Two European texts are reshaping the obligations of French executives since spring 2026. The Omnibus package modifies the thresholds of the CSRD directive on sustainability reporting, while the regulation on artificial intelligence (AI Act) imposes its first operational constraints. These developments directly impact the governance, compliance, and investment choices of companies, regardless of their size.
Omnibus Package and CSRD: the new thresholds that change the reporting scope
Do you run a mid-sized enterprise or a large SME and thought you would have to publish a sustainability report by 2026? The directive (EU) 2026/470, known as the Omnibus package, has disrupted this timeline. Published in the Official Journal of the European Union on February 26, 2026, and coming into force on March 18, 2026, it raises the thresholds for CSRD applicability.
In practical terms, a large number of SMEs and mid-sized enterprises are now excluded from the direct scope of the CSRD. Companies affected by “wave 2” must now exceed both 1,000 employees and €450 million in net revenue to remain within the scope. Their first reporting exercise is set for 2027, with publication expected in 2028.
For those who find themselves below these new thresholds, sustainability obligations do not completely disappear. They transform into indirect requirements, passed down by contractors through value chains. A strategic supplier of a large group subject to the CSRD may be asked for detailed ESG data, even without a specific legal obligation.
Executives who wish to anticipate these changes can consult the articles from Le Blog des Décideurs to follow the concrete implications of these texts on daily management.
Transposition into French law: a window of uncertainty until 2027
The transposition into French law must occur by March 19, 2027, at the latest. This interim period creates regulatory ambiguity. Companies situated just below the new thresholds do not yet know if the French legislator will add additional national criteria.
This uncertainty weighs on investment decisions. Should the reporting infrastructure be maintained? Reduce dedicated teams? Caution seems risky: major clients and investors do not wait for transposition to demand data.
AI Act and executive obligations since August 2026
On August 2, 2026, a new tranche of obligations from the European regulation on artificial intelligence came into effect. This text classifies AI systems by risk level and imposes graduated constraints.
Why does this issue concern executives beyond just technical directors? Because the regulation targets the company deploying the system, not just the one designing it. An applicant sorting software, a credit scoring tool, or an intelligent video surveillance system: if your company uses them, it bears the responsibility for compliance.
Concrete points of vigilance for a company in France
- AI systems classified as “high risk” (recruitment, credit scoring, access to public services) require technical documentation, a compliance assessment, and ongoing human oversight.
- General-purpose AI systems, including large language models used internally, must comply with transparency obligations: inform users that they are interacting with AI, maintain activity logs.
- Sanctions can reach a significant percentage of global revenue, placing AI compliance at the same financial risk level as GDPR.
- The executive must be able to prove the compliance of each deployed system, which implies a prior inventory of all tools integrating AI within the organization.
Many companies are discovering that they use more AI systems than they thought. A simple automated filter in a CRM or a customer service chatbot may fall under the regulation’s scope.
Training and governance: adapting the organization to new regulatory constraints
These two regulations share a common point: they shift responsibility to the top of the company. Sustainability reporting and AI compliance are no longer the responsibility of an isolated department. They engage the general management and the board of directors.
Training for executive teams becomes an operational lever, not just a communication exercise. A management committee that does not understand the risk categories of the AI Act or the ESRS standards of the CSRD makes decisions blindly. Several specialized firms report that the demand for targeted training for executive committees has significantly increased since the beginning of the year.
Building a cross-cutting compliance foundation
Rather than treating the CSRD and AI Act in silos, some executives are pooling efforts. The logic is simple: both texts require documentation, traceability, and identified governance.
- Simultaneously mapping ESG data flows and AI systems allows for identifying overlapping areas (a supply chain algorithm can generate relevant data for carbon reporting).
- Appointing a cross-cutting reference (expanded compliance officer) avoids the multiplication of contacts facing auditors.
- Integrating both topics into the same quarterly review calendar reduces administrative burden without sacrificing rigor.
Companies that anticipate this convergence save time and achieve consistency in the face of regulators who are also beginning to cross-check controls.
Regulatory monitoring and leadership: what French executives need to watch for this fall
The fall of 2026 promises to be dense in regulatory terms. The French transposition of the Omnibus package will be subject to parliamentary consultations in the coming months. The first decisions from the competent national authority on the AI Act could also set precedents.
For an executive, the riskiest posture would be to wait for the final version of each text before taking action. Value chains are already shifting: contractors are integrating sustainability criteria into their calls for tenders, and investors are scrutinizing the AI maturity of companies in their due diligence.
Establishing a structured regulatory monitoring system, even a light one, offers better protection than a catch-up audit. A monthly thirty-minute meeting with a specialized lawyer is often sufficient to identify decisions to be made before they become urgent.