CSRD Assurance After the Omnibus: Limited Stays, Reasonable Is Gone

For three years, CSRD assurance planning carried an assumption: limited assurance first, reasonable assurance later. Budgets, system choices and internal control work were sized for the harder engagement that was supposed to arrive around 2028.

Omnibus I removed it. Limited assurance is now the level, not the first step toward a level.

Most assurance plans have not been re-sized for that.

What the directive did

Directive (EU) 2026/470, the Omnibus I directive, was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026. Member States have until 19 March 2027 to transpose the CSRD amendments (Latham & Watkins; Norton Rose Fulbright).

On assurance, the change is a deletion. In the words of a legal analysis of the approved text, the directive “removes the possibility of a future transition towards a reasonable assurance engagement” and “assurance for sustainability information will remain limited in scope” (Cuatrecasas). Accountancy Europe reaches the same reading: limited assurance remains mandatory, with a limited assurance standard to be adopted no later than 1 July 2027 (Accountancy Europe).

The required level came down, and the standard that will define it has not been published yet.

Limited assurance is a negative conclusion

The distinction is not a matter of degree, and it is worth being precise because the two engagements ask the practitioner for opposite things.

In a reasonable assurance engagement the practitioner gathers enough evidence to express a positive opinion: the information is fairly stated. In a limited assurance engagement the practitioner does enough work to say they have not found evidence that the information is materially misstated. Cuatrecasas puts the CSRD version plainly: the auditor “must confirm that they have not found any evidence to suggest the information is materially misstated.”

A negative conclusion involves less testing and smaller samples. The practitioner still examines your records.

What this does and does not change for preparers

A limited assurance engagement still traces reported figures back to underlying records. Fewer of them, less deeply. A figure with no record behind it still fails when it is sampled.

The control investment is where the saving sits. Reasonable assurance effectively requires controls over sustainability data at something close to financial-reporting rigour, including testing of control operating effectiveness. That is the expensive part of the programme, and the Omnibus has removed its deadline. A team that sized its 2027 and 2028 budget around a reasonable-assurance build has room to re-plan.

The first reporting year is unchanged. The narrowed CSRD scope applies from financial years beginning on or after 1 January 2027, for EU companies and groups above 1,000 employees and €450 million in net turnover. Data collection starts in January 2027, more than two months before national transposition is due.

The practitioner’s framework is also unchanged. ISSA 5000, the IAASB’s general standard for sustainability assurance engagements, applies to sustainability information reported for periods beginning on or after 15 December 2026, covers both limited and reasonable engagements, and is framework-neutral. We have written on what ISSA 5000 asks of an AI-drafted report. A European delegated act will sit on top of that, not instead of it.

What “permanent” means here

Omnibus I removes a scheduled escalation. It does not legislate that reasonable assurance can never apply to sustainability information in Europe.

The practical difference matters for planning. Before, a date existed and a company could be late for it. Now there is no date, so the question “when do we need control operating effectiveness tested?” has no regulatory answer, and any answer a company gives is its own choice rather than a compliance deadline.

Two groups should still make that choice deliberately. Companies whose investors or lenders ask for a higher level of comfort than the regulation requires are not relieved of anything by this change. And companies that were building reasonable-assurance-grade controls for internal reasons, because they did not trust their own numbers, had a reason that the directive has not addressed.

For everyone else, the honest read is that the compliance ceiling fell and the schedule pressure came off a specific, expensive workstream.

What you may ask the value chain for

One further Omnibus change bears directly on evidence. A company in scope cannot request sustainability information from companies in its value chain with 1,000 or fewer employees on average, and it may rely on that company’s own statement of its employee count unless it knows, or should know, that the statement is wrong (Cuatrecasas). The limit applies to CSRD reporting and does not block voluntary sharing, existing contracts, or other due diligence processes.

This sets a boundary on what evidence can exist at all. Where a value-chain figure rests on an estimate because the underlying data could not be requested, the record has to carry that: the method used, the inputs behind it, and the reason direct data was unavailable. A practitioner asking about that figure will not find a supplier record, and the file should not be built as though one were expected. An estimate with its basis written down is supportable. An estimate presented as a measurement is not.

The gap between now and the standard

The Commission has to adopt the assurance delegated act before 1 July 2027. A company whose first CSRD reporting year begins on 1 January 2027 will therefore have been collecting data for roughly half that year before the standard governing its assurance exists.

This is not as dangerous as it sounds, but it has one practical consequence. You cannot design a reporting process to a standard you have not read, so design it to the thing that does not change: every reported figure traceable to an original record, with the calculation reproducible and the approval dated. That requirement is common to limited assurance, reasonable assurance and ISSA 5000. No plausible delegated act makes it less true.

What you should not do is defer the evidence work until the standard lands. The evidence is a property of how data was captured during the year. It cannot be reconstructed in the quarter the standard is published.

What to do in the next two quarters

Re-baseline the assurance budget. If the plan still carries a reasonable-assurance build for 2028, that line can be re-sized, and the saving is real.

Keep the evidence chain. Source record, calculation, adjustments and reviewer, attached to each figure rather than stored separately. This is the piece that survives every version of the rules.

Check the scope question separately from the assurance question. The two changed in the same directive and are often discussed together, but a company can be out of scope and still be asked for the same data by an in-scope customer. We have written on the value chain cap and on what changes on 1 January 2027.

Decide where the evidence lives before January. The question is not which tool stores the number, it is whether the number and its support are stored together. Teams that keep figures in a reporting system and evidence in shared drives discover the gap during the engagement, which is the most expensive moment to discover it.

Name an owner per disclosure area. Limited assurance involves inquiry, and inquiry needs someone who can answer. A disclosure with no named owner slows the engagement down.

Watch for the delegated act in the first half of 2027, and do not let its absence become a reason to wait.

Socious Report turns one dataset into AI-drafted CSRD, SSBJ and ISSB reports and keeps the source record and review trail beside each figure, then adds an independent Socious Verify credential. The free CSRD readiness check tells you whether each part of the reporting process has an owner and evidence behind it.