Changes in EU sustainability reporting: What SMEs need to know

The revision of the European Corporate Sustainability Reporting Directive eases reporting requirements for SMEs, but it does not reduce the underlying risks. Voluntary sustainability reporting helps businesses understand their exposure, strengthen resilience and improve their position with insurers, lenders and clients. 

About CSRD 

Sustainability reporting in Europe has entered a new phase. The Corporate Sustainability Reporting Directive (CSRD), once set to capture around 45,000 companies has now been significantly recalibrated to around 10,000  [1].  

This change follows the Omnibus package, a revision that narrows the scope of the CSRD and simplifies elements of the European Sustainability Reporting Standards (ESRS), which entered into force on 18 March 2026.  

For many SMEs, this may come as a welcome relief. However, being “out of scope” does not mean being out of risk. 

Climate risk, supply-chain pressure, investor expectations and changes in the insurance market continue to affect businesses regardless of regulatory thresholds. SMEs and newly exempt companies remain exposed from a commercial, financial and operational perspective. 

How are the CSRD scope changes relevant for smaller businesses? 

The revised CSRD significantly reduces the number of companies required to report. Under the new thresholds, the CSRD applies to companies that exceed both: 

• EUR 450 million in net turnover; and 
• An average of 1,000 employees during the financial year. 

This applies to EU companies and certain non-EU companies that are listed on an EU regulated market. Companies in scope will be required to report from the financial year 2027. 

Large companies that already started reporting under the original CSRD (often referred to as “wave one” entities) must continue reporting for financial year 2025 and 2026. However, if they fall below the new thresholds, national law may exempt them from future reporting obligations. 

Figure 1 Source: Howden based on Commission Recommendation (EU) 2025/1710 and Directive (EU) 2026/470 [3] 

SMEs are protected from excessive data requests

Companies below the threshold fall into a new category called "protected undertakings." These are companies that:

• Have fewer than 1,000 employees; and 
• Are part of the value chain of a company that is required to report under the CRSD 

This status enables SMEs below the threshold to provide sustainability information voluntarily without further verification, as well as to refuse requests for information that goes beyond the voluntary sustainability standards

Limits of the protection 

These measures are intended to reduce the reporting burden and limit excessive data requests from larger companies. However, it does not: 

•  Prevent companies from sharing information voluntarily; 
• Override contractual or legal obligations, provided these do not exceed the scope of voluntary standards; 
• Apply to other types of information requests, such as due diligence, financing and risk management information requirements. 

Voluntary reporting remains encouraged 

The Directive explicitly states that companies remain free to carry out voluntary sustainability reporting. By 19 July 2026, the European Commission will adopt a delegated act setting out voluntary sustainability reporting standards for protected undertakings. These standards will be based on the existing Voluntary SME Standard (VSME), which companies can already use in the meantime. 

In practice, this means that: 

• Large companies and financial institutions are expected to request only the information included in the VSME standard;  
• SMEs should receive more consistent and streamlined data requests. 

The framework is structured into two modules: 

• A Basic module, covering essential disclosures 
• A Comprehensive module, allowing for more advanced reporting. 

These modules follow a similar structure to the ESRS used by larger companies but require fewer data points, allowing companies to progress over time (See figure 1). Request for information can go beyond the basic module that goes into further depth on the topics, as well as introduce new topics of interest to large companies, investors and insurers. 

Figure 2 Source: Howden based on Commission Recommendation (EU) 2025/1710 [4] 

What this means for SMEs out of scope 

Sustainability reporting becomes a strategic and forward-looking risk management. As investors, insurers and customers are increasingly interested in whether businesses are aware and ready for climate and ESG risks, voluntary reporting signals competitiveness in the long-term. 

Financial risk management 

The European Central Bank (ECB) and the Bank of England state that climate risk is a source of financial risk - affecting credit risk, market risk, operational risk and systemic stability. The ECB has gradually escalated the level of intervention since publishing a guide that states how banks are expected to prudently manage and transparently disclose such risks [5]. In 2024, the ECB imposed fines on banks in Spain and another in France this year for failing to meet climate-risk disclosure expectations, reinforcing that climate governance is not treated as a prudential issue. 

For SME board members, this means: 

• Climate risk is a financial, regulatory as well as a reputational risk 
• Voluntary sustainability reporting provides evidence of board oversight, risk assessment and mitigation planning. 

Resource independence and national security  

The European Commission, and the World Economic Forum have all characterised climate change as “risk multipliers. [6][7]” Global biodiversity loss is now widely described as a systemic risk to economic stability and food systems. For sectors dependent on agriculture, raw materials, logistics or energy, these are not abstract concerns.  

For SMEs supplying to multinational corporates or operating in critical sectors, voluntary reporting can: 

• Demonstrate structured sustainability risk management 
• Strengthen positioning in a world where national security and resilience are priorities. 

Strategic dataset for future access to capital and insurance 

Institutional investors, guided by recognised climate and sustainability-related financial disclosure frameworks such as TCFD [8], ISSB [9] and increasingly integrated risk frameworks, continue to require transparent, consistent, decision-useful sustainability information. Private capital investors are reassessing portfolios after material losses linked to extreme weather events that damage infrastructure and logistics [10]. Even if reporting is no longer mandated, capital providers may still expect information. 

In addition, insurance premiums for physical risk are projected to rise by around 50% by 2030. In 2024, 60% of losses ($223 billion) was uninsured, creating a climate protection gap [11].  

For brokers and insurers, SMEs’ structured climate risk data can: 

• Facilitate better risk modelling and evaluation 
• Support companies in negotiating for premium and coverage. 

Competitive edge in supplier bids 

Large corporates still subject to CSRD must assess and disclose value-chain impacts and risks. While the Omnibus introduced protections that limit excessive information requests from SMEs, the commercial pressure may remain, and the protection does not cover other due‑diligence or risk‑management information requirements.  

SMEs that proactively align with the voluntary SME standards or CSRD-aligned framework can: 

• Strengthen preferred supplier positioning  
• Brand your business with sustainability credentials to secure long-term contracts. 

For any questions, please contact the Howden team to discuss how can support your business.