CSRD and the finance function in 2026 : Omnibus, simplified ESRS, CFO playbook

What is CSRD in one sentence ?

CSRD (Corporate Sustainability Reporting Directive) is the EU directive requiring large companies to publish an annual, audited sustainability report covering environmental, social and governance impacts, using ESRS standards. It replaced NFRD in 2024 and, before Omnibus, covered over 50,000 EU companies by 2028.

For the CFO, CSRD is not an "ESG topic" delegated to a chief sustainability officer : it's a legally binding report, audited by the statutory auditor, with the same reliability bar as consolidated accounts.

What did the February 2026 Omnibus change ?

The Omnibus adopted in February 2026 postpones by two years the scope extension to "wave 2" and "wave 3" companies, and cuts the number of mandatory ESRS datapoints by roughly 70%. Concretely :

• Mid-caps (250–5,000 employees) publish first report in 2028 (not 2026).
• Listed SMEs publish first report in 2029.
• Mandatory datapoints drop from ~1,140 to ~400.
• CSRD threshold raised to 1,000 employees (vs 250 initially).
• Value chain due diligence relaxed.

Result : ~80% of companies initially covered by CSRD exit the scope. Only ~7,000 EU companies remain in scope (vs 50,000 initially forecast).

Which companies are in CSRD scope in 2026 ?

In 2026, only large listed companies already publishing under CSRD in 2025 remain mandatory, plus large non-listed companies above 1,000 employees and €50M revenue. Post-Omnibus cascade :

• Wave 1 (2025 on FY 2024) : large listed companies previously under NFRD. Maintained.
• Wave 2 (originally 2026) : large non-listed > 1,000 employees. Postponed to 2028.
• Wave 3 (originally 2027) : listed SMEs. Postponed to 2029.
• Wave 4 (2029) : non-EU parent subsidiaries above specific thresholds.

For French B2B SaaS companies below 1,000 employees, CSRD drops off the 2026-2027 agenda. But indirect pressure (customer requests, bank ESG scoring) remains.

Which ESRS datapoints should the CFO steer ?

Priority ESRS datapoints for finance are : scope 1-2-3 carbon footprint, energy intensity, green taxonomy, governance diversity, and supplier payment terms. Omnibus retained these cores :

• ESRS E1 (climate) : scope 1, 2 and materially-significant scope 3 GHG emissions, transition plan.
• ESRS E3-E5 : pollution, water, biodiversity, circular economy (as material).
• ESRS S1 : pay equity, diversity, training.
• ESRS G1 : governance, business ethics, supplier payment terms (G1-6 datapoint).

The supplier payment terms datapoint (G1-6) is often overlooked yet sits at the heart of O2C/P2P processes. Reporting a high DPO with late-payment practices degrades the ESG score and can block access to some green financing.

Why is CSRD becoming a B2B credit issue ?

Banks and investors now use CSRD data to score corporate credit risk, turning sustainability into a cost-of-capital variable. Since 2025 :

• Mid-cap bank loans embed an "ESG spread" up to 30 bps.
• Green bonds and Sustainability-Linked Loans (SLL) tie coupon to CSRD KPIs.
• Large corporates (CAC 40) request CSRD reports from suppliers above €10M annual flow.

A CFO who ignores CSRD silently increases the cost of capital and risks being excluded from tenders.

How should the CFO organize in 2026 ?

The recommended setup is a trio : CFO sponsor, dedicated CSRD controller, sustainability data architect, anchored by a central ERP or ESG dashboard. Four workstreams to open in 2026 :

1. Governance : datapoint mapping, double materiality, governance committee.
2. Data : automated collection (scope 2 via energy invoices, scope 3 via ERP procurement, G1-6 via supplier module).
3. Audit : auditor engagement from June Y-1 to scope limited assurance.
4. Narrative : sustainability statement integrated into management report, held to the same quality bar as accounts.

Typical budget for a mid-cap in scope : €250k to €800k in year one, €150k to €400k steady-state.

FAQ

Is CSRD postponed or cancelled ?

Postponed, not cancelled. The February 2026 Omnibus postpones waves 2 and 3 by 2 years but retains the framework and ESRS. Wave 1 companies remain mandatory.

Do SMEs need to publish CSRD ?

No, except listed SMEs from 2029. Non-listed SMEs are out of CSRD. They can publish voluntarily (VSME standard) to serve customer and bank requests.

What's the link between CSRD and payment terms ?

ESRS G1-6 requires disclosure of average supplier payment terms and on-time payment ratio. It has become a conduct indicator, embedded in ESG ratings and bank scoring.

What's the cost of non-compliance ?

Missing or non-audited publication triggers fines up to €3,750 for the executive plus an order to publish. Bigger hit : loss of key customers, higher cost of capital, exclusion from public tenders.

Does CSRD apply outside the EU ?

Yes, indirectly. EU subsidiaries of non-EU parents with >€450M EU revenue must publish from 2029 (wave 4). And any supplier to a CSRD company must provide scope 3 data.

Conclusion

In 2026, post-Omnibus CSRD is both lighter and clearer. The smart CFO no longer treats sustainability as a compliance cost, but as a cost-of-capital and commercial competitiveness variable. Data reliability (including payment terms) is the differentiator.

👉 See how Cleavr lifts your G1-6 score by tying supplier payments to trade receivables. Let's talk.