Who must comply with CSRD?

Under Omnibus I, CSRD covers EU companies with more than 1,000 employees and more than €450 million in net turnover; those not already reporting start with financial year 2027. Listed SMEs are out of scope. Non-EU groups with over €450 million in EU turnover and an EU subsidiary or branch above €200 million report from financial year 2028.

What are the ESRS standards?

The European Sustainability Reporting Standards (ESRS) are the detailed reporting standards developed by EFRAG under CSRD. They include: ESRS 1 (General Requirements), ESRS 2 (General Disclosures — always mandatory), and 10 topical standards covering Environment (E1-E5), Social (S1-S4), and Governance (G1). Topical standards apply based on double materiality assessment.

What are the penalties for non-compliance?

Penalties are set by EU member states during national transposition. Expected penalties include fines, public statements of non-compliance, and potential director liability. Since CSRD reports are part of the management report and subject to external assurance, non-compliance carries similar consequences to financial reporting failures.

CSRD: Corporate Sustainability Reporting Directive

Status, September 2026: The EU's Omnibus I directive (in force March 18, 2026) narrows the CSRD to companies with more than 1,000 employees and more than €450 million in net turnover. The amendments apply from financial year 2027, with first reports in 2028, and member states must transpose them by March 2027. Source: Council of the EU.

What Is CSRD?

The Corporate Sustainability Reporting Directive (CSRD) is the EU's comprehensive sustainability disclosure law, adopted in November 2022. It replaces the Non-Financial Reporting Directive (NFRD) and dramatically expands the detail and rigor of required sustainability reporting in Europe.

As adopted, CSRD would have brought about 50,000 companies into mandatory sustainability reporting, up from roughly 11,700 under NFRD, according to the Council of the EU. The Omnibus I amendments (Directive (EU) 2026/470) cut the number of companies in scope by around 90%, according to a December 2025 analysis by law firm A&O Shearman. For the first time, sustainability reports must be included in the management report and subject to mandatory external assurance, and they will need to be digitally tagged in XBRL format once the Commission adopts the tagging rules.

Who It Applies To

CSRD uses a phased approach. The April 2025 "stop-the-clock" directive delayed Phases 2 and 3 by two years, and Omnibus I, in force since March 18, 2026, narrowed the scope:

Phase	Companies	Reporting Year	First Report Due
Phase 1	Companies already under NFRD (large public-interest entities with 500+ employees)	FY2024	2025
Phase 2	Other EU companies with more than 1,000 employees and more than €450M net turnover	FY2027	2028
Phase 3	Listed SMEs	Removed from scope by Omnibus I	None
Phase 4	Non-EU groups with more than €450M EU net turnover and an EU subsidiary or branch with more than €200M	FY2028	2029

From financial year 2027, the same 1,000-employee and €450 million thresholds decide scope for all EU companies. Phase 1 companies that fall below them drop out from that year, and member states may exempt them for financial years 2025 and 2026.

Important: the criteria apply at the individual entity or consolidated group level. A non-EU parent company may be in scope through its EU subsidiaries.

Key Requirements

Double materiality assessment: Companies must assess both impact materiality (their effects on people and environment) and financial materiality (how sustainability topics affect the company financially). A topic is reportable if it meets either threshold.

ESRS compliance: Report against the European Sustainability Reporting Standards — detailed, prescriptive standards covering:

ESRS 2: General disclosures (mandatory for all companies)
E1-E5: Climate change, pollution, water, biodiversity, circular economy
S1-S4: Own workforce, value chain workers, communities, consumers
G1: Business conduct

Value chain coverage: ESRS requires disclosure on impacts, risks, and opportunities across the full value chain — upstream suppliers, own operations, and downstream customers. Under Omnibus I, value chain companies with up to 1,000 employees can decline to provide more than the voluntary SME standard (VSME) asks for.

Digital tagging: Reports will need to be tagged in XBRL format per the ESRS digital taxonomy, enabling machine-readable disclosure. Under Omnibus I, tagging is not required until the Commission adopts the tagging rules.

External assurance: Limited assurance is mandatory from the first reporting year. Omnibus I dropped the planned move to reasonable assurance, and the Commission has until July 1, 2027 to adopt limited assurance standards.

Timeline and Deadlines

January 2023: CSRD entered into force
July 2023: First set of ESRS adopted by European Commission
FY2024: Phase 1 companies begin reporting
April 2025: "Stop-the-clock" directive delays Phase 2 and Phase 3 reporting by two years
March 18, 2026: Omnibus I enters into force, narrowing scope and removing listed SMEs
July 2026: Commission adopts simplified ESRS, with 61% fewer mandatory datapoints, applying from FY2027
March 19, 2027: Deadline for member states to transpose Omnibus I
July 1, 2027: Deadline for the Commission to adopt limited assurance standards
FY2027: Phase 2 companies begin reporting (reports due 2028); Phase 1 companies below the new thresholds drop out
FY2028: Phase 4 (non-EU groups) begin reporting (reports due 2029)

Compliance Steps

Determine your scope and timeline: Confirm which entities are in scope and when
Conduct double materiality assessment: Identify material topics across all ESRS standards
Gap analysis: Map required ESRS datapoints against current data availability
Build data infrastructure: Establish systems for collecting, validating, and managing required data
Prepare narrative disclosures: Develop governance, strategy, and risk management narratives
Engage assurance provider: Select and engage your assurer early in the process
Draft sustainability statement: Write the ESRS-compliant sustainability section of the management report
XBRL tagging: Once the Commission adopts the tagging rules, tag the sustainability statement per the ESRS digital taxonomy
Assurance engagement: Complete the assurance process
Board approval and filing: Obtain board approval and file with the management report

Penalties

Penalties are determined by individual EU member states during national transposition. Expected enforcement mechanisms include:

Financial penalties (fines)
Public naming of non-compliant companies
Director liability for management report content
Securities regulator enforcement for listed companies

How Council Fire Can Help

Council Fire provides end-to-end CSRD compliance support — from double materiality assessment through ESRS gap analysis, data system design, report drafting, and assurance readiness. Contact us to discuss your CSRD compliance needs.