A mid-market manufacturer opens 2026 with what looks like good news. The EU’s Omnibus package has pulled it out of mandatory CSRD reporting, and the compliance project it dreaded is shelved. Three months later it loses a tender. A large customer’s procurement team asks for audited Scope 1, 2 and 3 emissions data down to the product line, and the manufacturer can produce a spreadsheet but not proof. Around the same time, a batch of carbon credits it bought to tidy up its footprint is quietly downgraded by a ratings body, and the “net zero” line in its brochure becomes a legal risk. Nothing about its actual emissions changed. What changed is that everyone now wants the data behind the claim — and the company never built it.
This is the shape of ESG in 2026. The paperwork got lighter. The evidence got heavier.
The relief is real. In December 2025 the EU agreed its Omnibus package, and by February 2026 the directive was adopted. It narrows mandatory CSRD reporting to companies with more than 1,000 employees and over €450m in turnover — a reduction the Commission itself estimates at around 80% of previously in-scope companies. A “stop-the-clock” measure pushes later reporting waves back by two years, and the simplified standards cut required datapoints by roughly 61%. For many mid-market firms, the legal obligation has genuinely eased.
The market went the other way. The voluntary carbon market was worth somewhere around $2.5–$2.8bn in 2025 on most analyst counts, and it is splitting hard along one axis: integrity. High-integrity credits — those with strong measurement, reporting and verification behind them — now command a large premium, while low-quality credits keep getting cheaper. The carbon verification market alone is estimated at roughly $25bn in 2026 and projected to grow several-fold by the early 2030s. The money is flowing towards proof, not paperwork.
A carbon credit, an ESG score and a customs carbon declaration are the same thing in different clothes: a claim that is only ever worth what its underlying data can prove.
What we are actually talking about
It helps to be precise. ESG data, at the environmental end, comes down to emissions across three scopes: Scope 1 (what you burn directly), Scope 2 (the energy you buy) and Scope 3 (everything up and down your supply chain — usually the largest and the hardest to measure). A carbon credit is a tradable certificate representing one tonne of CO₂ reduced or removed; its value depends on whether that tonne is real, additional (it would not have happened anyway) and permanent. The mechanism that establishes all of this is MRV — measurement, reporting and verification — the evidence trail that turns a number into something an auditor, a buyer or a court will accept.
The important point: a report is a presentation. MRV is proof. Most organisations have built the first and skipped the second.
The relief is not what it looks like
Here is where the common reading gets it wrong. The story told through most of 2025 was that Brussels gutted ESG, so the pressure is off. It is not. The obligation simply changed hands. Your large customers still demand supplier emissions data, because their own reporting depends on it. Your lenders and investors still price climate risk. Carbon-credit buyers now pay up for verifiable quality and walk away from the rest. Regulators enforcing greenwashing claims still ask you to substantiate what you printed. Every one of those parties is asking for the same thing, and none of them will accept a tidy PDF: they want data with a traceable origin.
That reframes what an ESG or carbon programme is. It is not a reporting tool and a dashboard — those produce a document. What the market now rewards is an auditable data foundation: emissions figures tied back to source systems, meters, invoices and supplier records, with the lineage intact, so any number can be defended line by line. That is not a sustainability exercise. It is a data engineering one.
And it is exactly the part the checkbox approach skips. A dashboard that can render a chart but cannot tell you where a figure came from is worse than useless in 2026 — it is a liability with good styling.
How we sequence it
In our delivery, an ESG and carbon-data foundation is built in a deliberate order.
1.Establish one source of truth for emissions.Consolidate Scope 1, 2 and 3 data — including supplier inputs — into a single model with clear ownership, instead of a scatter of spreadsheets no one can reconcile.
2.Capture provenance at the source.Every figure carries its origin: the meter, the invoice, the fuel record, the supplier declaration. Lineage is captured as the data arrives, not reconstructed under audit pressure later.
3.Build to MRV grade, not report grade.Structure the evidence so it stands up to independent verification — the same standard a high-integrity carbon credit must meet — rather than merely looking complete.
4.Map to frameworks; don’t hard-wire one.ESRS, ISSB, the voluntary SME standard, a customs carbon declaration — the underlying data is largely the same. Model it once and map outward, so a change in the rules is a mapping change, not a rebuild.
5.Make it assurance-ready by default.Assume every number will be checked. Access, versioning and an audit log are part of the design, not bolted on when an auditor calls.
6.Only then, add the reporting layer.Dashboards and disclosures sit on top of a foundation that can already defend itself. Presentation is the last step, not the first.
The honest version
None of this argues for treating the Omnibus relief as a trap or ignoring it — lighter paperwork is a genuine saving, and firms out of scope should take it. The point is narrower and more useful: a reduction in mandatory reporting is not a reduction in the demand for provable data. That demand has moved to parties who are, if anything, harder to satisfy than a regulator. The organisations that keep building the data foundation through 2026 — quietly, while others declare the problem solved — are the ones who will still win the tender, sell the credit and stand behind the claim.
The rules got simpler. The data did not. Build for the data.
