Voluntary Standards: less obligation, more strategy. Núria del Pozo, October 2026

Europe has drastically reduced obligations on who should report on sustainability. But be careful: the Voluntary Standards emphasize sustainability reporting as a matter of competitiveness, not just compliance.

We have been talking about corporate sustainability in Europe for some time from the point of view of obligation. Who must report, from when and with what level of detail, but now the pieces of the puzzle have changed. And this is because, with the Omnibus Directive, in force since March 18, 2026 (and pending transposition until March next year) only companies that exceed 1,000 employees and 450 million euros in turnover must mandatorily report. Initially, the CSRD applied to companies that met two of the following three criteria: 1) average workforce volume of more than 250 employees, 2) turnover of more than 50 million euros; 3) balance sheet of more than 25 million euros. The new directive has reduced the volume of companies required to report by approximately 90%.

We may be tempted to feel relieved that we no longer have the obligation on our heads, and we may be tempted to lower the bar, but we must bear in mind that for the vast majority of companies, work does not disappear, but changes their frame of reference. And the cornerstone of the new legislative landscape are the new Voluntary Sustainability Standards (NV), created by Delegated Regulation (EU) 2026/1560, published last September and already in force.

Four pieces, one puzzle

The new framework is made up of four pieces that should be considered together. The Omnibus Directive decides who is obliged to report, Regulation 2026/1563 simplifies the European Sustainability Reporting Standards (NEIS) by defining the reporting requirements for these obliged companies, while Regulation 2026/1560 creates the Voluntary Standards (NV) that set the reporting guidelines for all other non-obliged companies, and without forgetting that until the Omnibus Directive is transposed in Spain, Law 11/2018 remains in force, which still regulates the obligation to prepare the Non-Financial Information Statement (NFIS).

For large companies, the revised NEIS is good news. There are fewer data points and, although double materiality remains the cornerstone, the exhaustive analysis of each sub-topic that has cost so much to the internal teams of the companies involved in its preparation has been simplified. In addition, sectoral standards disappear definitively and assurance remains limited, without the leap to reasonable that was announced.

But not everything is peaceful simplification. Groups outside the EU will only have to report if they have a turnover of more than 450 million in the European Union (previously 150 million) and have a subsidiary or branch of more than 200 million (previously 40 million), and they will do so with their own rules from the 2028 financial year. The change has generated controversy for lowering the requirements vis-à-vis European groups, and EFRAG itself has hinted at its distance from the decision.

But the data that is most interesting is not in what is simplified, but in a clear warning to take into account when deciding how to report: even if the company itself is not obligated, your client can be, and they will be able to request data from the companies in their value chain, which is especially important with voluntary standards, when establishing the protection shield

A common standard and, above all, a shield

The Voluntary Standards (VS) are a simple and modular European standard designed for those companies that are not required to report sustainability information based on the modification of the scope of application of the CSRD and replace Recommendation 2025/1710, which established the standard for Small and Medium-sized Enterprises not subject to the CSRD (VSME). They do not require verification and apply to financial years beginning on or after 1 January 2027.

Its structure is reasonable. A Basic Module, from B1 to B11, serves as a starting point for any company, including micro companies, and requires the reporting of information on various areas such as energy and emissions, pollution, biodiversity, water, waste, workforce, health and safety, remuneration and training, and corruption. To this Basic Module, a Complete Module is added, from C1 to C9, for those who want or need to provide more information, including information on strategy, Greenhouse Gas (GHG) reduction goals, climate risks or human rights, among others.

The Basic Module must be reported mandatorily for those who adopt NVs: that is, it is not possible to report only on the Complementary Module without taking into account the Basic Module. A double materiality analysis (DMA) is also not required, but those who already did so when the previous CSRD applied it should take it into account when deciding on which topics to report. The C4, on climate risks, deserves special attention: it is a relevant novelty, and the first reports published with NV in countries such as Germany or Ireland already present this information in a very visual way. Likewise, those who work with the EMAS standard can combine it with the Voluntary Standards in a single report.

A potential criticism is that perhaps there has been an oversimplification, and sometimes it is not clear what exactly needs to be reported, due to a lack of detail in terms of the information requirements, leaving too much room for interpretation of these. That is why it is always advisable to read the rules together with the EFRAG guidance guide, which is much clearer and has descriptive examples.

The decisive novelty, however, is another. By moving from recommendation to regulation, NVs acquire a legal basis to set a maximum limit on information requirements in the value chain, more specifically, what an obligated company can ask of its suppliers with fewer than 1,000 employees. From the 2027 financial years, no one will be able to demand more from them than what is set out in Annex II, which lists only the essential data to be reported.

This limit works as a real shield: that is, companies that adopt the Voluntary Standards and prepare their report based on this framework can refuse to provide more information than that indicated by the standard. Consequently, if they are required to provide information beyond the requirements defined in this annex, it is necessary to act with transparency, indicating which part exceeds the limit and remembering that there is the possibility of refusing. For smaller companies, the annex is even shorter: with fewer than ten employees, energy and emissions are excluded.

It should be borne in mind that the protection shield covers requests linked to the CSRD report, but not any other use; banks are only recommended to limit their requests. It should also be taken into account that a company with more than 1,000 employees, but under 450 million, is not obliged to report, although it does not enjoy this protection against third-party requirements either. This is a grey area that should be monitored.

In Spain, no one should let their guard down

In Spain we must remember that Law 11/2018 is still fully in force: that is, it requires companies with more than 250 workers that are entities of public interest or that meet two of the three criteria required for two years to submit the Non-Financial Information Statement (NFIS). Law 11/2018 requires reporting on the environment, personnel, human rights, corruption and society, with independent verification and approval by the meeting.

When the previous directive, the Non-Financial Reporting Directive (NFRD), was transposed, Spain went further than other countries and imposed mandatory verification. The result, considering the current regulatory framework, is paradoxical: a company with less than 1,000 employees that uses NVs would not need to verify, but if it is obliged to the NFIS, the verifier will continue to ask for it.

Right now, Spain has until 19 March 2027 to transpose the Omnibus Directive (as do the rest of the EU member countries), and when it does, it is foreseeable that many companies currently obliged to the NFIS will be left out of the mandatory perimeter and will have NVs as a reference element. But we must also add an added difficulty, that the fact of calling elections paralyzes everything that was pending processing in the Parliament, which could have an impact on the periods foreseen for the transposition of this Directive. In other words, as long as this transposition is not carried out, the NFIS remains mandatory. But be careful, dismantling the reporting equipment and processes now would be a mistake.

Without going any further, on 20 October, the National Securities Market Commission (CNMV) and the Institute of Accounting and Auditing (ICAC) published a statement recommending that entities subject to Law 11/2018 with more than 1,000 employees publish the NFIS considering the ESRS, to the extent that they are in a position to do so, while entities subject to Law 11/2018 that have less than 1,000 employees, in the preparation of their NFIS, assess the convenience of applying the ESRS, or where appropriate apply the voluntary standard. . The aim is for their information to be comparable with that of other European issuers, although Spanish legislation has not yet been equated.

From obligation to strategy

NVs are in force from September 24, 2026, the limit applies to the financial years starting on January 1, 2027 and in 2028 the first reports and requests for data from obligated customers will arrive. The most practical advice right now is simple: start collecting data.

Preparing does not require large investments, but order and knowledge of the information requirements. First, it is necessary to situate yourself: number of employees, turnover, membership of a group and NFIS obligations. Second, map who can request data on our operations: customers, parent company, banking, among others. Third, choose a module, with the Basic as a minimum and the Complete if our Stakeholders require it. Fourth, collect the required data (including energy, emissions and headcount, among others). And fifth, use the limit: respond in NV format and contrast each request with Annex II of the Voluntary Standards. If a customer or supplier in our value chain asks us for more, it must be requested in a transparent way and explaining what it is needed for. For those who are still bound by the NFIS, the sensible thing to do is to prepare it based on the NVs, so that today’s work will also be useful tomorrow.

We are not starting from scratch, both EFRAG and the Commission have developed materials and help guides and Member States are encouraged to disseminate the Voluntary Standards and support their digitisation. It would be desirable for Spain to take up this gauntlet decisively.

By way of conclusion, we want to emphasise that European simplification in sustainability reporting is already real right now. But we must also bear in mind that its main effect is not to exempt, but to order: it establishes a common language for thousands of SMEs to talk about sustainability with their customers, their banks and their investors without drowning in questionnaires. The value of sustainability reporting and information continues to be a fundamental tool for companies that allows them to differentiate themselves from their competition by highlighting a job well done. Companies that understand and apply it will undoubtedly reach 2028 with an advantage.

Núria del Pozo

Legal Manager of the Private Foundation Empresa & Clima