The short version: the Omnibus changed who has to report under CSRD and when. It did not change what a defensible product carbon footprint looks like. If your PCF program was built to survive an audit, nothing in the Omnibus makes that work less necessary. If it was built to fill in disclosure fields, the ground just moved under it.
The changes that are real
The EU's Omnibus package, finalized in 2026 after the 2025 "stop-the-clock" directive, did three things that matter for product-level carbon work.
Scope narrowed sharply. The final text limits mandatory CSRD reporting to the largest companies, with thresholds around 1,000 employees plus a net turnover test in the hundreds of millions of euros. Thousands of mid-sized companies that spent 2024 preparing to report are now out of mandatory scope. Check the final thresholds against your own numbers rather than a blog post, ours included: the figures moved several times between proposal and adoption.
Timelines slipped. Stop-the-clock pushed the second and third waves of reporters back by two years, and the simplified standards apply from the revised dates.
The ESRS themselves got smaller. Datapoints were cut substantially, sector-specific standards were discontinued, and the revised standards align more closely with ISSB on greenhouse gas boundaries. ESRS E1, the climate standard, kept its dedicated status through the simplification. Climate remains the most substantive disclosure area in the revised framework.
What did not change
Assurance still exists. Companies that remain in scope still have their sustainability statements assured, and an assurer's question about a carbon number is the same question it always was: where did this figure come from, what activity data sits under it, which emission factor was applied, and can you show the chain. A shorter list of datapoints does not lower the evidence bar on the datapoints that remain. Arguably it raises it, because the surviving disclosures are the ones regulators considered material enough to keep.
The supply-chain cascade did not stop. This is the part that affects physical-product brands most directly. A large customer that still reports under CSRD still needs scope 3 data, and it gets that data by asking its suppliers. Falling out of mandatory scope yourself does not remove the PCF requests arriving from customers who remain in it. In practice, the Omnibus concentrated reporting obligations at the top of supply chains while leaving the data demand flowing down them.
Voluntary reporting got a standard of its own. For companies below the thresholds, the voluntary VSME standard is becoming the common format customers point to when they ask suppliers for data. Smaller and simpler, but the numbers in it still get compared against the ones your customer files.
If the Omnibus took you out of scope
The tempting read is that PCF work can wait. The likelier reality is that the deadline moved from a regulator to your largest customers, and customer deadlines are less negotiable. A procurement team choosing between two suppliers, one with evidence-backed product footprints and one with a spreadsheet of estimates, does not need a directive to prefer the first.
What falling out of scope does buy you is the freedom to build the evidence chain at your own pace instead of against a filing date. Companies that use that time to bind numbers to source documents, keep calculation lineage replayable, and label estimates as estimates will find the eventual request, whether from a customer, a lender, or a returning regulator, routine instead of a fire drill.
If you are still in scope
Fewer datapoints means the disclosure workload shrinks. The evidence workload does not. E1's survival intact through the simplification is a signal about where scrutiny will sit. A carbon number you cannot defend a year later, with the manifest, the purchase order, the supplier PCF, and the factor vintage behind it, was a liability under the old ESRS and remains one under the new.
That defensibility framing is the reason CarbonSKU exists: an evidence ledger that binds every product-level number to its hashed, versioned source documents, so the answer to "show me the chain" is a query rather than a quarter-long reconstruction. Whatever tooling you use, build toward that standard. Rules about who must publish keep changing. What a number needs behind it to survive scrutiny has not changed at all.