After months of uncertainty, the outlook for key EU sustainability laws is far clearer.

On November 13, 2025, the European Parliament adopted its negotiating position on the Corporate Sustainability Reporting Directive (“CSRD”) and the Corporate Sustainability Due Diligence Directive (“CSDDD”) Omnibus simplification. This follows the European Commission’s Omnibus proposal in February (see more here) and the Council of the EU’s negotiating mandate in June (see more here). “Trilogue” negotiations between the three institutions began on November 18, 2025, with the aim of finalizing the legislation by the end of 2025 (see four-column document here).

This post uses the Parliament’s position as the basis to set out some of the key points on the CSRD and CSDDD that have been the focus of debate. It also flags some key outstanding discrepancies between the Parliament and Council positions which will need to be ironed out in the Trilogue negotiations. So while the legislative journey is not yet over, the emerging alignment on these texts is finally coming into greater focus. As a result, companies are now starting to reinvigorate their efforts to prepare for compliance, given the significant areas of convergence between the Parliament and Council (flagged in brackets below) and confirmation that both institutions continue to support the extraterritorial application of the CSRD and CSDDD to certain non-EU parent companies.

CSDDD

• Applicability Thresholds (Parliament and Council aligned):
  • For EU-incorporated companies: 5,000+ employees and over EUR 1.5 billion in net worldwide turnover (on a consolidated basis for EU ultimate parent companies of corporate groups).
  • For non-EU-incorporated companies: EUR 1.5 billion in net turnover generated in the EU (on a consolidated basis for non-EU ultimate parent companies of corporate groups).
• Timing (Parliament and Council not aligned):
  • Application: The Parliament proposes to maintain the CSDDD application timeline set out in the Commission’s “Stop the Clock” proposal, i.e., obligations will apply to all in-scope companies starting July 26, 2028. The Council, in contrast, proposes postponing the CSDDD’s application by another year, to July 26, 2029.
  • Transposition: The Parliament maintains the Commission position on the Member State transposition deadline (July 26, 2027), whereas the Council would also push this by a year (July 26, 2028).
• Level of Harmonization (Parliament and Council partially aligned): All three institutions propose a significantly broader harmonization of CSDDD obligations across the Member States. Parliament proposes the most extensive harmonization with mandatory alignment for all provisions from Articles 6 to 16. Parliament also proposes deleting the provision that would allow Member States to introduce more stringent or more specific due diligence obligations. This expanded harmonization would substantially reduce the risk of fragmented national requirements across the EU.
• Changes to Due Diligence Obligations (Parliament and Council not aligned): The main focus of recent debates has been the required approach to identification and assessment of adverse impacts (under Article 8). Some of the key areas of divergence are as follows:
  • Broader Value Chain Scope and Risk-Based Approach to the Identification and Assessment of Adverse Impacts: The Parliament proposes requiring a company to cover the entire in-scope chain of activities (including both direct and indirect business partners) when identifying and assessing adverse human rights and environmental impacts. Rather than limiting the due diligence obligations to specific “tiers” of the supply chain, the Parliament position emphasizes a risk-based approach that takes into account relevant risk factors. This is in contrast to the Commission and Council positions which seek to introduce a two-tiered approach that limits impact assessment obligations to a company’s own operations, its subsidiaries, and direct business partners in the chain of activities (with additional triggers for when indirect business partners may be included).
  • Reframed Risk Identification and Assessment Steps: The Parliament’s position reframes and somewhat limits the risk identification and assessment requirements:
    • Step One: Companies must first carry out a “scoping” exercise (revising the Commission’s “mapping exercise”), relying solely on “already reasonably available information” to identify general areas where adverse impacts are most likely to occur and most severe. During this initial phase, companies are expressly not required to request information from their business partners.
    • Step Two: Based on the results of their scoping exercise, companies would only proceed to a “further assessment” (replacing and limiting the Council’s “in-depth assessment”) where, based on “relevant and verifiable information,” they have “grounds to believe” that adverse impacts may arise or have arisen, and only in the areas that were previously identified to be most likely to occur and most severe.
  • Value Chain Information Cap: For the purposes of further assessments in “Step Two” above, companies must only seek information from business partners where necessary, and never in the areas where no likely and severe risks were identified. To protect smaller companies from burdensome requests, in-scope companies can only request additional information from business partners with fewer than 5,000 employees (in contrast to the Council’s 1,000 employee cap) as a last resort, and only if that information cannot reasonably be obtained by other means. All information requests must be targeted, reasonable, and proportionate.
  • Other Substantive Obligations (Parliament and Council aligned in key areas): While the nature of the other substantive obligations (Articles 9–16) is broadly aligned between the Parliament and Council positions, some differences must still be resolved. For example, in Articles 10 and 11, the Parliament has proposed that it will always be voluntary for a company to suspend a relationship with a business partner as a way to prevent or end adverse impacts (the Commission proposed these “last resort” measures as mandatory). The Parliament also proposes to shorten Article 15’s regular due diligence assessment interval to four years, in contrast to the five-year interval proposed by the Commission and Council.

• Climate Transition Plans (“CTPs”) (Parliament and Council not aligned): The Parliament’s proposal removes the mandatory CTP requirement entirely by deleting Article 22. This differs from the Council’s position, which maintains the obligation for companies to have a CTP, albeit with reduced obligations.

• Civil Liability (Parliament and Council aligned): Both the Parliament and Council support the Commission’s proposal to remove the mandatory EU-wide civil liability regime. Civil liability for CSDDD breaches would still be subject to the rules and procedures of each Member State’s national court system.

• Penalties (Parliament and Council aligned): Both the Parliament and Council require the Commission, together with Member States, to develop penalty-setting guidance for supervisory authorities. The Parliament clarifies that this guidance should spell out the “appropriate level” of penalties, a requirement not included in the Council’s text. Instead, the Council’s position includes a mandatory “cap” on penalties in the operative provision. However, in the Recitals the Parliament also agrees with the Council that the maximum limit for pecuniary penalties should be set at 5% of the net worldwide turnover.

CSRD

• Applicability Thresholds (Parliament and Council not aligned):
  • For EU companies: The Parliament’s proposal increases the proposed employee threshold to 1,750+ employees (the Council sets the threshold at 1,000+ employees). The Parliament maintains the Council’s proposed turnover requirement of over EUR 450 million.
  • For non-EU ultimate parent companies: The Parliament’s proposal limits applicability to non-EU ultimate parent companies that have an EU-incorporated subsidiary or branch in the EU that generates more than EUR 450 million in net turnover. The Council maintains the prior structure of the threshold that requires (i) a large EU subsidiary or branch and (ii) the non-EU parent to generate more than EUR 450 million of turnover “in the EU.”
  • The Parliament proposes to exempt from direct reporting requirements “financial holding” companies that have the sole purpose of acquiring and managing shares in other companies, without directly or indirectly being involved in the management of those companies. The subsidiaries of those companies may have reporting requirements, if they meet the applicability requirements in their own right.
  • Separately, on November 13, 2025, a Delegated Regulation entered into force that provides reporting relief for companies that were required to publish CSRD sustainability statements on FY 2024 data (Wave 1 companies). Applying retroactively from January 1, 2025, the Delegated Regulation ensures that companies in the first wave of CSRD reporting will not be required to disclose additional information when reporting on FY 2025 and FY 2026 data beyond what was in their FY 2024 sustainability statements.

• ESRS (“European Sustainability Reporting Standards”): The Parliament’s position broadly aligns with the Commission’s proposal and the Council’s position that reporting standards must be simplified and reduced. The Parliament also tasks the Commission with developing sector-specific guidelines to assist voluntary sector-specific reporting. The European Financial Reporting Advisory Group (“EFRAG”) has announced that the next draft of the simplified ESRS will be released on December 4, 2025. EFRAG’s initial proposal for revisions in the Amended ESRS confirm that the CSRD’s distinct double materiality assessment will be preserved (albeit streamlined), and both the Council and the Parliament ask that the Commission provides further clarity on the application of the double materiality principle when it adopts the Amended ESRS as a delegated act.

• Value Chain Information Cap: The Parliament proposes that companies reporting under the CSRD are not allowed to request information from companies with an average of less than 1,750 employees and a net turnover of EUR 450 million, beyond what is required under the voluntary reporting standard for non-listed micro, small and medium enterprises (“VSME”). By comparison, the Council limited this cap to companies not exceeding an average of 1,000 employees. This cap will only apply to information requests for CSRD reporting purposes, and not to other commercial information exchanges.

• Taxonomy Reporting: As in the current CSRD, only companies within the proposed scope of CSRD reporting (which varies among the three institutions) will be required to report under Article 8 of the Taxonomy Regulation. The Parliament and the Council agree to delete the Commission’s proposed option to report on partial Taxonomy alignment.

We expect to see growing clarity on these outstanding questions over the coming weeks. By early 2026, there will likely be a final CSRD/CSDDD Omnibus that amends the current CSRD and CSDDD rules, and which Member States must then transpose into national law applicable to companies.

* * *

If you have any questions concerning the material discussed in this post, please contact the members of our Sustainability/Environmental, Social, and Governance (ESG) practice.