Significant changes expected to EU ESG rules as Omnibus negotiations heat up

The European People’s Party (EPP), the largest political group in the European Parliament, is advocating for substantial changes to the EU’s environmental, social, and governance (ESG) regulations within the framework of the Omnibus package negotiations spearheaded by Commission President Ursula Von Der Leyen. Beyond just minor simplifications, the EPP is calling for significant revisions to the Corporate Sustainability Reporting Directive (CSRD), the Corporate Sustainability Due Diligence Directive (CSDDD), the Carbon Border Adjustment Mechanism (CBAM), and the EU Taxonomy.


What is the Omnibus proposal?

The EU Omnibus ESG Regulation is a comprehensive framework aimed at streamlining and harmonising sustainability reporting across the EU. It was proposed by EU Commission President Ursula Von Der Leyen in response to the European Parliament elections in June 2024 and the effective end of the Green New Deal. The Omnibus consolidates various existing regulations, such as the CSRD, CSDDD, and EU Taxonomy, to create a unified and efficient approach to ESG compliance. The regulation seeks to reduce administrative burdens for businesses by eliminating redundant reporting requirements and improving consistency. It also introduces enhanced enforcement mechanisms to ensure compliance, with potential penalties for non-compliance.

 

EPP’s Proposal: Key Changes and Justifications

The EPP is entering the negotiations with a number of demands which would significantly alter the application of the EU’s Green New Deal.

Two-year implementation delay

The EPP proposes that the implementation of the CSRD, CSDDD, and related regulations, including the EU Taxonomy and CBAM, be postponed for at least two years. This delay aims to provide businesses with legal certainty and alleviate the bureaucratic burden in the short term.

Narrowing the scope of who is affected

They advocate for limiting the applicability of these ESG rules to only the largest companies with more than 1,000 employees. This would effectively eliminate the indirect regulatory impact on small and medium-sized enterprises (SMEs).

Reducing reporting obligations:

The EPP calls for cutting reporting obligations for large companies by at least 50%. Such a move would address concerns over administrative burdens and overlapping legislative requirements that lead to double reporting.

Revising of legislative measures:

The bloc demands a comprehensive review of legislation yet to be implemented, including delegated and implementing acts. This would entail evaluating “technical” implementation measures to avoid unnecessary complexities.

 

Why is the EPP calling for this?

The push for these changes comes in the wake of a resurgent right-wing following the European Parliament elections in 2024. The Green bloc have seen vastly reduced numbers, along with losses in key European governments like Germany. Further concerns have been raised that the current regulatory framework hinders European competitiveness.

The EPP argues that regulatory overreach disproportionately affects SMEs and digital sectors, which could stifle innovation and job creation. Also excessive regulation and bureaucracy are among the key factors slowing Europe’s economic growth compared to other global regions, such as the US and China.

 

How will the EU Commission respond?

The European Commission is expected to present its omnibus proposal on 26 February 2025, which will likely reflect some of these demands. However, with the EPP framing the debate around significant deregulation, even a modest proposal could face pressure for further amendments.

What are the key dates coming up for the EU’s ESG regulations?

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.