The Corporate Sustainability Reporting Directive (CSRD) is the EU law that requires large companies to publish audited sustainability information alongside their financial accounts. It sets out what to report through the European Sustainability Reporting Standards (ESRS), a single rulebook of reporting topics.
The picture changed in early 2026. The Omnibus I simplification package, long discussed as a proposal, became law as Directive (EU) 2026/470, adopted by the Council on 24 February 2026 and in force from 18 March 2026. It sharply narrowed who has to report and trimmed what they report. This guide covers the requirements as they now stand: who is in scope, what the standards cover, when reports are due, and how to prepare.
- The CSRD, the EU law that requires large companies to publish audited sustainability information, was sharply narrowed when the Omnibus simplification package became law as Directive (EU) 2026/470.
- An EU company now reports only if it exceeds both EUR 450 million in net turnover and 1,000 employees on average. The old EUR 50 million turnover / EUR 25 million balance-sheet test no longer applies.
- Reporting follows 12 European Sustainability Reporting Standards (ESRS). The new scope applies to financial years from 2027, and the Commission has indicated in-scope companies fall from roughly 50,000 to around 5,000.
- Climate (ESRS E1) is the one topic a company must explain if it claims to be immaterial. In practice it is material almost everywhere.
The CSRD replaced a lighter regime with audited, standardized disclosure
The CSRD (Directive 2022/2464) replaced the older Non-Financial Reporting Directive (NFRD) in January 2023. The NFRD asked a few hundred large companies for broad, loosely structured statements. The CSRD asks for granular, comparable disclosures under the ESRS, and it makes two demands the NFRD did not.
First, it requires double materiality. A company reports both how sustainability issues affect its business (financial materiality) and how its own operations affect people and the environment (impact materiality). Second, the sustainability report must be independently assured, putting it on a similar footing to audited financial statements.
In plain terms: sustainability reporting in the EU moved from a narrative add-on to a structured, audited disclosure that sits inside the annual report.
Who must report now, after the Omnibus
The Omnibus directive raised the bar substantially. Under the amended scope (which changes Articles 19a and 29a of the Accounting Directive 2013/34/EU), an EU company is in scope when, on its balance sheet date, it exceeds:
- a net turnover of EUR 450 million, AND
- an average of more than 1,000 employees during the financial year.
Both conditions must be met. This replaces the earlier definition that brought in companies above two of three lower thresholds (250 employees, EUR 50 million turnover, EUR 25 million balance sheet). The EUR 50 million and EUR 25 million figures are the old test. They are not the post-Omnibus gate, and a company sizing itself against them today would reach the wrong conclusion.
Listed small and medium-sized enterprises, which the original CSRD would have pulled in, are now fully exempt.
Non-EU companies fall in scope where the third-country parent generates more than EUR 450 million of net turnover in the EU for each of the last two consecutive years, and has an EU subsidiary or branch with more than EUR 200 million of net turnover. These figures were raised from EUR 150 million (parent) and EUR 40 million (branch).
The Commission has indicated the narrower scope cuts the number of in-scope companies from roughly 50,000 to around 5,000. (That count comes from Commission and adviser estimates; the directive text itself does not state a number.) The companies that remain are the largest, typically operating across many sites, so their reporting burden scales with their physical and operational footprint.
When reports are due
CSRD reporting was designed to phase in across groups of companies, often called waves. The Omnibus reshaped the schedule. In the directive’s own language, the original “first set” of reporters applies for three financial years only (2024 to 2026), and a “second set” applies for financial years starting on or after 1 January 2027.
| Reporter group | Financial years | Note |
|---|---|---|
| First set (original large public-interest entities, ~500 firms) | FY 2024 to FY 2026 | Reporting now. May omit quantitative E1-9 financial-effects figures for FY 2025-2026 (the July 2025 Quick Fix). |
| Second set (the EUR 450M + 1,000-employee cohort) | From FY 2027 | The single post-Omnibus scope. |
| Listed SMEs (former Wave 3) | Eliminated | Removed from scope entirely. |
| Non-EU companies (EUR 450M EU turnover) | FY 2028 (filed 2029) | Subsidiary/branch test above. |
The important consequence is easy to miss: from FY 2027 the scope is simply the EUR 450 million turnover and 1,000 employee gate. Many original first-set reporters that sit below EUR 450 million in turnover fall out of scope from FY 2027, and Member States may exempt them even for the financial years beginning in 2025 and 2026. So “the second set” is not “every company with more than 1,000 employees.” It is the companies that clear both the turnover and the headcount test.
The Commission is also revising the ESRS standards themselves under an Omnibus mandate (a delegated act due within six months of the directive entering into force). The revision trims and simplifies the data points rather than changing the topics. Companies reporting from FY 2027 will use that streamlined version.
What the standards cover: the 12 ESRS
Reporting is organized across 12 European Sustainability Reporting Standards. Two are cross-cutting and apply to every reporter. The other ten cover environmental, social, and governance topics and apply only where a company’s double materiality assessment finds them material.
| Standard | Topic |
|---|---|
| ESRS 1, ESRS 2 | Cross-cutting: framework rules, governance, strategy, risk management, metrics and targets (apply to all) |
| ESRS E1 | Climate change (mitigation, adaptation, energy, physical and transition risk, financial effects) |
| ESRS E2 to E5 | Pollution; water and marine resources; biodiversity; resource use and circular economy |
| ESRS S1 to S4 | Own workforce; value-chain workers; affected communities; consumers and end-users |
| ESRS G1 | Business conduct |
Climate (ESRS E1) holds a special position: it is the only topic where a company that concludes it is not material must explain that conclusion. In practice climate is material almost everywhere. ESMA’s 2025 review of 91 reporting companies found E1 assessed as material by 100% of them. For what ESRS E1 actually requires on climate and physical risk, see the companion guide on CSRD climate risk disclosure under ESRS E1.
The value-chain cap protects smaller suppliers
A common worry is that in-scope companies will push ESRS-level data requests down to small suppliers. The Omnibus added a guard. Companies in the value chain that do not exceed 1,000 employees on average are “protected undertakings.” A reporting company is prohibited from requiring information from them beyond the limits set by the voluntary reporting standard, and protected undertakings have a statutory right to refuse anything above that. The reporting company may rely on a supplier’s self-declaration of its size and does not have to verify it.
In plain terms: the directive caps how much sustainability data a large reporter can demand from a small supplier, and gives the supplier the right to say no.
Sample Climate Risk Assessment
See a full climate risk assessment, end to end
We’ll email you a complete worked example for a manufacturing site: 12 hazards, multiple scenarios, and value-at-risk out to 2050. It’s the underlying assessment that feeds the climate (ESRS E1) part of a CSRD report.
Assurance: limited, and staying that way
Every CSRD sustainability report must undergo independent limited assurance. Limited assurance is a lower bar than the reasonable assurance applied to financial statements, but it still requires documented processes, traceable data, and an audit trail an assurance provider can follow from each disclosed figure back to its source.
The original CSRD set a path to escalate from limited to reasonable assurance later. The Omnibus removed that escalation. Limited assurance is now the permanent standard, and the Commission’s limited-assurance standards are due by 1 July 2027.
In plain terms: the assurance bar will not ratchet up to the financial-audit level, which holds the compliance cost down. For who performs that check and what evidence they ask for, see our CSRD limited assurance explainer.
Format: machine-readable, inside the annual report
The sustainability report is not a standalone PDF. It must be prepared in XHTML and tagged with XBRL (a structured digital format that makes the data machine-readable and comparable across companies), and it must sit inside the company’s annual management report, next to the financial information.
Penalties sit with national regulators
The CSRD has no single EU-wide penalty regime. Enforcement is set by each Member State and can include fines, public notice of non-compliance, or restrictions on trading securities. This differs from the EU due-diligence directive (CSDDD), whose penalties are more harmonized. (The Omnibus also narrowed the CSDDD, raising its thresholds to more than EUR 1.5 billion turnover and more than 5,000 employees.) Separately, if an assurance provider finds material misstatements, a company faces both regulatory and reputational consequences.
How to prepare for CSRD compliance
A company in the second set reports on FY 2027, with the report filed in 2028. That feels distant, but building the data processes and controls to meet ESRS takes 12 to 18 months. A practical sequence:
- Confirm scope. Check whether you exceed both EUR 450 million net turnover and 1,000 employees on average, at group level where applicable. Non-EU groups check EU-generated turnover and the subsidiary/branch test.
- Run a double materiality assessment. Follow EFRAG’s Implementation Guidance (IG-1) process: understand your context, identify impacts and risks across the ESRS topics, assess them against severity and likelihood, and document the result. Climate (ESRS E1) is the topic you must justify if you find it immaterial.
- Gap analysis. Map your current disclosures against the data points your materiality assessment flagged as material, to see what you already collect and what you lack.
- Build data collection. Stand up the systems to gather what the gap analysis revealed. Different topics need different sources and tools.
- Screen physical climate risk. For the climate standard, this means documented, scenario-based hazard screening across your operations and material supply-chain sites. The methodology and data sources have to be transparent enough to assure. This is where Continuuiti supplies the asset-level exposure data; the full requirement is covered in the CSRD climate risk disclosure guide.
- Assurance readiness. Put controls around sustainability data that mirror your financial-reporting controls: defined ownership, validation, and an audit trail per metric. Engage your assurance provider early.
- Integrate with the annual report. Coordinate with the finance team so the sustainability statement is embedded in the management report and tagged for XBRL.
Frequently asked questions
Who has to comply with the CSRD after the Omnibus?
EU companies that exceed both EUR 450 million in net turnover and 1,000 employees on average. Non-EU companies with more than EUR 450 million of EU turnover (over two consecutive years) and an EU subsidiary or branch above EUR 200 million. Listed SMEs are fully exempt. The scope fell from roughly 50,000 companies to around 5,000.
What is the CSRD reporting timeline?
Original first-set reporters cover FY 2024 to 2026. From FY 2027 the single EUR 450 million and 1,000 employee scope applies, and original reporters below that threshold drop out. Non-EU companies start with FY 2028 (filed 2029). Listed SMEs have been removed.
What changed in the CSRD under the Omnibus?
Directive (EU) 2026/470 raised the EU threshold to EUR 450 million turnover and 1,000 employees, and exempted listed SMEs. It raised the non-EU thresholds (EUR 450 million parent, EUR 200 million subsidiary or branch), added a value-chain data cap, removed the move to reasonable assurance, deleted sector-specific ESRS, and mandated a slimmed ESRS revision. It applies from FY 2027.
Is the assurance requirement increasing over time?
No. The Omnibus removed the planned escalation from limited to reasonable assurance. Limited assurance is now permanent.
What are the disclosure requirements under the CSRD?
Reporting follows 12 ESRS. ESRS 1 and ESRS 2 apply to everyone; the ten topical standards apply where material. Climate (ESRS E1) is the one topic a company must explain if it claims to be immaterial.
Free Climate Risk Report
Run a free climate risk assessment for your location
12 hazards across multiple emission scenarios and four time horizons, for any site. Start free, no call required.
Sources
- Directive (EU) 2026/470 (Omnibus I), amending Directives 2022/2464, 2013/34/EU, 2006/43/EC and 2004/109/EC. EU scope (net turnover over EUR 450 million and more than 1,000 employees; Arts 19a/29a); third-country thresholds (Art 40a); FY 2027 application; value-chain cap; assurance; sector-specific deletion; ESRS revision mandate. Adopted 24 February 2026, OJ 26 February 2026, in force 18 March 2026.
- CSRD (Directive 2022/2464) and NFRD (Directive 2014/95/EU) for the reporting framework and its predecessor.
- EFRAG Implementation Guidance IG-1 (materiality assessment process).
- ESMA, Materiality matters fact-finding (October 2025): ESRS E1 assessed material by 100% of the 91 issuers reviewed.
