The Corporate Sustainability Reporting Directive (CSRD) is the EU law that requires large companies to publish audited sustainability information alongside their financial accounts. It sets out what to report through the European Sustainability Reporting Standards (ESRS), a single rulebook of reporting topics.
The Omnibus I simplification package, long discussed as a proposal, became law as Directive (EU) 2026/470, adopted by the Council on 24 February 2026 and in force from 18 March 2026. It sharply narrowed who has to report and trimmed what they report. This guide covers the requirements as they now stand: who is in scope, what the standards cover, when reports are due, and how to prepare.
- The CSRD, the EU law that requires large companies to publish audited sustainability information, was sharply narrowed when the Omnibus simplification package became law as Directive (EU) 2026/470.
- An EU company now reports only if it exceeds both EUR 450 million in net turnover and 1,000 employees on average. The old EUR 50 million turnover / EUR 25 million balance-sheet test no longer applies.
- Reporting follows 12 European Sustainability Reporting Standards (ESRS). The new scope applies to financial years from 2027, and the Commission has indicated in-scope companies fall from roughly 50,000 to around 5,000.
- Climate (ESRS E1) is the one topic a company must explain if it claims to be immaterial. In practice it is material almost everywhere.
The CSRD replaced a lighter regime with audited, standardized disclosure
The CSRD (Directive 2022/2464) replaced the older Non-Financial Reporting Directive (NFRD) in January 2023. The NFRD applied to large public-interest companies with more than 500 employees and asked for broad, loosely structured statements. The CSRD asks for granular, comparable disclosures under the ESRS, and it makes two demands the NFRD did not.
First, it requires double materiality. A company reports both how sustainability issues affect its business (financial materiality) and how its own operations and value chain affect people and the environment (impact materiality). Second, the sustainability report must be independently assured, putting it on a similar footing to audited financial statements.
In plain terms: sustainability reporting in the EU moved from a narrative add-on to a structured, audited disclosure that sits inside the annual report.
Who must report now, after the Omnibus
The Omnibus directive raised the bar substantially. Under the amended scope (which changes Articles 19a and 29a of the Accounting Directive 2013/34/EU), an EU company is in scope when, on its balance sheet date, it exceeds:
- a net turnover of EUR 450 million, AND
- an average of more than 1,000 employees during the financial year.
Both conditions must be met, tested on a consolidated basis for parent companies.
Non-EU companies fall in scope where the third-country parent generates more than EUR 450 million of net turnover in the EU for each of the last two consecutive years, and has an EU subsidiary or branch with more than EUR 200 million of net turnover.
The companies that remain are the largest, typically operating across many sites, so their reporting burden scales with their physical and operational footprint.
What the CSRD Omnibus changed
Four legal acts, led by the Omnibus directive, now shape who reports, when, and how much: one cut the scope, one bought time, one eased the load on companies already reporting, and one slimmed the standards themselves.
| Instrument | What it did | Status |
|---|---|---|
| Omnibus I, Directive (EU) 2026/470 | Raised the scope thresholds, exempted listed SMEs, deleted sector-specific standards, kept assurance at the limited level, added a value-chain data cap, and ordered a slimmer ESRS | In force 18 March 2026. Member States write the CSRD changes into national law by 19 March 2027 |
| Stop-the-Clock, Directive (EU) 2025/794 | Delayed the second and third reporting waves by two years | In force since 17 April 2025 |
| Wave-one quick fix, Delegated Regulation (EU) 2025/1416 | Let first-wave reporters omit the ESRS E1-9 financial-effects disclosure for FY 2024 to FY 2026, and extended other phase-ins | In force |
| Revised ESRS, Delegated Regulation (EU) 2026/1563 | Shorter standards across the same 12 topics, with over 60% fewer mandatory data points | Published 21 September 2026, in force 10 November 2026. Applies from FY 2027 and is optional for FY 2026 |
The CSRD scope change: from a wide net to the largest companies
The original CSRD pulled in any large EU company that met two of three tests: more than 250 employees, more than EUR 50 million in net turnover, or more than EUR 25 million in balance sheet total. The Omnibus replaced that with one higher gate, and a company must clear both parts of it.
| Original CSRD | After the Omnibus | |
|---|---|---|
| EU company test | Two of three: 250+ employees, EUR 50 million turnover, EUR 25 million balance sheet (inflation-adjusted in 2023 from EUR 40 million and EUR 20 million) | Net turnover above EUR 450 million AND more than 1,000 employees on average |
| Listed SMEs | In scope (later wave) | Exempt |
| Non-EU groups | EUR 150 million of EU turnover | EUR 450 million of EU turnover in each of the last two years, plus an EU subsidiary or branch above EUR 200 million |
| Companies in scope (estimate) | about 50,000 | about 5,000 |
The turnover test matters as much as the headcount test. A company with 2,000 employees and EUR 300 million in turnover is now out. The company counts are Commission and adviser estimates, and the directive itself gives no number.
Who dropped out of CSRD reporting, and who is still in
You are out if you fall below either gate: EUR 450 million or less in net turnover, or 1,000 employees or fewer on average. Listed SMEs are out entirely. The cut removes the smaller companies that were due to phase in later and also a band of large employers below the turnover line. Only the largest companies remain, and a company must clear both numbers to stay in.
First-wave reporters below the new gate stop reporting from FY 2027. Member States may also exempt them for FY 2025 and FY 2026, so check your national law. Belgium, Croatia, Finland and Poland had notified national measures by September 2026.
If you are out, you can still report voluntarily under the EU’s voluntary standard, in force since 24 September 2026. If you sit in the value chain of a company that is still in scope and have 1,000 employees or fewer, its data requests to you are capped at that standard’s level.
The reporting schedule shifted twice. Stop-the-Clock delayed the second and third waves by two years, and the Omnibus then narrowed who those waves contain. The dates by group are in the timeline below.
When reports are due
CSRD reporting was designed to phase in across groups of companies, often called waves. The Omnibus reshaped the schedule. In the directive’s own language, the original “first set” of reporters applies for three financial years only (2024 to 2026), and a “second set” applies for financial years starting on or after 1 January 2027.
| Reporter group | Financial years | Note |
|---|---|---|
| First set (large public-interest entities with more than 500 employees) | FY 2024 to FY 2026 | Reporting now. May omit the ESRS E1-9 financial-effects disclosure for FY 2024 to FY 2026 (the July 2025 quick fix). |
| Second set (the EUR 450M + 1,000-employee cohort) | From FY 2027 | The single post-Omnibus scope. |
| Listed SMEs (former Wave 3) | Eliminated | Removed from scope entirely. |
| Non-EU companies (EUR 450M EU turnover) | FY 2028 (filed 2029) | Subsidiary/branch test above. |
From FY 2027 the second set is the companies that clear both the turnover and the headcount test. Many companies with more than 1,000 employees fall outside it because their net turnover is EUR 450 million or less.
Companies reporting from FY 2027 use the revised ESRS published in September 2026. Companies may choose it for FY 2026 and must state which version they apply.
What the standards cover: the 12 ESRS
Reporting is organized across 12 European Sustainability Reporting Standards. Two are cross-cutting and apply to every reporter. The other ten cover environmental, social, and governance topics and apply only where a company’s double materiality assessment finds them material.
| Standard | Topic |
|---|---|
| ESRS 1, ESRS 2 | Cross-cutting: framework rules, governance, strategy, risk management, metrics and targets (apply to all) |
| ESRS E1 | Climate change (mitigation, adaptation, energy, physical and transition risk, financial effects) |
| ESRS E2 to E5 | Pollution; water and marine resources; biodiversity; resource use and circular economy |
| ESRS S1 to S4 | Own workforce; value-chain workers; affected communities; consumers and end-users |
| ESRS G1 | Business conduct |
The revised ESRS, published in September 2026 and applying from FY 2027, keeps these 12 standards. The Commission says the revision cuts mandatory data points by over 60% and total data points by over 70%.
Climate (ESRS E1) holds a special position: it is the only topic where a company that concludes it is not material must explain that conclusion. The revised standards keep that rule. In practice climate is material almost everywhere. ESMA’s 2025 review of 91 reporting companies found E1 assessed as material by 100% of them. For what ESRS E1 actually requires on climate and physical risk, see the companion guide on CSRD climate risk disclosure under ESRS E1.
The value-chain cap protects smaller suppliers
A common worry is that in-scope companies will push ESRS-level data requests down to small suppliers. The Omnibus added a guard. Companies in the value chain that do not exceed 1,000 employees on average are “protected undertakings.” A reporting company is prohibited from requiring information from them beyond the limits set by the voluntary reporting standard, and protected undertakings have a statutory right to refuse anything above that. The reporting company may rely on a supplier’s self-declaration of its size and does not have to verify it.
In plain terms: the directive caps how much sustainability data a large reporter can demand from a small supplier, and gives the supplier the right to say no.
Sample Climate Risk Assessment
See a full climate risk assessment, end to end
We’ll email you a complete worked example for a manufacturing site: 12 hazards, multiple scenarios, and value-at-risk out to 2050. It’s the underlying assessment that feeds the climate (ESRS E1) part of a CSRD report.
Assurance: limited, and staying that way
Every CSRD sustainability report must undergo independent limited assurance. Limited assurance is a lower bar than the reasonable assurance applied to financial statements, but it still requires documented processes, traceable data, and an audit trail an assurance provider can follow from each disclosed figure back to its source.
The original CSRD set a path to escalate from limited to reasonable assurance later. The Omnibus removed that escalation. Limited assurance is now the permanent standard, and the Commission’s limited-assurance standards are due by 1 July 2027. The Commission plans to base them on ISSA 5000, the international assurance standard, with EU-specific additions, and asked European audit regulators for advice on those additions by 30 September 2026.
In plain terms: the assurance bar will not ratchet up to the financial-audit level, which holds the compliance cost down. For who performs that check and what evidence they ask for, see our CSRD limited assurance explainer.
How a CSRD report is formatted and published
The sustainability report sits inside the company’s management report, next to the financial information, and is prepared in the EU’s single electronic reporting format (XHTML). The CSRD also calls for digital tagging with XBRL, which makes the data machine-readable and comparable across companies. Under the Omnibus, that tagging duty starts only once the Commission adopts the sustainability tagging rules, and until then companies do not have to tag.
The management report is published together with the auditor’s limited-assurance opinion, within the period national law sets and no later than 12 months after the balance sheet date. Member States may also require companies to put the report on their website, free of charge. National law can, in some cases, let a company provide a copy on request instead of publishing the management report.
Penalties sit with national regulators
The CSRD has no single EU-wide penalty regime. Enforcement is set by each Member State and can include fines, public notice of non-compliance, or restrictions on trading securities. This differs from the EU due-diligence directive (CSDDD), whose penalties are more harmonized. (The Omnibus also narrowed the CSDDD, raising its thresholds to more than EUR 1.5 billion net worldwide turnover and more than 5,000 employees, and capping its fines at 3% of net worldwide turnover.) Separately, if an assurance provider finds material misstatements, a company faces both regulatory and reputational consequences.
How to prepare for CSRD compliance
A company in the second set reports on FY 2027, with the report filed in 2028. That feels distant, but building the data processes and controls to meet ESRS takes 12 to 18 months. A practical sequence:
- Confirm scope. Check whether you exceed both EUR 450 million net turnover and 1,000 employees on average, at group level where applicable. Non-EU groups check EU-generated turnover and the subsidiary/branch test.
- Run a double materiality assessment. Follow EFRAG’s Implementation Guidance (IG-1) process: understand your context, identify impacts and risks across the ESRS topics, assess them against severity and likelihood, and document the result. Climate (ESRS E1) is the topic you must justify if you find it immaterial.
- Gap analysis. Map your current disclosures against the data points your materiality assessment flagged as material, to see what you already collect and what you lack.
- Build data collection. Stand up the systems to gather what the gap analysis revealed. Different topics need different sources and tools.
- Screen physical climate risk. For the climate standard, this means documented, scenario-based hazard screening across your operations and material supply-chain sites. The methodology and data sources have to be transparent enough to assure. This is where Continuuiti supplies the asset-level exposure data; the full requirement is covered in the CSRD climate risk disclosure guide.
- Assurance readiness. Put controls around sustainability data that mirror your financial-reporting controls: defined ownership, validation, and an audit trail per metric. Engage your assurance provider early.
- Integrate with the annual report. Coordinate with the finance team so the sustainability statement sits in the management report, in the EU’s electronic reporting format, and is ready for XBRL tagging once the Commission adopts the tagging rules.
Frequently asked questions
Who has to comply with the CSRD after the Omnibus?
EU companies, and parent companies of EU groups, that exceed both EUR 450 million in net turnover and 1,000 employees on average. Non-EU groups report if they earned more than EUR 450 million in the EU in each of the last two years and have an EU subsidiary or branch above EUR 200 million. Listed SMEs are exempt. The Commission has indicated the change cuts the in-scope population from roughly 50,000 companies to around 5,000.
What is the CSRD reporting timeline?
The original first-wave reporters, large public-interest entities with more than 500 employees, report on FY 2024 to FY 2026. From FY 2027, with reports published in 2028, the single EUR 450 million and 1,000-employee scope applies, and first-wave reporters below it drop out. Non-EU groups start with FY 2028, published in 2029. The listed-SME wave was removed.
Is the CSRD Omnibus still a proposal?
No. It was adopted as Directive (EU) 2026/470 on 24 February 2026 and entered into force on 18 March 2026. It raised the scope thresholds, exempted listed SMEs, deleted sector-specific standards, kept assurance at the limited level, added a value-chain data cap and ordered slimmer standards. Member States must write the CSRD changes into national law by 19 March 2027.
Is the CSRD being delayed or scrapped?
Neither. The Stop-the-Clock directive delayed the later waves by two years and the Omnibus narrowed the scope, but the CSRD stays in force for the largest companies. First-wave companies keep reporting through FY 2026.
Is the assurance requirement increasing over time?
No. The Omnibus removed the planned move from limited to reasonable assurance, so limited assurance is permanent. The Commission must adopt EU limited-assurance standards by 1 July 2027 and plans to base them on the international ISSA 5000 standard.
What are the disclosure requirements under the CSRD, and did the Omnibus change climate?
Reporting follows 12 ESRS. ESRS 1 and ESRS 2 apply to everyone, and the ten topical standards apply where the double materiality assessment finds them material. Climate (ESRS E1) is the one topic a company must explain if it concludes it is not material. The revised standards that apply from FY 2027 keep that rule while cutting data points.
How and when is a CSRD report published?
The sustainability statement sits inside the management report, which is published with the auditor’s limited-assurance opinion no later than 12 months after the balance sheet date, following national filing rules. It is prepared in the EU’s electronic reporting format, and XBRL tagging applies only once the Commission adopts the sustainability tagging rules. Member States may also require the report on the company website.
Free Climate Risk Report
Run a free climate risk assessment for your location
12 hazards across multiple emission scenarios and four time horizons, for any site. Start free, no call required.
Sources
- Directive (EU) 2026/470 (Omnibus I), amending Directives 2022/2464, 2013/34/EU, 2006/43/EC and 2004/109/EC. EU scope (net turnover over EUR 450 million and more than 1,000 employees; Arts 19a/29a); third-country thresholds (Art 40a); FY 2027 application; value-chain cap; assurance; sector-specific deletion; ESRS revision mandate. Adopted 24 February 2026, OJ 26 February 2026, in force 18 March 2026.
- CSRD (Directive 2022/2464) and NFRD (Directive 2014/95/EU) for the reporting framework and its predecessor.
- EFRAG Implementation Guidance IG-1 (materiality assessment process).
- ESMA, Materiality matters fact-finding (October 2025): ESRS E1 assessed material by 100% of the 91 issuers reviewed.
- Directive (EU) 2025/794 (Stop-the-Clock): two-year delay for the second and third waves. In force 17 April 2025.
- Delegated Regulation (EU) 2025/1416 (wave-one quick fix), Annex, ESRS 1 Appendix C (E1-9 phase-in).
- Delegated Regulation (EU) 2026/1563 (revised ESRS). OJ 21 September 2026; in force 10 November 2026; applies from FY 2027.
- Delegated Regulation (EU) 2026/1560 (voluntary standard for companies protected by the value-chain cap). In force 24 September 2026.
- Delegated Directive (EU) 2023/2775 (inflation-adjusted size criteria for large undertakings).
- Directive 2013/34/EU, Art 29d and Art 30(1) as amended by Directive (EU) 2022/2464 Art 1(10) (format and publication).
- European Commission, news release on the revised ESRS (3 July 2026, data-point reduction) and letter to CEAOB on limited-assurance standards (27 January 2026).
- EUR-Lex, national transposition measures notified for Directive (EU) 2026/470 (as of September 2026).
