Over the past five years, the European Union has systematically built one of the world’s most ambitious regulatory frameworks for sustainable business. The goal is clear: to steer capital, business and supply chains in a more sustainable direction — not through voluntary pledges, but through binding legislation.
In companies’ everyday work, this shows up as a growing flood of requirements. There’s more to report, and in more detail. Supply chains have to be known more deeply. The environmental impacts of products have to be documented, human rights risks have to be mapped, and all of this has to be verifiable — not with words, but with data.
At the same time, the regulatory framework is constantly in motion. Timelines have been pushed back, scopes have been narrowed and directives have been amended mid-process. The EU’s Omnibus I directive significantly eased the requirements of the CSRD and the CSDDD, and it entered into force in March 2026. So is regulation actually easing after all?
The answer is clear: the basic direction hasn’t changed. Transparency requirements are growing, responsibility for supply chains is expanding and sustainability data is becoming an ever more central part of business — in financing, in procurement and in customer relationships.
We’ve put together an information package to make the big picture easier to grasp. We go through the nine most important pieces of EU sustainability regulation — what each one means, who they apply to and how to prepare for them.
One thing is worth keeping in mind: regulation doesn’t only apply to large companies. The requirements also trickle down through supply chains to SMEs — often faster than expected.
The key regulations in force and coming up
CSRD — Corporate Sustainability Reporting Directive
What is it?
The CSRD is the EU’s sustainability reporting directive, which requires companies to report on their sustainability performance annually as part of their management report. The reporting covers environmental, social and governance (ESG) aspects in accordance with the principle of double materiality — meaning the company must assess both how sustainability risks affect the company and how the company affects the environment and society.
The content of the reporting is defined by the ESRS (European Sustainability Reporting Standards), which cover the environment, social responsibility and governance. With the Omnibus I package, the number of data points has been significantly reduced and the role of the materiality assessment has grown — so a company reports only what is material to its business.
Who does it apply to?
The CSRD is being phased in. The first large listed companies — listed companies, credit institutions and insurance companies with more than 500 employees — have already reported on their 2024 data in line with the original timeline.
The original directive would have extended the reporting obligation to a considerably larger group of companies as early as 2025–2026. The Omnibus I directive (EU) 2026/470 changed this significantly: the application threshold was raised and the timelines were pushed back. Going forward, the reporting obligation applies to companies with more than 1,000 employees and net turnover exceeding €450 million. These companies will report for the first time in 2028, for financial years beginning on or after 1 January 2027.
The changes mean that many companies that had already prepared for a reporting obligation in the coming years were given more time. The direction is nevertheless clear — reporting obligations are expanding in general, and through supply chains the requirements will sooner or later affect almost all companies.
How to prepare?
Even if the CSRD doesn’t yet apply to your company directly, it’s worth starting to systematise data collection now. Your customers may ask for your sustainability data before the law requires you to report — and by then it’s too late to start building processes. The VSME is a good standard for smaller companies to lay the groundwork for reporting, because under the Omnibus, the information collected from the value chain must be limited to what the VSME standard requires.
VSME — Voluntary Sustainability Reporting Standard for SMEs
What is it?
The VSME is a voluntary sustainability reporting standard developed specifically for SMEs. It is a lighter version of the ESRS standards for large companies — clearer in structure, lighter in requirements and practically achievable without an extensive reporting organisation.
The standard is divided into two levels: the basic module covers the company’s most essential sustainability information, and the comprehensive module offers more detailed reporting for those who want to go deeper. The company can choose itself which level it reports on.
The standard’s status is currently changing. On 3 July 2026, the Commission adopted a delegated act that elevates the standard from a recommendation to EU legislation — and at the same time its name is settling into the form Voluntary Standard (VS). The act is under scrutiny by the European Parliament and the Council, and it will enter into force if neither objects within a two-month period. Reporting itself remains voluntary — what becomes binding is what large customers are allowed to request from their suppliers.
Who does it apply to?
The VSME is voluntary — no law requires an SME to report in accordance with it. Its practical significance is nevertheless great: under the Omnibus I package, large companies subject to reporting obligations may request only VSME-based information from companies in their supply chain with fewer than 1,000 employees. The VSME is therefore the ceiling for information requests — not the floor.
In other words: if you are a supplier to a large company, the customer can ask you for information — but no more than what is defined in the VSME.
However, the ceiling only applies to what the customer may require for its own sustainability reporting. It doesn’t restrict what a company may choose to report itself, nor does it apply to contract terms or information requests based on other legislation. If a customer requests information beyond the ceiling, it must state which information exceeds the limit and that the supplier has a statutory right to refuse.
How to prepare?
It’s worth getting familiar with the VSME now, even if no one is asking for anything yet. It’s a practical tool for structuring your own sustainability data — and when a customer sends a survey, answering is much easier when the information has already been compiled.
The EU Taxonomy
What is it?
The EU Taxonomy is a classification system that defines which economic activities can be considered environmentally sustainable. It isn’t a reporting obligation as such, but a common language — a standard that allows investors, financiers and companies to assess the sustainability of activities on a comparable basis.
The Taxonomy covers six environmental objectives: climate change mitigation, climate change adaptation, the sustainable use and protection of water and marine resources, the circular economy, pollution prevention and control, and the protection of biodiversity. An activity is classified as Taxonomy-aligned if it contributes substantially to at least one of these objectives and does no significant harm to the others.
Who does it apply to?
The Taxonomy reporting obligation applies directly to companies within the scope of the CSRD — they must report what share of their turnover, capital expenditure and operating expenditure is Taxonomy-aligned. Indirectly, the Taxonomy has a broader impact: banks and investors increasingly use it as a criterion in their financing decisions. A company whose activities don’t meet the Taxonomy criteria may face stricter financing terms or weaker investor interest.
How to prepare?
Even if the Taxonomy reporting obligation doesn’t apply to your company directly, it’s worth understanding which category your own business falls into. In financing negotiations and customer relationships, the question can come up surprisingly quickly. Knowing the Taxonomy criteria also helps you identify where developing your own operations will have the greatest impact.
CSDDD — Corporate Sustainability Due Diligence Directive
What is it?
The CSDDD is the EU’s corporate sustainability due diligence directive, which requires companies to identify, prevent and remedy adverse impacts on human rights and the environment across their entire value chain. This isn’t about reporting — it’s about action. A company must build a systematic process to assess and manage risks both in its own operations and in its supply chain.
In practice, this means things like risk mapping, supplier assessments, contract terms, training and, where necessary, ending business relationships if a supplier fails to correct identified shortcomings.
Who does it apply to?
With the Omnibus I package, the directive’s application threshold was raised significantly. The CSDDD applies directly to companies with more than 5,000 employees and turnover exceeding €1.5 billion. Member States must transpose the provisions into national law by 26 July 2028, and the obligations apply to companies from 26 July 2029.
SMEs are not directly within the directive’s scope — but the impact is still real for them too. The large companies covered by the directive are starting to require documented evidence from their suppliers of their human rights practices, environmental impacts and risk management.
How to prepare?
The requirement doesn’t come only from the law, but also from customers — often attached to a request for proposal. That’s why it’s worth starting by identifying the risks in your own supply chain: which countries you source from, under what conditions products are manufactured, and whether there are opaque parts in the subcontractor chain. Document your practices and make sure your code of ethics is up to date.
EUDR — EU Deforestation Regulation
What is it?
The EUDR is the EU Deforestation Regulation, which aims to ensure that products placed on the EU market or exported from it have not contributed to deforestation or forest degradation anywhere in the world. The regulation prohibits placing a product on the market altogether unless it meets three conditions at the same time: it is deforestation-free, it has been produced in accordance with the legislation of the country of production, and a due diligence statement has been submitted for it to the EU’s TRACES database. All three conditions must be met — one or two is not enough.
The regulation covers seven key commodities and products derived from them: palm oil, soy, coffee, cocoa, wood, cattle and natural rubber — in practice, for example, beef, furniture, chocolate and rubber products. The list may be updated if information on deforestation areas changes.
Who does it apply to?
The regulation applies to all companies that place these commodities or products derived from them on the EU market or export them from the EU. Application begins on 30 December 2026 for large and medium-sized companies, and on 30 June 2027 for small companies — those with fewer than 50 employees and turnover under €10 million.
The regulation doesn’t apply to all industries, but its effects reach far — for example in the food, forestry, furniture and textile industries and their supply chains.
On 4 May 2026, the Commission published a simplification package and confirmed at the same time that the start of application will not be postponed again. The package eases the administrative burden considerably, but the actual due diligence obligations remain unchanged. So the timeline is now certain.
How to prepare?
First, find out whether your company falls within the scope of the regulation — go through Annex I of the regulation and check whether the customs codes of your company’s products are listed. If you fall within scope, map the geographical origin of your products across the entire supply chain and register in the EU’s TRACES system well before the application date.
CBAM — Carbon Border Adjustment Mechanism
What is it?
CBAM is the EU’s carbon border adjustment mechanism, whose purpose is to prevent so-called carbon leakage — a situation in which companies move their production outside the EU to avoid the costs of the EU Emissions Trading System. The importer buys carbon certificates corresponding to the carbon price that would have been paid if the product had been manufactured under the EU’s emissions trading rules.
CBAM isn’t a reporting obligation — it’s a direct financial mechanism that makes emissions-intensive imports more expensive.
Who does it apply to?
CBAM applies to companies importing certain goods into the EU: iron and steel products, aluminium, cement, fertilisers, hydrogen and electricity. The full payment obligation began on 1 January 2026.
Simplification Regulation (EU) 2025/2083 brought significant relief: the obligations apply only to importers whose total CBAM imports in a calendar year exceed 50 tonnes. In practice, this means a large share of smaller importers are exempted from the obligations entirely. However, the threshold doesn’t apply to hydrogen or electricity — for these, the obligations apply regardless of the import volume.
The key challenge remains, however: responsibility for declaring emissions data lies with the importer, but the data has to be obtained from the manufacturer of the goods. If there are intermediaries in the supply chain, the flow of information becomes more difficult — but the responsibility still stays with the importer.
How to prepare?
First, find out whether the goods you import fall within the scope of CBAM and whether the 50-tonne annual threshold is exceeded. If it is, make sure you have a direct connection to the manufacturer of the goods to obtain emissions data, and include a clause on emissions data in your purchase contracts.
Forced Labour Ban — Regulation (EU) 2024/3015
What is it?
The EU Forced Labour Regulation prohibits the import, export and sale of products made with forced labour on the EU market. The ban covers the entire supply chain, from raw material sourcing to the end product — including e-commerce and distance selling. In line with the ILO definition, forced labour means work exacted from a person under the threat of a penalty and without their voluntary consent — including child labour and state-imposed forced labour.
If forced labour is found in the manufacture of a product, the company can be required to withdraw the products from the market and dispose of them appropriately.
Who does it apply to?
The regulation applies to all companies regardless of size or industry — to both products made in the EU and imported products. The regulation entered into force on 13 December 2024 and will apply after a three-year transition period, from 14 December 2027. In Finland, the national implementing act is currently out for consultation.
An important note: the regulation doesn’t create new due diligence obligations for companies, but it does emphasise companies’ responsibility for supply chain transparency. When suspicions arise, the authorities can require detailed information on supply chains within 15 days.
How to prepare?
Map the high-risk countries and product groups in your supply chain now. The European Commission will publish a database of forced labour risk areas, which will make assessment easier. Make sure your supplier contracts include clauses prohibiting forced labour and that you can request explanations from suppliers on short notice if needed.
ESPR — Ecodesign for Sustainable Products Regulation
What is it?
The ESPR is the EU’s Ecodesign Regulation, which aims to make sustainable products the norm on the EU market. It significantly broadens the scope of the old Ecodesign Directive — alongside energy efficiency, recyclability, repairability, material efficiency, resource use and the environmental impacts of products across their entire lifecycle now come to the fore.
One of the regulation’s key innovations is the digital product passport, which will track a product’s entire lifecycle from manufacturing to recycling. It contains information on the product’s materials, emissions, repairability and recyclability — and requires data from along the supply chain as well.
Who does it apply to?
The regulation will affect almost all product groups through delegated acts — with the exception of food, medicines and vehicles. The first product groups for which requirements are being prepared are textiles, furniture, electronics, iron and steel, aluminium and chemicals. New product regulations are expected for around 30 product groups in 2025–2030.
The regulation applies to all products placed on the EU market — including imported products and e-commerce. Regardless of size or industry: if the product is on the market, the requirements apply. The first concrete obligation took effect on 19 July 2026: large companies may no longer destroy unsold apparel, clothing accessories and footwear. The same ban applies to medium-sized companies from 2030. The first product-group-specific requirements — for textiles and for iron and steel — are expected to take effect in June 2027.
How to prepare?
Follow the Commission’s working plan and check whether your own product groups are among the first to be regulated. In practice, the digital product passport requirements mean that the collection and management of product data must be systematised — this also applies to information obtained from subcontractors and suppliers. The better your own product data is managed already now, the lighter the transition will be.
PPWR — Packaging and Packaging Waste Regulation
What is it?
The PPWR is the EU’s Packaging and Packaging Waste Regulation, which harmonises packaging requirements across the entire Union. It replaces the Packaging Directive that had been in force since 1994 — and this is a key difference: the directive required national implementation, which resulted in 27 different versions of the same rules. The regulation, by contrast, applies as such in every Member State.
The regulation sets requirements for packaging recyclability, recycled content, reuse, material efficiency, labelling and restricted substances. It also extends producer responsibility.
Who does it apply to?
The regulation applies to all operators that place packaging or packaged products on the EU market — manufacturers, importers, distributors and online marketplaces. There is no general exemption for small companies: the obligations are determined by the role the company plays for each product.
Key provisions have applied since 12 August 2026. From that date, packaging placed on the market must have a declaration of conformity and technical documentation, and restrictions on substances also took effect, such as PFAS limits in food contact packaging. There is no transition period for new goods. The bigger changes — recyclability, recycled content, the empty space limit and bans on certain single-use plastic packaging — will come from 2030 onwards.
How to prepare?
First, determine your role: are you a manufacturer, importer, distributor or a combination of these for different products? Then map all the packaging types you place on the market and make sure a declaration of conformity and technical documentation are available for each one — in practice, this means requesting information from your packaging suppliers. Also check your producer registrations in the countries you deliver to.
Regulation is moving forward — the direction is clear
EU sustainability regulation can feel like a complex jungle. There are lots of acronyms, timelines change and the relationships between directives aren’t always self-evident. But a few clear conclusions stand out from the big picture.
First, regulation isn’t just a matter for large companies. Almost every regulation covered here affects SMEs, either directly or through supply chains. The VSME, the forced labour ban and the EUDR apply to companies regardless of size. The CSRD and the CSDDD trickle down as requirements through supply chains. CBAM and the ESPR apply to everyone who imports goods into the EU or sells products on the EU market — and the PPWR applies to anyone whose product is packaged.
Second, the timelines change — but the direction doesn’t. Omnibus I eased and postponed several obligations, and more changes may come. That doesn’t mean, however, that it’s wise to put off preparing. Customer expectations, financiers’ requirements and the criteria in requests for proposals respond to the direction of regulation — often before the law requires it.
Third, data is the foundation of everything. Every regulation covered here requires information in one way or another — about your own operations, your supply chain, your products or your emissions. A company with its data management in order can meet the requirements smoothly. A company without it has to collect and process the necessary information in a rush, and any shortcomings have to be addressed quickly. In the worst case, significant shortcomings may come to light in your own operations or in your supply chain that you can’t respond to quickly enough. A good starting point is simple: do you know right now what information you have — and what you’re going to be asked?
Would you like to clarify the big picture from your own company’s perspective?
We help you map which regulations apply to your company and what that means in practice. Get in touch — the conversation costs nothing.