Your startup just fell out of CSRD scope. The questionnaire is still coming.

tl;dr. The EU's omnibus package, finalized in early 2026, cut CSRD's direct scope to companies with more than 1,000 employees and over 450 million euros in annual turnover. Almost every startup and scale-up reading this is now formally out. Celebrate briefly, then notice what did not change: your large customers still report, their value chain is still in their report, and the data request lands in your inbox as a procurement questionnaire instead of a directive. There is a voluntary standard designed to be your sane answer to it, a cap on what big companies are allowed to demand from you, and a quiet product opportunity for anyone whose software touches energy or infrastructure. Here is the post-omnibus map for builders.

For about two years, the standard advice to European tech companies was to start preparing for CSRD before it reached you. I gave versions of that advice myself. The omnibus changed the facts, and when the facts change, the advice should too.

What actually happened

The short version of a long and messy political process: the European Commission proposed simplifying its sustainability rules in February 2025, the Parliament and Council fought over it for most of a year, a deal landed in December 2025, and the final directive was adopted and published in February 2026, entering into force in March.

The headline change is scope. CSRD now applies only to companies with more than 1,000 employees and more than 450 million euros in net annual turnover. The earlier regime would have pulled in large chunks of the mid-market and listed SMEs; the new thresholds remove them. Companies that were already reporting and still clear the new bar continue, with simplified standards on the way, a lighter ESRS is expected to be finalized during 2026, mandatory from the 2027 fiscal year with optional early adoption. Companies that were bracing for later waves and no longer qualify are, in the main, released, with member states able to exempt those who would otherwise have reported for only a transitional year or two.

If you run a startup or a scale-up, the practical reading is simple: unless you are far larger than the typical company using that label, direct CSRD reporting is no longer your problem. No double materiality assessment, no ESRS data points, no assurance engagement. The compliance project you may have been quoted for last year is, for you, cancelled.

That is genuinely good news, and I am not going to pretend otherwise. The burden was disproportionate for smaller companies, and the correction is rational. But the story does not end there, because the mechanism that was always going to reach you first was never the directive itself.

The questionnaire that survives the directive

The companies still in scope, the banks, the utilities, the industrial groups, the large retailers, must report on their value chain, and you are the value chain. Their emissions accounting includes the goods and services they buy; their risk disclosures include their suppliers. Which means the reporting obligation you escaped reappears, translated into commercial English, as a supplier questionnaire attached to a procurement process, a bank financing review, or an enterprise sales cycle.

This was already happening before the omnibus and it does not stop after it. If anything, the dynamic sharpens: the companies that remain in scope are the largest ones, exactly the customers a B2B startup most wants, and their procurement and sustainability teams need numbers from somewhere. If you sell into enterprises, lease space from institutional landlords, or borrow from European banks, some version of "what are your emissions and your climate practices" reaches you regardless of what any directive says about you directly.

The EU understood this trickle-down problem, and the post-omnibus framework contains two things a smaller company should actually know about, because together they define your reasonable response.

The first is the value chain cap. The rules limit what in-scope companies may demand from smaller partners in their chain: the reference point is the voluntary SME standard, and large companies are not supposed to require reporting beyond it from companies under the thresholds. This is your shield. When a customer's questionnaire arrives asking for disclosures that would embarrass a mid-cap, you are entitled to push back to the standardized baseline, and well-run procurement teams increasingly know it.

The second is that baseline itself: the VSME, the voluntary sustainability reporting standard for SMEs. It is deliberately small, basic organizational data, energy and emissions at a level a normal company can produce, a short list of policy questions, and it is on its way to being the lingua franca answer to every scattered ESG questionnaire. The efficient move for a smaller company is to prepare one VSME-shaped answer pack once a year and reuse it everywhere, rather than bespoke-answering every customer's homemade spreadsheet. One document, many questionnaires.

That is the whole defensive playbook, and it is deliberately boring: know you are out of direct scope, know the cap protects you from over-broad demands, keep a lightweight VSME-style pack current, and route every incoming questionnaire to it.

What I would still measure anyway

Defensive compliance is the floor. There are two reasons a technology company might voluntarily go further, and both are self-interested rather than virtuous.

The first is that the cheapest time to build carbon visibility into your own operations is before anyone forces you. For a software company, the material footprint is mostly cloud, and the major providers now hand you usage-based emissions data of varying quality through their consoles and APIs. Wiring that into a dashboard is days of work, not months. If you later grow into scope, cross a threshold, get acquired by someone in scope, or take money from a fund whose LPs ask portfolio-level questions, you will be glad the historical data exists, because you cannot retrofit measurement onto the past.

The second reason is the interesting one: the AI workload question is coming for all of us. Inference and training costs are becoming a visible line in both budgets and energy debates, and customers have started asking their vendors about the footprint of AI features specifically. A vendor who can answer with measured numbers rather than a shrug has a quiet advantage in exactly the sales conversations where these questionnaires live. Measuring your compute footprint per service, and increasingly per model call, is cheap insurance against a question whose frequency only goes up.

The product opportunity did not shrink, it moved

Here is the part I find most interesting as a builder, and it is the inversion of the doom framing.

The omnibus reduced the number of companies that must report, but the ones that remain are the largest buyers in Europe, their value-chain data problem is unchanged, and the standards they report against are being simplified and stabilized right now, which is exactly the moment tooling markets consolidate. Meanwhile an entire mid-market that escaped mandatory reporting still faces the questionnaire economy, and what it wants is not a compliance suite but a cheap, mostly automated way to produce a credible VSME-shaped answer once a year.

For anyone building in energy, infrastructure, or B2B software, the same logic applies one level down: if your product sits where energy is consumed, produced, or billed, the carbon number is increasingly a data field your enterprise customers need from you, and exposing it well is product work, not reporting work. The regulation got smaller. The data demand did not.

The honest post-omnibus summary for a founder is this: you probably owe the regulator nothing, you owe your biggest customers a tidy standardized answer, you owe your future self a measurement habit that costs almost nothing to start now, and if you are building products in this space, the buyer pool just got clearer, not smaller.

If you are trying to work out what your company's actual exposure is, or where the product opportunity sits in your corner of the energy and climate stack, this is familiar ground in my advisory work. Details on the consulting page.