When regulation retreats, the risk doesn't

The compliance mirage

On 18 March 2026, the EU's Omnibus I simplification package took effect. Among its most consequential changes: the standalone legal obligation under the Corporate Sustainability Due Diligence Directive (CSDDD/CS3D) for large companies to adopt and implement a Paris-aligned climate transition plan was deleted outright. The directive's scope narrowed from approximately 13,000 to 6,000 companies, with a single compliance date moved to 2029. Companies still reporting under the Corporate Sustainability Reporting Directive (CSRD) must disclose a transition plan under ESRS E1, but the harder legal duty to act on one is gone.

Read narrowly, this is a compliance story: fewer companies, later deadlines, lighter penalties. Read at board level, it is a different story entirely. One that touches four domains usually discussed separately but increasingly can't be: physical climate risk, adaptation and resilience, carbon markets, and transition finance. Omnibus loosened the disclosure architecture connecting them. It did nothing to the underlying exposure.

Physical risk was never contingent on Brussels

I spent years building catastrophe and climate risk models on the insurance and reinsurance side before moving into strategy and risk advisory. The lesson that carries over is simple: physical risk pricing has always run ahead of regulation, not behind it. Reinsurers, credit officers and asset owners were pricing flood, heat, drought and windstorm exposure into portfolios years before CSRD or CS3D existed, because loss data forced the issue directly.

That means the Omnibus rollback changes almost nothing about whether an asset in a flood-exposed delta or a heat-stressed supply region is mispriced. It changes who is legally required to have quantified that exposure, and by when. For financial institutions in particular: where transition and physical risk show up as credit risk, underwriting risk and portfolio risk rather than operational risk. This distinction has always mattered more than the compliance calendar suggests.

The data bears this out: Swiss Re's sigma reports show that natural catastrophe losses have exceeded $100 billion annually in 8 of the last 10 years, with secondary perils (flood, wildfire, hail) growing faster than primary perils. Munich Re's 2025 analysis found that 72% of corporate insurance claims now involve climate-related physical risks, up from 45% in 2020. These are balance sheet realities that exist independent of disclosure timelines.

Adaptation and resilience: the asymmetry regulation never fully captured

Adaptation finance sits awkwardly inside most ESG and due-diligence frameworks, including CS3D even before Omnibus, because adaptation spend doesn't reduce a company's own emissions footprint, the metric most disclosure regimes are built to track. It reduces exposure to physical loss, which is a balance-sheet question, not primarily a reporting one.

That mismatch is a large part of why adaptation and resilience investment has consistently lagged mitigation finance globally. The Climate Policy Initiative estimates that adaptation finance flows reached $63 billion in 2023. Just 10% of total climate finance and far below the $340-477 billion annually the EU estimates is needed for its climate investment gap alone.

Yet the insurance protection gap tells the real story: only 40% of global catastrophe losses were insured in 2023 (Swiss Re), with the gap widest in emerging markets where physical risk is growing fastest.

Some boards that treated their transition plan mainly as a mitigation-and-disclosure exercise now have one less reason to keep resilience spend on the agenda at all.

Leading boards understand adaptation as core capital allocation: where to harden infrastructure, which counterparties carry uninsured physical exposure, where insurance retreat is already signalling repricing before the loss event happens. They lose nothing when the regulatory duty softens, because their duty was never the first reason this work mattered.

Carbon markets: the mechanism regulation depends on, not the other way around

It's imperative in 2026 to consider the full arc of the EU's own decarbonisation architecture: CBAM, the Innovation Fund, the Carbon Border Adjustment Mechanism, and the proposed Carbon Removals and Carbon Farming Regulation (CRCF). This runs on carbon pricing and market mechanisms that sit entirely outside CSDDD's scope and were untouched by Omnibus. So far so good.

It is worth boards noting explicitly: the compliance carbon market and the voluntary carbon market are not downstream of due-diligence disclosure. They are separate infrastructure, moving on their own timeline, and they increasingly set the actual price signal that transition plans were meant to translate into strategy.

Consider the numbers:

• EU ETS prices have tripled since 2020, from ~€25 to ~€90/tonne in early 2026
• CBAM's first reporting period began in October 2023, with financial obligations starting in 2026
• The voluntary carbon market traded ~500 million tonnes in 2024 (Ecosystem Marketplace), with prices for high-integrity removals exceeding $200/tonne
• Article 6 mechanisms under the Paris Agreement are creating new cross-border carbon credit flows that will affect EU competitiveness

That means a company treating its transition plan as the primary analytical output, with carbon market exposure as a subordinate line item, now has a weaker forcing function holding that analysis together.

Leading companies continuously evaluate their carbon market positioning: CBAM cost exposure, removals procurement, EU ETS pricing trajectory. As the driver, with the transition plan as one output among several, they lose nothing when the plan's legal status changes.

The prudential reality: ECB, EIOPA, and national supervisors aren't waiting

While the EU simplified disclosure, prudential supervisors are moving in the opposite direction. The European Central Bank's 2025 climate stress test, its third iteration, now explicitly requires banks to model physical risk impacts on credit portfolios, integrate transition risk into capital planning, assess carbon market exposure through ETS and CBAM, and demonstrate adaptation resilience in operational risk frameworks.

EIOPA's 2026 guidelines for insurers similarly mandate that climate risk be treated as a material risk category in Solvency II Pillar 1 calculations. The European Insurance and Occupational Pensions Authority has signalled that underwriting standards must evolve to reflect physical risk repricing, regardless of CSRD scope.

Regional banks and insurers, often lacking the resources of global players, face particular pressure: the European Banking Authority's 2025 report found that 60% of EU regional banks had not yet integrated climate risk into their credit risk models, despite 78% acknowledging material exposure to physical risks in their portfolios.

Institutional investors: the market is pricing what regulation isn't

Institutional investors are not waiting for regulatory clarity. Engagement has made its way into stewardship reporting and now includes climate risk discussions, with physical risk and adaptation resilience as top priorities for the first time. Explicit screening for physical risk exposure in portfolios has become established practice, and this backsliding-risk deserves attention it may otherwise not get.

Private equity and VC investors are moving faster. Climate tech capital supports adaptation and resilience startups with strong increases year-over-year lately, as investors recognise the commercial opportunity in physical risk solutions. This is not only a conversation at financial institutions; the travel tech sector, too, is increasingly being advised on its climate resilience strategy, as physical risks to supply chains and destinations make strategic risk and adaptation investments clearer.

My personal observation and message here is clear: while regulation simplified, the market is pricing physical risk, adaptation gaps, and carbon exposure with increasing sophistication.

Three questions for the committee agenda, not the 2029 deadline

For audit, risk, and sustainability committees, the right response to Omnibus is not to relax climate oversight, but to re-anchor it in economics and exposure rather than disclosure scope. Three questions can structure that conversation this quarter:

1. Is transition risk still owned by someone, now that no one has to sign off on it? Statutory duties concentrate ownership almost by accident. Remove the duty and ownership diffuses across sustainability, risk, and strategy functions that each assume someone else is tracking it.
2. Does the organisation's physical and adaptation exposure get assessed independently of what it's required to disclose? Regulatory scope thresholds are a political outcome, not a risk boundary. A company sitting just below CS3D's €1.5 billion turnover threshold carries essentially the same transition and physical exposure as one just above it.
3. Is carbon market exposure, compliance and voluntary, still being priced into strategy, or was it riding on the transition plan's coattails? CBAM cost pass-through, ETS price trajectories, and removals market development don't pause because a due-diligence duty was scaled back.

Committees that treat these as capital-allocation questions rather than compliance check-boxes will keep the right work on the agenda regardless of the 2029 deadline.

The competitiveness argument and the risk argument are not the same

The Omnibus rollback is reasonably read as part of a broader EU competitiveness recalibration, and that is a legitimate policy debate on its own terms. The European Commission's 2025 Competitiveness Strategy explicitly frames CS3D simplification as a pro-growth measure to reduce administrative burden on EU businesses.

But it is a separate question from whether a given institution's physical, transition, and carbon-market exposure is priced correctly on its own books. Conflating regulatory relief with risk relief is the mistake worth flagging first: at committee level, this year, not at the 2029 compliance date.

The institutions that will win

The institutions that keep treating transition plans, physical risk exposure, adaptation investment, and carbon-market positioning as four separate compliance workstreams that can each be individually deprioritised won't win. Those that succeed in holistically connecting their capital-allocation disciplines will, without scrambling to rebuild capability from scratch when:

• The next ECB climate stress test (2027) demands granular physical risk modelling
• Insurance markets further retreat from high-risk geographies, forcing self-insurance or capital reallocation
• CBAM and ETS costs escalate faster than transition plans anticipated
• The next physical loss event exposes unpriced exposure in a major portfolio
• VC-backed climate solutions mature and create new competitive advantages in resilience

The window to act is now. The regulatory noise is high, but the underlying risks warrant strategic, timely and holistic positioning.

illuminem Voices is a democratic space presenting the opinions of leading Sustainability Thought Leaders, their views do not necessarily represent those of illuminem.

The world needs sustainability knowledge. At illuminem, no interest group or shareholder can influence our work. Thank you for supporting our mission to make high-quality and independent sustainability information free for all. Every contribution helps. Thank you for donating today.