simpler public standard. It is also not a generic "ESG is resilient" story — the binding mechanism has changed owner and form, from public and harmonised to private and fragmented. And it is not only an EU compliance question — it reaches every third-country supplier, borrower and counterparty connected to an EU bank, insurer or buyer. Competing interpretations to hold alongside the primary signal: this could equally be read as a healthy market-led maturation in which finance, not regulators, sets a leaner de facto standard — or as a transparency loss in which fragmentation and estimation quietly raise the cost and lower the quality of sustainability data for everyone.

Early Indicators to Monitor

Disconfirming Signals

Strategic Questions

Keywords

EU Omnibus I; CSRD; sustainability disclosure; value-chain cap; VSME voluntary standard; ESG data; CSDDD; CRD6; transition plans; private gatekeeping; ESRS simplification; sustainable finance regulation

Bibliography

This Signal Scan is one component of a Shaping Tomorrow intelligence cycle on Regulation, Standards & Policy Change. Every monitored topic also includes monthly Change Trackers that assess what is materially shifting in momentum, and a quarterly Decision Intelligence briefing that converts the cycle into board-level strategic implications. Cycles may also close with Action Triggers, an end-of-cycle synthesis that reads across the three formats and surfaces patterns no single deliverable carries on its own. Continuous intelligence on this topic is available as a Single-Topic or Multi-Topic programme.

Discuss a Tailored Programme