In March 2026, the EU's first Omnibus Directive on sustainability reporting entered into force, and with it the great descoping: CSRD obligations now concentrate on companies above 1,000 employees and €450 million turnover, releasing thousands of mid-sized firms that had spent two years preparing. In many of those firms, the preparation stopped the week the ink dried. Budget reallocated, project closed, relief general.
The relief mistakes how this regulation propagates. CSRD was never only a direct obligation; it is a value-chain reporting regime. The large companies still in scope must report on the impacts, risks and emissions of their supply chains, under assurance, on deadlines. Their supply chains are, to a first approximation, the companies that just left scope.
What actually changed, and what did not
What the descoped company lost in March was the obligation to publish its own sustainability statement under ESRS. What it kept is everything operational: the customer questionnaires, the Scope 3 data requests, the audit-adjacent scrutiny, because in-scope reporters' assurance providers increasingly test the supplier data behind the statements. Survey work on CSRD implementation has consistently found supplier data availability the top Scope 3 challenge, cited by around 79% of reporters, which tells you exactly where the pressure lands next. On suppliers, with sharper questionnaires and less patience.
And the requests arrive worse than before. Under CSRD-for-everyone, a mid-sized firm could build one ESRS-shaped dataset and serve all comers. Post-descoping, the same firm faces each customer's own questionnaire format, thresholds and deadlines, with no common standard to anchor on. The homework survived; the syllabus was withdrawn.
Meanwhile the machinery most companies built for CSRD was never built to answer ad-hoc questions anyway. Reports of CSRD-era practice put spreadsheet reliance among sustainability reporters above 90%. Annual-cycle tooling, manually assembled, one heroic effort per year. Pointed at a monthly stream of heterogeneous customer requests, that machinery produces exactly what it was built to produce: one heroic effort, per request.
The capability, not the report
The strategic error available right now is to treat each incoming questionnaire as a small reporting project. The alternative is to notice that every request draws on the same underlying facts, and build the facts once:
- A data foundation, not a document. Energy, emissions factors, workforce, materials and site data maintained continuously with lineage, so any questionnaire is a projection of the same audited numbers rather than a fresh assembly.
- Supplier-of-a-supplier readiness. The same value-chain logic cascades downward: the descoped company's own suppliers will be asked for their inputs. Firms that can pass structured questions down and aggregate answers up become easy to keep; firms that cannot become the bottleneck their customers eventually design out.
- Consistency as the control. When five customers ask overlapping questions in five formats, the risk is five subtly different answers, each individually defensible, collectively contradictory, and discoverable. One source serving every format is not efficiency alone; it is how you avoid contradicting yourself under scrutiny.
The companies that stayed in scope get a standard, a deadline and a budget line. The descoped get the same questions with none of the three. The capability is how you answer cheaply anyway.
The commercial reading is simpler still. Large buyers are actively tiering suppliers by data reliability, and procurement processes increasingly score it. For a mid-sized firm, being the supplier whose numbers arrive structured, consistent and on time is a differentiation cheaper than most marketing.
The regulation moved. The questions stayed. Build for the questions.
A useful benchmark: count the hours your team spent on the last three customer ESG questionnaires, and how many of the answers were assembled fresh each time. If the second number is not near zero, the foundation is missing, and building it is what the Prophesee ESG module is for. Serve the next request from a system.