ESG due diligence on small and mid-cap deals: what should you check in 2026?
ESG due diligence on a small or mid-cap target is no longer about checking whether it will fall under the CSRD: the Omnibus package raised the thresholds to 1,000 employees and €450m in turnover and pushed the second wave to 2028, which puts almost all of these companies out of scope. What is left to check comes down to four things: the obligations the target still carries through its value chain, what the fund itself must report, the ESG risks that will cost money at exit, and the data that actually exists. That is a few days of work, not a few weeks.
What did the Omnibus package change in the CSRD timetable?
A great deal, and quickly. Voted by the European Parliament on 16 December 2025, approved by the Council on 24 February 2026, published in the Official Journal on 26 February and in force on 18 March 2026, the Omnibus I package pushed the CSRD’s second wave — large unlisted companies — from 2026 to 2028, on 2027 financial year data.
Above all it raised the thresholds: companies with at least 1,000 employees and more than €450m in net turnover, cutting the number of entities in scope by roughly 80 %. In parallel, EFRAG published a simplified version of the ESRS in December 2025, bringing the number of required data points down from around 1,100 to around 300.
The due diligence directive (CS3D) follows the same path: transposition by member states is deferred to 26 July 2028, with the first vigilance obligations applying no earlier than July 2029.
The target is below the thresholds: what still needs checking?
First, what reaches it indirectly. An out-of-scope company supplying an in-scope group receives that group’s questionnaires, and its ability to answer them conditions contract renewal. That is a commercial risk before it is a regulatory one.
Second, what the fund itself must publish. In France, article 29 of the Energy-Climate Act — its implementing decree dating from 27 May 2021 — has since 2023 required nearly all management companies to publish extra-financial reporting: share of assets aligned with the taxonomy, financing of fossil activities, quantified emission reduction targets for 2030 and every five years to 2050. What the portfolio company does not measure, the fund cannot report.
Third, what will weigh at exit. A trade buyer or a larger fund will ask the questions nobody asked on the way in: accident record, energy dependency, supply chain compliance, governance. Entry ESG diligence is as much about preparing the sale as securing the acquisition.
How is it actually run?
Invest Europe’s GP ESG Due Diligence Guide sets out the framework the industry recognises: a questionnaire structured around four materiality pillars, a desk review supplemented where needed by site verification, and an action plan for the post-closing period. That is what an LP expects to see.
What AI changes here is clear. ESG diligence used to be consumed by reading: internal policies, supplier contracts, social data, incident reports. That work automates, and the time it frees goes back where it matters — the conversation with the CEO and the judgement call on what actually counts. That is what lets us run this work in days rather than weeks.
Who runs these diligences, and why is the small-cap end poorly served?
The large firms — Big Four, sustainability specialists — have the methods and the teams, but their economics are built for deals where the diligence budget runs into tens of thousands of euros. On a small-cap deal, ESG diligence competes directly with financial and commercial diligence, and it is the one that gets dropped.
The result is familiar to every small and mid-cap fund: a box ticked by a self-declared questionnaire, unverified, protecting nothing and preparing nothing. The point is not to run large-cap diligence on a small-cap deal; it is to run an honest, proportionate one that produces an action plan usable at the first board meeting.
What do you keep after closing?
The useful deliverable is not the report, it is the starting point. Good ESG diligence leaves three things: a measurement baseline the company can maintain, two or three actions written into the value creation plan with an owner and a deadline, and enough to answer the fund’s reporting without starting from scratch each year.
That is the difference between diligence filed in the data room and diligence that starts working the day after closing.