SMEs are out of CSRD scope. But the data requests aren't.

For two years, the message to small and medium enterprises was simple (yet threatening): get ready, the CSRD is coming for you too. The good news is that this is no longer true. 

‍

In 2026, the EU rewrote the rules (again). Listed SMEs were taken out of mandatory reporting altogether. So if you're an SME, you almost certainly don't have to file a CSRD report. But the data requests landing in your inbox from banks, large customers, and investors? Those aren't going anywhere. Sorry. 

‍

In this article, we’ll go through what changed, what it means for you, and what's actually worth doing about it.

‍

What changed: the Omnibus.

In February 2025, the European Commission proposed a large simplification package, nicknamed "Omnibus I". After a year of negotiation, it became law. Directive (EU) 2026/470 was published in the EU's Official Journal on 26 February 2026 and entered into force on 18 March 2026.

‍

It does three things that matter to SMEs:

‍

• It raises the bar for who has to report
• It removes listed SMEs from scope entirely
• It caps what large companies can demand from the smaller ones in their value chain

‍

There was also an earlier "Stop-the-Clock" directive in April 2025 that pushed reporting deadlines back, and between the two, the CSRD you read about in 2023 is not the CSRD that exists today.

‍

Are you in scope? Probably not

Under the original CSRD, you were caught if you met two of three size criteria. But that test is gone, and in its place is a single, much higher bar. A company now has to report only if it has both:

‍

• more than 1,000 employees, and
• more than €450 million in net turnover

‍

The keyword here is “and”. It’s not one or the other. If you’re not over both thresholds, you're out of mandatory scope for financial years starting on or after 1 January 2027 and can sit back and relax. For the companies still caught, the timeline moved too. The next wave files its first reports in 2028, covering the 2027 financial year.

‍

And listed SMEs? Specifically and deliberately removed. The whole "Wave 3" category – the one this article used to be about (you remember that, right) – no longer exists. The simplified ESRS that was being built just for listed SMEs has been cancelled, along with the planned sector-specific standards. 

‍

So if you spent 2024 bracing for a deadline that was coming in 2026 – you’re officially off the hook. 

‍

Off the hook? Not quite

Oh, sorry about that. You’re not quite off the hook. Being out of mandatory scope doesn't mean nobody wants your data.

‍

The companies still in scope – the big ones – have to report on their value chains, and that includes their suppliers. Which might well include you. So the request gets passed down the chain: "Send us your energy and emissions data, please."

‍

Luckily, the EU saw this coming and built in a safeguard: the value-chain cap. If you have fewer than 1,000 employees, a large customer can't demand more from you than what's set out in the voluntary SME standard (the VSME). You have the right to decline anything beyond it.

‍

What this means is that the data pressure is real, but it's now limited. You're no longer expected to produce a full corporate-grade report just because a customer asked nicely.

‍

The VSME: the voluntary route

The replacement for all those scrapped SME rules is the VSME (are you keeping track of these initialisms?) – a voluntary sustainability reporting standard purpose-built for smaller companies.

‍

The European Commission recommended it in July 2025 and is turning it into a formal standard, expected to be finalised in 2026 (but don’t hold your breath). It covers the same topics as the full ESRS, but in a far lighter form, sized for companies that don't have an ESG manager or sustainability department on hand.  

‍

Two things make it worth knowing about:

‍

• It sets the ceiling for the value-chain cap. If (when) a customer asks for data, the VSME defines how far they can go
• It's a clean, credible way to answer those requests without reinventing your reporting every time

‍

Meanwhile, the main ESRS – the framework for the big reporters – is being trimmed as well. The revised version cuts mandatory data points by more than 60%. 

‍

The era of 1,000-plus data points is ending. Praise be.

What smart SMEs, like you, do now

Needless to say, this doesn’t mean you can just sit back and do nothing. The legal deadline might have disappeared, but the commercial reality didn’t. Sorry.

‍

If banks, investors, or large customers are asking for your energy and emissions data, you'll answer faster and look more credible when that data is already in order and at hand. 

‍

Here's where to focus.

‍

Get your energy data straight

Energy use is usually the biggest chunk of an SME's emissions, and it's the data most often requested. Know where it lives, how it's measured, and whether you can produce it on demand. If it's scattered across invoices and spreadsheets, that's the first thing to fix.

‍

Use the VSME as your template

Don't build a bespoke answer for every customer. Map your data to the VSME once, then reuse it. It's the standard the cap is built around, so it's the safest thing to point to when a request goes too far.

‍

Just say no

If a request exceeds the value-chain cap, you can say no. Knowing the boundary saves you from over-reporting out of politeness, which saves you time and your sanity.

‍

Treat it as an edge, not a chore

Customers and investors increasingly pick partners who can show their numbers. Being the SME that answers a data request in a day, with clean figures, is a real advantage. And with no compliance gun to your head, this is the best possible time to get it right.

‍

The short version

The CSRD won't force most SMEs to report, and listed SMEs are fully out. But your customers and banks still want the data; the VSME is now the standard that governs those requests, and good energy data is the thing that makes answering them painless.

‍

comundo helps SMEs collect accurate energy data automatically – the biggest slice of most companies' emissions. No hardware. No metre requirements. No spreadsheets. So when the next data request lands, you'll have the answer ready.

Book a demo and see how it works.

‍