Under the CSRD a company must publish, as an identified section of its management report and against the ESRS standards, how its activity affects people and the environment and what risks those matters pose to the business — and must have that section assured. Since the latest narrowing the duty reaches only the largest undertakings.
Quick Overview
What you’ll learn:
- The size test that now decides whether the duty reaches you
- The separate chain applied where the parent sits outside the Union
- Which financial year a covered undertaking starts from
- What assurance asks for, and what the format does not yet require
Who this article is for:
- Finance directors and controllers preparing a first statement
- Sustainability teams assembling the ESRS disclosures
- Data teams who must get the figures out of source systems
Reading time: 8 minutes
The Size Test
Many companies arrive at the CSRD with a reporting history behind them, usually under the GRI Standards maintained on globalreporting.org. That history is useful and not the same thing: a voluntary framework lets the reporter pick its boundary, depth and publication date, while the CSRD fixes all three by law and attaches an assurance engagement. So “do we report” has a legal answer, reached by a chain of tests.
The requirements sit inside the Accounting Directive 2013/34/EU, because Directive (EU) 2022/2464 of 14 December 2022 on eur-lex.europa.eu amended it rather than standing beside it. Articles 19a and 29a carry the duty, and the size vocabulary they rely on was reset by Commission Delegated Directive (EU) 2023/2775 of 17 October 2023.
Directive (EU) 2026/470 of 24 February 2026 on eur-lex.europa.eu then lifted the bar sharply. Individual-level reporting is owed where net turnover passes EUR 450 000 000 and the average number of employees passes 1 000 in the financial year. Groups and issuers are measured the same way. Separately, listed small and medium-sized undertakings were removed from the regime outright, so for them no arithmetic is needed at all.
The consequences cut both ways. A company that prepared for years as a “large undertaking” under the earlier vocabulary may now sit outside the duty, while a mid-sized subsidiary owing nothing on its own account still feeds its parent’s consolidated statement as a data provider. Neither follows from a readiness memo.
Where the Parent Sits Outside the Union
A different chain applies when the top of the group is a third-country undertaking. Article 40a of Directive 2013/34/EU, as amended on eur-lex.europa.eu, reads best as tests in order.
Begin at group level, because this test gates the rest: did the third-country undertaking generate net turnover in the Union above EUR 450 000 000 in each of the last two consecutive financial years? One strong year does not open the gate. If it opens, look for an EU subsidiary whose own net turnover passed EUR 200 000 000 in the preceding financial year — that subsidiary carries the publication duty. Only where no such subsidiary exists does attention move to an EU branch, at the same figure. Each number replaced something different under the amending directive on eur-lex.europa.eu: the group-level gate rose from EUR 150 000 000 to EUR 450 000 000, the branch threshold from EUR 40 000 000 to EUR 200 000 000, and the subsidiary — previously identified by size class rather than a turnover figure — acquired the EUR 200 000 000 test.
What the subsidiary or branch owes is narrower than Articles 19a and 29a require: it makes available the statement its parent supplies, rather than reporting on its own account.
The Starting Financial Year
For an undertaking that passes the size test, the start date depends on its wave before the amendments.
A first-wave undertaking has reported since financial year 2024, and Directive (EU) 2026/470 on eur-lex.europa.eu confines that provision to three financial years from 1 January 2024 — making financial year 2027 the handover to the narrowed second-wave provision. Where an undertaking met the old provision but misses the narrowed one, financial year 2027 is when it stops reporting instead. Those originally due to begin with financial years 2025 or 2026 had already been deferred by Directive (EU) 2025/794 of 14 April 2025, “stop the clock”.
Domestic implementing law applies as enacted until amended. The directive on eur-lex.europa.eu gives Member States until 19 March 2027 for Articles 1 to 3 and until 26 July 2028 for Article 4, taking effect twenty days after publication in the Official Journal.
Can You Evidence It?
What must be disclosed comes from Commission Delegated Regulation (EU) 2023/2772 of 31 July 2023 on eur-lex.europa.eu: cross-cutting ESRS 1 and ESRS 2, then topical standards for the environmental area opening with ESRS E1 on climate change, the social area and governance. A double materiality assessment selects which apply.
Assurance is the part that reaches into systems. A statutory auditor or audit firm performs it at limited assurance level; a Member State may admit an independent assurance services provider instead. The demand is a traceable line from each published figure to the system that produced it and the person accountable — build it while collecting the data, because reconstructing it mid-engagement is where cost lands. Directive (EU) 2026/470 on eur-lex.europa.eu withdrew the plan to mandate reasonable assurance standards and set 1 October 2028 for the limited assurance ones.
The electronic format is widely overstated and deserves a precise reading. The management report goes out in the single electronic reporting format of Commission Delegated Regulation (EU) 2019/815 on eur-lex.europa.eu, but marking up the sustainability section is not yet required: recital 24 of Directive (EU) 2026/470 states that until marking-up rules are adopted into that regulation, undertakings need not mark up their sustainability reporting. Keeping figures as fields is preparation ahead of a deadline, not a breach of a current one.
One obligation runs inward: the same directive caps what may be required from value chain partners, leaving due diligence duties under other Union or national law untouched and not reaching data gathered for internal risk management.
Read Also
- ESG reporting: where to start as a company — first steps
- Measuring the carbon footprint of IT infrastructure — an environmental input
- Sustainable IT: practical green IT operations — what technology can measure
Build Your Skills
This topic is developed in the CSRD and ESG reporting with IT tools and CSRD: practical sustainability reporting workshop courses. The first covers getting data into a traceable, field-level structure; the second walks through materiality and the statement itself. Contact us to match the scope to your stage.
Frequently Asked Questions (FAQ)
Who does the CSRD cover after the latest amendments?
Run the size test: net turnover above EUR 450 000 000 with an average headcount above 1 000, per Directive (EU) 2026/470 on eur-lex.europa.eu, measured the same way for groups and issuers. Listed small and medium-sized undertakings sit outside the regime whatever their figures; a third-country group is measured by the Article 40a chain.
Which standards have to be applied, and where are they published?
Start from your double materiality assessment rather than the catalogue: it determines which disclosures you owe, and an auditor may challenge the selection. The catalogue — ESRS 1 and ESRS 2 plus topical standards including the climate standard ESRS E1 — comes from Commission Delegated Regulation (EU) 2023/2772 on eur-lex.europa.eu.
Does the sustainability statement have to be audited?
Assured rather than audited, and the distinction is not cosmetic: limited assurance is narrower than a financial audit, though real. A statutory auditor or audit firm carries it out, or an independent assurance services provider where a Member State allows it. Under Directive (EU) 2026/470 on eur-lex.europa.eu reasonable assurance standards are no longer planned and the limited assurance standards are due by 1 October 2028.
What tooling does CSRD-compliant reporting require?
Judge any candidate on the route back from a number, since that is what an assurance provider asks for: which system produced a figure, who owns it, what happened between the raw and published value, and who signed it off. A product preserving that route earns its place; one that only renders a statement moves the work to the engagement. The format is the lesser constraint — keeping figures as fields is worth doing now, though marking up is not yet required.