ESG and Sustainability Compliance Training After the Omnibus

Two years of preparation, then a rewrite. A great many Nordic companies built sustainability reporting capability through 2024 and 2025 on the assumption that CSRD applied to them, and then discovered in early 2026 that it might not.

The confusion is the commercial opportunity here. Clarity is the product, and almost nothing published on this topic states the current position cleanly.

What the Omnibus actually did

Directive (EU) 2026/470 was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026. It amends both the Corporate Sustainability Reporting Directive and the Corporate Sustainability Due Diligence Directive, and it went considerably further than the Commission’s original February 2025 proposal.

For CSRD, the scope thresholds were raised substantially, removing a large proportion of previously in-scope companies. Member states must transpose the reporting amendments by 19 March 2027, with first application for financial years beginning on or after 1 January 2027. Companies that were required to report as wave one under the original rules but no longer meet the revised thresholds fall out of scope for the relevant financial years, subject to national transposition.

For CSDDD, the changes are larger still. Scope is now restricted to undertakings above roughly 5,000 employees and 1.5 billion euro turnover, with non-EU undertakings caught on EU turnover. Transposition is extended to 26 July 2028, with application from 26 July 2029 and the website statement obligation applying to financial years starting on or after 1 January 2030.

Verify the exact CSRD figures against the directive text before publishing. The direction is unambiguous and the precise numbers are the detail most often misquoted.

Why out of scope does not mean unaffected

Here is the argument that matters for a Nordic audience, and it is the one almost nobody is making.

Very few Nordic companies meet the revised CSDDD thresholds. A smaller but still substantial number now fall outside CSRD. What has not changed is that Nordic mid-caps are overwhelmingly suppliers, subcontractors and service providers to larger European groups, and those groups remain in scope.

In-scope companies discharge their obligations partly by collecting information from their value chain. That arrives as a supplier questionnaire, a code of conduct to countersign, a data request with a deadline, and contractual clauses on environmental and human rights standards. None of it depends on you being in scope of anything. It depends on your customer being in scope.

Three other channels apply regardless of the directive. Banks and investors apply sustainability criteria in lending and investment decisions under their own regulatory obligations. Public procurement in the Nordics applies environmental and social award criteria as a matter of routine. And consumer protection enforcement on environmental claims operates entirely independently of CSRD, which means greenwashing exposure did not move at all.

The Nordic version of this argument is stronger than the European one. Nordic companies reported voluntarily at higher rates than the EU average long before CSRD existed, and Nordic buyers and investors were applying these criteria years ahead of the legislation. In this region the commercial requirement ran ahead of the legal requirement, and the Omnibus changed the legal requirement only.

What sustainability training actually needs to cover

This is where most ESG training goes wrong. It teaches climate science, the Sustainable Development Goals and the architecture of the reporting framework. Employees find it interesting and it changes nothing they do.

What in-scope and value-chain companies actually need from ordinary employees is data quality and evidence habits.

Sustainability reporting is subject to assurance. That means numbers reported must be traceable to a source, produced by a defined method, and consistent between periods. The people who generate those numbers are in operations, facilities, procurement, HR and logistics, and they have never before been asked to produce figures to an audit standard. An operations manager who has estimated waste volumes for a decade now needs to be able to show where the figure came from.

That is the training case, and it is concrete enough to build a course on. Where does this number come from. How was it measured. What is the boundary, meaning what is included and excluded. Where is the evidence retained. What do you do when a figure is estimated, which is to record that it is an estimate and how it was derived, rather than to present it as measured.

Roles that need depth

Procurement needs the most. They send and receive the value-chain questions, they hold the supplier relationships, and they are increasingly the function that has to explain to a supplier why a data request is not optional.

Finance needs the assurance dimension and the interaction between sustainability and financial reporting boundaries.

Operations and facilities generate most of the primary environmental data.

HR owns a substantial share of the social data, including workforce metrics that sound simple and are not, such as headcount definitions, turnover calculations and incident rates.

Sales and bid teams answer customer sustainability questionnaires, frequently under time pressure, and frequently by asserting things nobody has verified. This is a live greenwashing risk sitting inside the commercial function and it is almost never trained.

Marketing and communications need the environmental claims module, for the same reason.

Greenwashing, which did not get easier

While reporting obligations narrowed, enforcement on environmental claims did not. Consumer protection authorities across the Nordics have been active on unsubstantiated sustainability marketing, and EU rules on empowering consumers for the green transition tighten the position on generic environmental claims and on claims based on offsetting.

Practically, this means the highest-probability sustainability enforcement risk for a mid-sized Nordic company is not a failure to report. It is a claim on a website, a product label or a tender response that cannot be substantiated. Train for that.

Building a proportionate programme

If you are in scope of CSRD: train the data owners on evidence quality, train finance on assurance, train procurement on value-chain data, and brief the board.

If you are out of scope but in someone’s value chain, which is most Nordic mid-caps: train procurement and sales on handling incoming requests, train the data owners on producing defensible figures, and train marketing on claims. Skip the reporting architecture entirely, because you are not reporting.

If you are neither, train marketing on claims and stop. Doing more than that is not a compliance decision.

That third recommendation matters for credibility. A vendor that tells every company it needs a full sustainability programme is not worth trusting on the ones that do.

Frequently asked questions