Content developed with the assistance of AI tools and reviewed by the author.
How the 2026 EU simplification reshapes sustainability reporting duties for US companies with an Italian subsidiary — and the supply-chain obligation nobody cancelled
A Milan-based società a responsabilità limitata (a private limited company, the Italian equivalent of an LLC) received a formal ESG questionnaire from its largest Italian retail customer in early 2026. The customer — a listed group still within the CSRD reporting perimeter — cited its own disclosure obligations. The subsidiary's US parent had concluded, six months earlier, that CSRD no longer applied to it. Both were partly right. Neither was ready.
That gap is where real compliance cost accumulates.
Probably not — if you are a mid-size US group. Here is the precise answer.
The EU Corporate Sustainability Reporting Directive, Directive 2022/2464/EU, was transposed into Italian law by Decreto Legislativo 125 of 6 September 2024 (D.Lgs. 125/2024), which amended both the Italian Civil Code (codice civile) and the Consolidated Finance Act (Testo Unico della Finanza). That decree imposed a phased reporting obligation extending to Italian subsidiaries of foreign groups.
The Omnibus I simplification directive, which took effect on 18 March 2026, rewrote the threshold architecture. Under the post-Omnibus regime, mandatory CSRD reporting for EU entities now requires both more than 1,000 employees and net turnover above €450 million. Previously, the lower wave would have captured companies with 250 employees and €40 million turnover. For a non-EU parent — your US group — the trigger is EU-wide net turnover above €450 million, combined with a qualifying Italian subsidiary or branch that itself exceeds €200 million in net turnover.
If your Italian SRL has 300 employees and €80 million in revenue, it is out of scope. Full stop. You do not file an ESRS-compliant sustainability report.
Separately, the EU stop-the-clock regulation (Regulation (EU) 2025/794, in force 17 April 2025) deferred certain first-report deadlines for wave-two and wave-three companies while the Omnibus text was finalised. That deferral mattered during the legislative gap; the Omnibus I thresholds are now the applicable standard.
omit or place in footnote — everything divides into three parts. Caesar's observation about Gaul applies, with uncomfortable precision, to CSRD after Omnibus I.
The problem with most English-language commentary on this subject is binary: either your Italian subsidiary is in scope, or it is not. That framing misses a middle tier that has real operational consequences.
Level A: Large groups still in scope. Italian subsidiaries — or Italian branches of US groups — that clear both the employee and turnover thresholds file full ESRS sustainability reports with the Italian Business Register (Registro delle Imprese), disclosed as part of the annual management report. D.Lgs. 125/2024 requires this; the Omnibus thresholds adjust when it starts but not what it requires.
Level B: Sub-threshold Italian subsidiaries of Level A groups. An Italian SRL below the Omnibus thresholds does not have CSRD filing obligations. But when its Level-A parent — or a Level-A customer — needs consolidated or supply-chain data, it can request that data from the subsidiary under the Voluntary SME Standard (VSME). EFRAG published the VSME standard in December 2024. It is structured in two modules: a basic module of approximately 11 data points and an additional narrative module. Critically, a European Commission delegated act from 3 July 2026 caps exactly which VSME data points an in-scope reporter may request from sub-threshold entities. A Level-B subsidiary cannot be required to produce data beyond that cap. But it can be asked for what is within it.
Level C: Suppliers to Level-B subsidiaries. If your Italian SRL is itself a supplier to another company that sits at Level B, you may receive a supply-chain ESG questionnaire from that customer too. The same July 2026 delegated act governs what they can legitimately request. Refusing without reading it carefully is as risky as over-disclosing.
This three-tier structure is not theoretical. US CFOs are currently spending money on full ESRS gap analyses for Italian subsidiaries that sit at Level B or Level C — reports they do not need, at costs that can reach €50,000 to €150,000 for a structured readiness project. Others are ignoring VSME questionnaires from Italian customers that are legally required and commercially damaging to ignore.
Unlike in most US contexts, where ESG disclosure frameworks (GRI, SASB, TCFD) are voluntary at every level of the supply chain and carry no binding downstream obligation, the VSME standard in Italy operates within a legally structured request-and-answer framework. An Italian company in the CSRD perimeter is not merely asking for ESG data as a matter of commercial preference. It is discharging a disclosure obligation about its own value chain. The questionnaire it sends you has a legal basis.
The VSME basic module covers energy consumption, greenhouse gas emissions (Scope 1 and 2), waste generated, employee headcount by gender, and one or two governance data points. The full additional module goes further into supply-chain practices, social indicators and business conduct. An Italian SRL asked to complete the basic module is looking at a data-collection exercise of perhaps two to four weeks for a reasonably organised company. The additional module is more demanding.
You do not have to produce third-party-verified figures. VSME responses are not audited. But you do have to produce figures that are internally consistent and retraceable — because your Italian customer's auditor may review them as part of its own ESRS audit.
Yes — within defined limits. The July 2026 delegated act sets the ceiling. A Level-A reporter cannot ask you for data points outside the delegated act's list, even if its own ESRS report would benefit from them. If a customer sends you a questionnaire that exceeds the cap, you are not legally required to answer the excess. You should document that position in writing.
What you cannot do, commercially, is refuse the entire questionnaire. A CSRD-obligated Italian customer that cannot obtain value-chain data from a supplier may flag that supplier as a transparency risk in its own disclosure. That is an ESG rating event.
The right response is to answer what the delegated act permits, note explicitly which requests fall outside the cap, and offer to discuss the remainder under a separate commercial data-sharing agreement if the customer has a genuine operational need.
For a US parent, the trigger under the post-Omnibus regime has two legs. First, the group must generate more than €450 million in net turnover in the European Union in each of the last two consecutive financial years. Second, it must have at least one qualifying Italian subsidiary or branch. A qualifying subsidiary is one that either exceeds €200 million in Italian net turnover, or is a large undertaking under Italian law (meeting two of three criteria: more than 250 employees, more than €20 million in total assets, more than €40 million in net turnover).
If your Italian SRL has €80 million in turnover and 150 employees, it is not a qualifying subsidiary even if your US group's EU revenues clear €450 million. The group-level obligation does not attach.
If your Italian SRL is the qualifying subsidiary, the non-EU parent obligation requires a group sustainability report covering the entire EU operations, filed through the Italian subsidiary with the Business Register. The first financial year for which this obligation bites under the Omnibus timetable is the year following the year in which both thresholds were met for two consecutive years — meaning most mid-size US groups are looking at a first reporting obligation no earlier than the 2028 financial year, depending on when their EU revenues crossed the threshold.
In our files, the most common error is treating the Omnibus I news as a full exit from the CSRD ecosystem. A US parent sees the headline — "CSRD threshold raised, smaller companies exempt" — pauses or cancels a readiness project, and instructs its Italian SRL accordingly. The Italian SRL then receives a VSME questionnaire from an Italian bank or trade customer within six months. With no internal data infrastructure and no prior mapping exercise, it spends three to five weeks scrambling to produce figures that should have taken three days. The second common error is the reverse: a US group at Level B continues to fund a full ESRS readiness programme at its Italian subsidiary when a VSME-readiness review — a fraction of the cost — is all that is required. Clarifying which tier your Italian operation sits in takes one structured legal and financial review. It usually takes less than a week. It removes the uncertainty that is currently driving both over-spending and under-preparation.
As the legal theorist Roberto Mangabeira Unger observed, institutional structures do not simply constrain behaviour — they shape what actors believe is possible. The CSRD tier structure does exactly that: until a US CFO understands which level their Italian subsidiary occupies, they cannot correctly budget, correctly respond to customer requests, or correctly advise their board on residual ESG risk.
My Italian SRL has 180 employees and €60 million in revenue. Do I need any CSRD documentation at all?
You are not a mandatory CSRD filer under the post-Omnibus thresholds. However, you should maintain basic ESG data — energy use, headcount by gender, waste — because your Italian customers or banks who are in scope may send you a VSME questionnaire. Having that data ready in a simple internal log costs very little and removes a commercial friction point.
Does the July 2026 delegated act protect me from unlimited ESG information requests?
Yes. The Commission's 3 July 2026 delegated act defines the ceiling of what an in-scope CSRD reporter may request from a sub-threshold supplier under the VSME framework. Requests beyond that list are not legally grounded in CSRD. You may decline them in writing, noting the specific provision. You should document refusals carefully if the customer is significant to your business.
If our US group crosses the €450 million EU turnover threshold next year, when does the Italian subsidiary have to file a sustainability report?
The two-threshold test (€450 million EU turnover and a qualifying Italian subsidiary) must be met for two consecutive financial years before the reporting obligation attaches. The first report would cover the financial year following that two-year period. Under the Omnibus timetable, a US group that crosses both thresholds in 2026 and 2027 would face a first reporting obligation for the 2028 financial year, due in early 2029. Begin the readiness assessment at least 18 months before that deadline — Italian auditors experienced in ESRS assurance are already heavily booked.
HREFLANG BLOCK:
Editorial Team — Panato Law Firm Staff
