The CSRD Omnibus was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026, simplifying the EU sustainability reporting regime in ways that materially change the CSRD supplier data hospitality equation (Covington & Burling). Wave 2 reporting is delayed by two years, with first reports now landing in 2028 for fiscal year 2027 (BDO). Wave 3 listed SMEs have dropped out of the mandatory regime entirely, with the voluntary VSME standard taking their place (European Commission). For hospitality groups that spent 2024 and 2025 building supplier data programmes for Wave 2, the immediate question is whether to pause, sustain, or accelerate.
The honest answer is that none of the three are universally correct. The right move depends on the customer mix, the lender base, and the brand position a hospitality group wants to occupy in 2027.
What the Omnibus actually changed for hospitality procurement
The Omnibus narrows the in-scope universe to EU entities with more than 1,000 employees and net turnover above 450 million euros (Council of the EU). That threshold removes a meaningful share of mid-market hotel groups from direct CSRD obligation. Wave 1 large-cap operators stay in scope and continue publishing reports through 2026 and 2027 against their existing baselines (Lexology). Wave 2 operators above the new threshold get two extra years; smaller groups previously caught by Wave 2 are now out of the mandatory regime and may report voluntarily under VSME.
The change that matters most for procurement is the value-chain cap. Under the Omnibus, CSRD reporters cannot demand information from suppliers with 1,000 employees or fewer that exceeds the data points set out in the VSME standard (EcoVadis). Suppliers below that threshold gain a statutory right to refuse requests that go further (Linklaters). For hospitality, where a typical group sources from a long tail of regional F&B distributors, linen services, and amenities suppliers, the cap is a structural simplification of the supplier engagement workload.
EFRAG’s parallel simplification of the ESRS reduces mandatory data points by roughly 61 per cent and removes the preference for direct value-chain data, replacing it with greater tolerance for estimates and sector averages (EY). The Commission is expected to adopt the revised ESRS via Delegated Act in the first half of 2026, with mandatory application from FY2027 and optional early use for FY2026 (Gibson Dunn).
Why the requests keep arriving anyway
In theory, the Omnibus relieves smaller hospitality groups from direct CSRD pressure. In practice, the requests keep arriving from three directions.
First, Wave 1 corporate customers. Large travel management companies, corporate booking platforms, and brand owners with sustainability commitments to their own reporting cycle continue to ask hotel groups for emissions, water, waste, and supplier governance data as part of the procurement RFP process. The contractual leverage is the booking volume, not the directive itself.
Second, lenders. Banks subject to the European Banking Authority’s Pillar 3 ESG disclosure rules need counterparty data to calculate Green Asset Ratios and to underwrite sustainability-linked loans (Coolset). A hospitality group seeking to refinance a portfolio of properties in 2027 will be asked for ESRS-aligned metrics regardless of whether it is itself a CSRD reporter.
Third, brand-affiliated operators. Management contracts and franchise agreements with branded hotel groups commonly include sustainability reporting clauses that survive the regulatory simplification. Brand standards are private law obligations the Omnibus does not touch.
The implication is that the directive’s relief is real for the strictly compliance-driven posture, but limited for any operator whose revenue depends on customers and capital providers who are themselves in scope.
The two approaches
Approach A: strip back to minimum-viable disclosure. Treat the Omnibus as a green light to scale down the supplier data programme to the VSME ceiling. Concentrate effort on the small set of high-spend, high-emissions suppliers where the data genuinely matters for Scope 3 calculation, accept estimates and sector averages for the long tail, and decline any customer or lender request that exceeds VSME. This approach minimises 2026 cost and frees procurement capacity for other initiatives. The risk is that it leaves the operator unprepared if a major customer raises the bar, or if a sustainability-linked refinancing window opens earlier than the FY2027 reporting cycle would suggest.
Approach B: maintain full Wave 2 readiness as a procurement differentiator. Continue the programme as if the original timeline still applied. Use the extra two years to deepen supplier engagement, normalise data formats across categories, and arrive at FY2027 with a mature, audit-ready data set. In our view, this approach makes sense for groups that already invested heavily in 2024 and 2025, that compete for corporate booking volume against larger Wave 1 brands, or that expect to refinance a portfolio before 2028. The cost is sustained programme spend during a period when peers are scaling back.
Neither approach is wrong. The decision logic should be customer-driven: if more than a small share of nights are booked by corporate customers with their own CSRD obligations, Approach B is the lower-regret option even at higher direct cost. If the customer mix is leisure-dominant and the lender base is local, Approach A captures the relief the legislator intended.
What hospitality procurement should do in the next six months
We see four practical steps that hold regardless of which approach a group selects.
Map the customer and lender data demands explicitly. Catalogue every contract clause and RFP question that touches sustainability data, separate the genuinely binding requests from the aspirational ones, and identify which customers are themselves Wave 1 or large Wave 2 reporters. The output is a defensible position on what the group must continue to collect even if CSRD direct obligation falls away. This connects directly to the broader question of how groups score and continuously monitor their critical suppliers, which we discussed in our framework for supply continuity scorecards in hospitality.
Apply the value-chain cap deliberately. The VSME ceiling is a tool, not a default. For suppliers below 1,000 employees, the group can now refuse to absorb data-collection costs that vendors push down through long surveys. Define the cap in the supplier code of conduct and train category buyers to apply it consistently.
Concentrate effort where Scope 3 actually concentrates. In hospitality, F&B procurement typically accounts for the largest share of supplier emissions, with linen, energy services, and amenities following. The Omnibus permits proportionate effort, which is the right framing: collect granular data from the top 20 per cent of spend that drives the majority of the footprint, and accept estimates for the tail. Groups already navigating overlapping EU regimes will recognise the pattern from our analysis of the EUDR and hotel F&B procurement, where similar concentration logic applies.
Treat data infrastructure as a procurement asset, not a reporting overhead. The supplier data collected for CSRD purposes also informs spend analytics, supplier risk scoring, and category strategy. A group that builds the infrastructure once and reuses it across procurement, sustainability, and treasury captures more value than one that treats reporting as a parallel workflow. This logic extends to multi-property and GPO contexts, where supplier data has compounding value across cost, risk, and compliance categories.
The honest reading
The Omnibus is not a retreat from sustainability disclosure. It is a recalibration of who reports, how much they collect, and where the cost falls. For hospitality groups, the regulatory pressure has eased; the commercial pressure has not. The procurement function that treats 2026 as a pause year will be visibly behind in 2028; the function that simply maintains the prior trajectory will pay for capability the group may not need. The work is to decide which of the two errors is more expensive given the specific customer mix, lender base, and brand position, and then to commit.