What Is the CSRD and Who Has to Comply?
The CSRD is an EU law requiring companies to report detailed sustainability information alongside their financial statements, following the ESRS. It replaced the older Non-Financial Reporting Directive and applies a double materiality test, meaning companies report both how sustainability issues affect the business and how the business affects people and the environment. Reports go in the management report and carry third-party assurance.
The CSRD now applies to:
| Company type | How it qualifies |
|---|---|
| Large EU companies, listed or private | More than 1,000 employees and more than €450m net turnover |
| EU parent companies (consolidated) | Same thresholds, measured on a consolidated basis |
| Non-EU parent companies | More than €450m EU net turnover in each of two consecutive years, and an EU subsidiary or branch with more than €200m turnover |
Two things determine how much work a first report is: the double materiality assessment, which sets which topics you report, and how much of your emissions and value chain data you can already evidence. Our climate team estimates a first report takes a small internal team six months or more. Gravity's CSRD solution covers the data collection and assurance trail, and the climate disclosure framework guide shows how the CSRD sits alongside CDP, ISSB and California's rules.
What Changed under Omnibus I?
Everything about scope, and a great deal about the standards. Here is the state of play, separating what is law from what is not.
Adopted and in Force
- Directive (EU) 2025/794, the "stop the clock" directive (April 14, 2025) delayed wave 2 and wave 3 reporting by two years.
- Delegated Regulation (EU) 2025/1416, the ESRS "quick fix" (in force November 13, 2025) extended phase-in reliefs for wave 1 companies, deferring ESRS E4, S2, S3, and S4 for FY2025 and FY2026.
- Directive (EU) 2026/470, Omnibus I was adopted February 24, 2026, published in the Official Journal February 26, and entered into force in mid-March 2026. The European Parliament passed it 428 to 218. This is the directive that reset scope.
- The EU Taxonomy Omnibus Delegated Act entered into force January 28, 2026, applying retrospectively from January 1, 2026. It introduced a 10% materiality threshold, so non-financial undertakings need not assess activities representing less than 10% of turnover, capital expenditure, or operating expenditure. Templates were cut by roughly 64% of datapoints for non-financial undertakings and 89% for financial ones.
Adopted but Not Yet in Force
- The revised ESRS, adopted as delegated act C(2026) 5010 on July 3, 2026, alongside a second delegated regulation establishing the voluntary standard for smaller companies in value chains. Both were still in the European Parliament and Council scrutiny period as of mid-August 2026 and are not yet published in the Official Journal. Entry into force is expected around November 10, 2026 if no objection is raised.
Still in Progress
- ESRS-40a, the standards for non-EU undertakings, published as an exposure draft July 23, 2026 with consultation open until October 31, 2026.
- The EU limited assurance standard, due from the Commission by July 1, 2027.
- Revised EU Taxonomy technical screening criteria, overdue, targeted for application January 1, 2027.
- National transposition, due March 19, 2027.
Who Is in Scope of the CSRD Now?
The New Threshold Test
A company is in scope if it exceeds both a net turnover of €450 million and an average of 1,000 employees during the financial year. Article 19a(1) of the amended Accounting Directive states it plainly: "Undertakings which, on their balance sheet dates, exceed a net turnover of EUR 450 000 000 and an average number of 1 000 employees during the financial year."
This is an important structural change. The old test was two of three: 250 employees, €50m turnover, or €25m balance sheet total. The new test is cumulative and there is no balance sheet criterion at all. A company with 3,000 employees and €300m turnover is out. A company with 800 employees and €2bn turnover is out.
It is also a much larger cut than the Commission first proposed. The February 2025 proposal set the turnover bar at €50m. The final agreed figure is €450m.
Who Came Out of Scope
- All listed SMEs, the entire former wave 3. They never report.
- Large undertakings with 250 to 1,000 employees, and any large undertaking below €450m turnover. This is most of the former wave 2.
- Wave 1 companies below the new thresholds, out from FY2027 and potentially exempt earlier at member state discretion.
- Financial holding undertakings, newly exempted.
- Large listed subsidiaries already covered by a parent's consolidated sustainability report.
- Non-EU groups with €150m to €450m of EU turnover, and third-country subsidiaries and branches in the €40m to €200m band.
How Many Companies Remain
The Commission's own staff working document accompanying the revised ESRS puts it at 6,753 companies: 1,535 wave 1 and 5,218 wave 2. The same document describes Omnibus I as "reducing the number of companies in scope by about 85%."
You will see a 90% figure quoted widely. It is not the Commission's number. Use 85% and cite the source, or say "roughly 85 to 90%."
What Are the Current CSRD Deadlines?
The wave structure has effectively been dismantled. Here is where each cohort stands.
| Cohort | Original CSRD | Current position |
|---|---|---|
| Wave 1 — large public-interest entities over 500 employees | FY2024 | Reported FY2024. Continues FY2025 and FY2026, but member states may exempt those below the new thresholds. From FY2027, in scope only if above 1,000 employees and €450m turnover. |
| Wave 2 — other large undertakings | FY2025 | FY2027, first report published 2028, and only if above the new thresholds. |
| Wave 3 — listed SMEs | FY2026 | Removed from scope. No report. |
| Wave 4 — non-EU parent companies | FY2028 | FY2028, first report published 2029, at much higher thresholds. |
The Wave 1 Trap
The relief for wave 1 companies that fall below the new thresholds for FY2025 and FY2026 is a member state option, not an automatic exemption. Whether you report for those years depends on the transposing law in the jurisdiction where you file, and several member states are still mid-transposition with the March 2027 deadline ahead of them.
If you are a wave 1 company below 1,000 employees or €450m turnover, do not assume you are finished. Check your specific jurisdiction, and check it again before you close the year.
Non-EU Companies: Two Different Routes
A non-EU ultimate parent is caught under Article 40a if it generated more than €450m of EU net turnover in each of the last two consecutive financial years and has an EU subsidiary or branch with more than €200m turnover. There is no employee test. The obligation sits on the triggering EU subsidiary or branch, first reporting for FY2028 and publishing in 2029, under the dedicated ESRS-40a standards still in development. EFRAG estimates about 1,200 non-EU companies are caught.
A non-EU company with securities listed on an EU regulated market is not under Article 40a at all. It is caught by the ordinary thresholds of 1,000 employees and €450m turnover, applies the full ESRS, and reports on the ordinary timeline. That is a considerably heavier obligation arriving considerably sooner.
What Do the Revised ESRS Require?
The revised ESRS cut more than 60% of mandatory datapoints and more than 70% of total datapoints, and the Commission expects reporting costs to fall by more than 30% per company. All voluntary disclosures were eliminated. More than 100 optional disclosures were deleted, application requirements were moved into boxed content, and minimum disclosure requirements were repositioned as general disclosures.
Note that every published figure on this is a percentage. No source gives reliable absolute datapoint counts, so treat any specific number you see with suspicion.
What Survived
Double materiality is retained. This was the most contested question of the entire Omnibus process and the answer is that it stays. What changed is the method: the materiality assessment is now top-down, starting from business model and strategy, and companies no longer need to assess every individual impact, risk, and opportunity.
The structure also survives. ESRS 1 and ESRS 2 remain the general disclosures every company completes. The ten topical standards remain, reported where material:
Environmental (E1 to E5): climate change, pollution, water and marine resources, biodiversity and ecosystems, resource use and circular economy. ESRS E1 remains the most data-hungry standard, requiring scope 1, 2, and 3 emissions, energy use, intensity ratios, targets, and a transition plan aligned with the Paris Agreement.
Social (S1 to S4): own workforce, workers in the value chain, affected communities, consumers and end users.
Governance (G1): business conduct.
What Changed
- Companies shall not disclose non-material information except in defined circumstances, reversing the old instinct to report everything.
- Fair presentation now applies to the sustainability statement as a whole rather than datapoint by datapoint.
- Greenhouse gas reporting allows a choice between financial control and operational control consolidation approaches.
- Asset managers are exempted for client-managed investments.
- Companies whose transition plans are not compatible with 1.5°C must say so explicitly.
Sector-specific Standards Are Dropped
The Commission's power to adopt mandatory sector-specific ESRS by delegated act was deleted. Only non-binding guidance remains possible. If your planning assumed a sector standard was coming, it is not.
Which Version Applies to FY2026
Companies reporting for financial year 2026 get a choice: apply the old ESRS, apply the revised ESRS in full, or apply the old ESRS with specified reliefs. Whichever you pick, you must state clearly in your sustainability statement which version you applied. From FY2027 the revised ESRS apply to everyone in scope.
A Note of Caution from the Regulator
Worth knowing if you are calibrating how much relief to lean on: ESMA's February 2026 opinion found the revised ESRS only "partly capable" of meeting investor protection objectives, and criticised the "number, range and permanence" of the reliefs as potentially encouraging "opportunistic behaviour." It singled out the breadth of the "undue cost or effort" relief and recommended converting four permanent reliefs into temporary ones ending FY2029.
Reliefs that draw that kind of comment from a securities regulator are reliefs worth documenting carefully when you use them.
What Is Double Materiality?
Double materiality means reporting from two directions at once.
Financial materiality is how sustainability issues affect the business: how climate, social, or regulatory change could affect financial position, performance, and prospects.
Impact materiality is how the business affects people and the environment, even where those impacts do not affect financial performance.
A double materiality assessment determines which ESRS topics you report in detail and which you can justify omitting. It draws on internal functions and external stakeholders, and it requires a defined materiality threshold to judge the results.
Under the revised ESRS the assessment starts top-down from business model and strategy rather than bottom-up from every possible issue. That is a meaningful reduction in effort, but it does not make the assessment optional or quick. For most companies it remains the longest single item in a first reporting cycle, which is why it is worth starting a year ahead of the first report rather than a quarter.
What Are the CSRD Assurance Requirements?
Limited assurance, and it stays limited. The Commission's power to move the requirement up to reasonable assurance was deleted from the directive as a cost control measure. The previous October 2028 deadline for a reasonable assurance standard is gone.
The Commission must adopt an EU limited assurance standard by July 1, 2027, postponed from October 2026. Until then, no EU standard exists and assurance providers work to national requirements or international standards such as ISAE 3000 and ISSA 5000.
For planning purposes, the practical requirement is unchanged: every figure in the sustainability statement needs a traceable evidence trail. Limited assurance tests whether your numbers are supportable, and the work of making them supportable is the same whether or not the standard ever moves.
What Is the Value Chain Cap?
A statutory limit on what large companies can demand from small suppliers, and one of the more consequential changes for anyone running a supplier data programme.
A "protected undertaking" is any entity in the value chain with fewer than 1,000 employees. Protected undertakings "shall have the right to decline to provide information exceeding the information specified in the voluntary standards in response to a request made for the purpose of sustainability reporting."
Three details make this real rather than theoretical:
- Contractual clauses attempting to override the cap are void. You cannot draft around it.
- Self-declaration is enough. A reporting company may rely on a counterparty's statement that it is a protected undertaking, without verification, and gets deemed compliance for staying within the cap.
- The content of the cap is set by the voluntary standard adopted July 3, 2026, which is based on the VSME and includes further relief for entities with 10 or fewer employees.
Three carve-outs sit outside the cap: information that is common practice in a sector, information required by other legal obligations, and information required by other regulations.
The cap applies to larger companies from FY2027, and protected undertakings also get a three-year transition period.
What this means for your scope 3 programme. Your supplier surveys need to be designed around what the voluntary standard covers, because for most of your supply base that is the ceiling. The old approach of sending an exhaustive questionnaire and escalating through procurement no longer works below 1,000 employees. Building supplier-specific data now means prioritising your largest suppliers and using spend-based or industry-average methods elsewhere.
What Data Do You Need to Collect for CSRD?
ESRS E1 is the most demanding standard and the part most companies underestimate. In practice you need:
- Energy and fuel data for every site, from utility bills, meters, and fuel records, which produces scope 1 and scope 2. Gravity's utility bill management reads this straight from bills and utility APIs.
- Scope 3 across all material categories, starting from procurement spend and moving to supplier-specific data where the value chain cap allows. Our scope 3 guide covers the fifteen categories and how to prioritise them.
- Targets and a transition plan, including base year, reduction trajectory, and the capital behind it. If the plan is not 1.5°C-compatible, the revised ESRS require you to say so.
- Evidence for every figure: source document, emission factor, factor version, and change history. This is what limited assurance tests. Gravity's carbon accounting keeps that trail attached to each number.
- Non-climate topical data for whichever of E2 to E5, S1 to S4, and G1 come out material. This usually lives in HR, procurement, and health and safety systems rather than finance, which is why it takes longer to obtain than people expect.
- EU Taxonomy alignment data, still mandatory for CSRD-scope companies under Article 8, now with the 10% materiality threshold to narrow the assessment.
How Does CSRD Compare to California, CDP, and ISSB?
They ask for overlapping data with different boundaries and audiences.
- CSRD. Broadest. Ten ESRS topics subject to materiality, double materiality, scope 1, 2, and 3, a transition plan, limited assurance, filed in the management report and tagged in XBRL.
- ISSB (IFRS S1 and S2). Investor-focused and financial materiality only, built on the TCFD structure. Being adopted into national rules in more than 20 jurisdictions.
- California's climate disclosures. SB 253 covers emissions only, scope 1 and 2 due November 10, 2026 and scope 3 from 2027, with limited assurance from 2027. SB 261 requires a climate financial risk report but is currently enjoined and unenforced. See our California disclosures solution.
- CDP. A voluntary questionnaire, scored and published, aligned with the TCFD pillars.
The emissions inventory underneath all four is the same, which is why it pays to build it once with evidence attached. Our climate disclosure framework guide maps the requirements side by side.
What About the CSDDD?
The Corporate Sustainability Due Diligence Directive was rewritten by the same Omnibus I directive, and one change matters directly for CSRD reporters.
The obligation to adopt and put into effect a climate transition plan has been deleted. Companies in CSRD scope must still report a transition plan if they have one, but the CSDDD no longer requires them to have one.
Other headline changes: scope rose to more than 5,000 employees and more than €1.5bn net worldwide turnover, cutting covered companies by roughly 70%. Transposition is due July 26, 2028 with application from July 26, 2029. Full value chain mapping was replaced by a risk-based scoping exercise using "information that is already reasonably available." The harmonised EU civil liability regime was removed, penalties are capped at 3% of net worldwide turnover, and the obligation to terminate business relationships as a last resort was deleted.
Where Does National Transposition Stand?
As of the most recent comprehensive trackers in early 2026, only Austria had transposed any part of Omnibus I, adopting the new thresholds early. Twenty-three member states had transposed stop-the-clock. Six had adopted nothing. Germany, Spain, and the Netherlands all had implementation stalled or suspended pending the EU-level outcome.
Divergences worth checking if you file in these jurisdictions:
- Sweden faces a Commission infringement procedure and sets thresholds in SEK.
- Hungary runs a parallel domestic regime covering smaller entities than the EU criteria, with a Hungarian-language submission requirement.
- Romania sets thresholds below the CSRD for medium and large entities.
- Denmark and Finland extend scope to commercial foundations and cooperatives, with Finland adding a six-month publication deadline.
- Poland and Slovakia adopted transitional wave 1 relief ahead of Omnibus I.
- Austria and Belgium have their own statutory limits on value chain data requests.
With the March 19, 2027 transposition deadline still ahead, confirm your obligation against the transposing law where you actually file, not against the directive alone.
What Happens if You Miss the CSRD Deadline?
Enforcement sits with member states, which set their own penalties when they transpose. Expected consequences include fines scaled to company size, regulatory scrutiny of the annual report, and the reputational effect of filing an incomplete management report.
ESMA's enforcement priorities give a clearer signal of what supervisors will actually look at. For sustainability disclosure they are materiality considerations under ESRS, meaning disclosure of thresholds, input parameters, stakeholder engagement, and the link from impacts and risks to strategy, and the scope and structure of the sustainability statement, meaning alignment with the consolidated financial statements' scope, transparency about value chain limitations, and connectivity with the financial statements.
Both priorities were carried over from the prior year. If you want to know where a first report is most likely to draw a question, that is the list.
How Gravity Helps You Meet Your CSRD Deadline
The CSRD remains the most demanding sustainability disclosure regime in force, even after simplification. There are several ways to meet it, whether that is managing it in house, hiring a consulting firm, or onboarding software.
Gravity offers the best of both worlds: world-class software and personalized support from Climate Experts. We'll work with you every step of the way, from double materiality assessments to data collection to final reports.
- Double materiality. Gravity's experts and software guide you through the assessment efficiently and determine which topical standards you need to report, so you can get on with the reporting.
- Data collection. Collecting scope 1, 2, and 3 data is the most time-consuming part of reporting. Gravity's bill scanning and utility APIs process thousands of documents in seconds. Supplier engagement and surveys collect value chain data in record time, scoped to what the value chain cap allows.
- Assurance readiness. Gravity's platform keeps data logs, attaches supporting evidence to every data point, and speeds up review by keeping everything in one place with view access for your assurance provider. We can also introduce you to trusted providers.
- Simplified reporting. Our platform formats your data for CSRD filing, and you can translate the same underlying data to any other disclosure you need to meet, including California's climate disclosures, CDP, and IFRS S2.
- World-class assistance. You'll be partnered with an expert Climate Strategist who will help you navigate the regulation as it applies to your company, compose answers to qualitative and quantitative questions, and offer final reviews and submission reports.
Talk to an expert about your CSRD timeline.