The future of sustainability regulations in the EU: What rules will survive?

The European Union has long been at the forefront of environmental, social, and governance (ESG) regulations, driving corporate accountability and sustainability measures across industries. However, recent political shifts and regulatory debates have cast uncertainty over the future of these frameworks. With the introduction of the Omnibus regulation, many of the green policies established over the past five years are now at risk of being scaled back or dismantled entirely.

 

Key ESG regulations in the EU at risk

Several major ESG-related directives and regulations have shaped corporate sustainability reporting in the EU. Among the most significant are:


However, the implementation of these regulations has come into question following the 2024 European Parliament elections, which significantly altered the political landscape.

 

The impact of the 2024 EU elections

The European elections in June 2024 dramatically shifted political priorities. Green parties suffered heavy losses, and the European Parliament, along with key national governments such as France and Germany, reassessed the breadth of upcoming sustainability regulations. The Omnibus regulation, introduced by European Commission President Ursula von der Leyen, seeks to consolidate, streamline, and, in many cases, reduce the regulatory burden on businesses.

The EU Commission has set out its agenda, including:

  • Reducing overall EU reporting obligations by 25% for large companies and 35% for SMEs.
  • Creating a new company category between SMEs and large corporations to exempt more businesses from strict reporting requirements.
  • Ensuring that ESG disclosure obligations remain proportionate to company size and activities.
  • Preventing a trickle-down effect where large companies impose stringent ESG requirements on their smaller suppliers.

 

Diverging political agendas on ESG regulations

The Omnibus regulation has sparked debate between different political factions within the EU. The European People’s Party (EPP), the largest party in the European Parliament, has proposed significant delays and reductions in ESG obligations, including:

  • A two-year blanket delay in implementing CSRD, CSDDD, the EU Taxonomy, and related regulations.
  • Limiting ESG reporting requirements to only the largest companies (1,000+ employees).
  • Cutting reporting obligations for large companies by at least 50%.
  • Conducting a comprehensive review of ESG-related legislation that has been passed but not yet implemented.


On the other hand, environmental and ESG advocacy groups are pushing back, trying to retain as many sustainability requirements as possible. A key point of contention is the debate between single materiality and double materiality in ESG reporting:

  • Single materiality focuses on how ESG risks impact a company’s financial performance.
  • Double materiality considers both the company’s financial risks and its broader environmental and social impact.


It is highly likely that double materiality will be scrapped, along with the mandatory reporting of Scope 3 emissions (those from supply chains). Sector-specific sustainability reporting standards may also be significantly reduced.

 

The fate of the EU Deforestation Regulation (EUDR)

One of the first casualties of the recent political shifts was the EU Deforestation Regulation (EUDR). Originally set to take effect at the end of 2024, this regulation would have required companies dealing with products such as palm oil, soya, wood, coffee, cattle, and rubber to provide verifiable proof that their supply chains were free from deforestation.

Businesses would have had to ensure full traceability of raw materials and comply with strict due diligence processes. Countries would also have been classified based on deforestation risk levels (high, standard, or low), affecting import regulations.

However, in response to political pressure, the European Parliament delayed the implementation of the EUDR by one year, pushing it to the end of 2025. While the regulation itself remains intact for now, its future is uncertain. Many believe it will either be further delayed or heavily diluted before coming into effect.

 

What happens next?

The EU Commission is expected to present its Omnibus package proposals on 26 February 2025, though this timeline may be optimistic. Once the proposals are announced, they will enter the EU’s legislative process, which includes negotiations between the European Parliament and the European Council.

Several key factors will influence the outcome:

  • The anti-Green sentiment within the EU Parliament and among major EU countries, particularly France and Germany, remains strong.
  • The German elections at the end of February 2025 will be crucial. If the Greens are excluded from the next German government, there will be few remaining political defenders of the Green New Deal within the EU’s key decision-making bodies.
  • Many companies have already begun preparing for ESG compliance, raising the question of whether rollbacks will be practical or if a compromise will be reached.


The EU’s ESG regulatory landscape is undergoing a significant transformation. What was once an ambitious agenda for corporate sustainability is now facing serious cutbacks. While some level of ESG reporting will remain, the scope and scale of these requirements are likely to be greatly reduced in the coming months.

The primary question now is how much of the original Green New Deal will survive after the final Omnibus negotiations. Given the current political climate, it appears that Europe is moving toward a more business-friendly, less burdensome ESG framework—at least for the foreseeable future.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.