After two years of proposals and postponements, the revised CSRD rules are now settled. The Omnibus narrowed who has to report, and the Simplified ESRS are now final.
Key takeaways
- The CSRD requires in-scope companies to publish a sustainability statement under the European Sustainability Reporting Standards (ESRS), with limited assurance.
- About 6,000 companies are in scope after the February 2026 Omnibus. EU companies must exceed both €450 million in net turnover and 1,000 employees.
- Wave 1 companies still in-scope continue reporting in 2027 on financial years starting on or after 1 January 2026. They may use the original or the simplified ESRS.
- All EU companies must use the simplified ESRS in their 2028 reports, on financial years starting on or after 1 January 2027. Non-EU groups report in 2029 using the ESRS 40a (a standard that is currently still being drafted)
- The Simplified ESRS contain 61% fewer data points than the original 2023 ESRS.
- Climate is the mandatory topic: if you assess ESRS E1 as non-material, you must give a detailed written justification.
What are the CSRD and the ESRS?
The CSRD is an EU law that requires large companies to report on their sustainability impacts, risks and opportunities with the same rigour as their financial results. It replaced the Non-Financial Reporting Directive (NFRD). The revised CSRD, finalised through the Omnibus in February 2026, replaces the original version.
Three pieces of EU law work together:
- The CSRD sets who must report and when.
- The ESRS sets what to disclose and how to structure it.
- The EU Taxonomy classifies how much of a company's revenue and spending is environmentally sustainable.
Who has to comply with the CSRD?
Check your scope in three steps:
- Is the entity incorporated in the EU? If it's part of a non-EU group, apply the non-EU test as well.
- Does it pass both tests? "Employees" means everyone employed by the EU entity, wherever they work. A company incorporated in Luxembourg with staff in Belgium and the Netherlands counts all of them.
- Is it a financial holding company? Financial holding companies are exempt. The thresholds apply to every other EU entity, including holding companies. Check with your legal or accounting team if you're unsure which type you have.
A subsidiary is a separate legal entity. A branch is an extension of the parent company with no separate legal entity. For example, a U.S. parent that books all its French revenue directly operates a French branch.
The revised CSRD no longer uses reporting "waves." You'll still hear "Wave 1" used for former NFRD reporters and "Wave 2" for other large EU companies. This guide refers to EU companies and non-EU groups instead.
What if your company is below the thresholds?
You have no CSRD reporting requirement. You can still report voluntarily. Companies with fewer than 10 employees can use the Voluntary SME standard (VSME). Larger companies below the thresholds can use the voluntary ESRS standard the Commission adopted in July 2026.
Your customers may still ask you for data. If you have fewer than 1,000 employees, you can refuse requests that go beyond what the VSME covers.
Former NFRD reporters that now fall below the thresholds should check their member state's transposition status before deciding to skip their 2027 report. Until national law exempts you, plan to report.
How do subsidiaries and groups report?
Groups with several in-scope EU entities can choose one of three approaches:
If your parent is outside the EU, your EU subsidiary can rely on the parent's group report only if that report is ESRS-compliant. A report under an equivalent standard would also qualify, but the Commission has not yet recognised any standard as equivalent. If neither applies, the EU subsidiary must report itself.
Watershed supports all 3 approaches to meet your unique CSRD compliance needs.
When do companies have to report?
What's changed since 2025
- April 2025: Stop-the-Clock postponed reporting for most companies by two years.
- February 2026: The Omnibus was accepted. It cut scope to about 6,000 companies, removed reasonable assurance and dropped sector-specific standards.
- July 2026: The Commission adopted the Simplified ESRS.
- September 2026: The Simplified ESRS are published in the Official Journal of the EU.
What to watch in 2027
- January: First official draft of ESRS 40a, the standard for non-EU groups (formerly the non-EU ESRS).
- 19 March: Deadline for member states to transpose the revised CSRD into national law.
- First half: The Commission is expected to adopt the XBRL taxonomy for digital tagging.
- By July: The Commission adopts a dedicated EU limited assurance standard.
- Mid-2027: ESRS 40a adopted. EFRAG is weighing options for ISSB interoperability, including an "ISSB+" approach that uses an ISSB report as the baseline and adds EU-specific requirements.
Member states can add their own requirements during transposition, such as translating reports into a local language. Check the rules wherever you file.
For a full breakdown of the new standards, download our What changed in the Simplified ESRS guide.
What must companies report?
The ESRS have three tiers:
- ESRS 1 (always mandatory): general requirements, including the double materiality framework.
- ESRS 2 (always mandatory): general disclosures on governance, strategy, impact and risk management, and metrics and targets.
Ten topical standards: required only where your double materiality assessment finds the topic material.
Double materiality means assessing each topic from two directions: how sustainability issues affect your financial performance (financial materiality), and how your business affects people and the environment (impact materiality). A topic is material if it meets either test. You can run the assessment top-down, bottom-up or as a hybrid of the two. Complete it before you start drafting.
E1 is the exception. You can omit any other topical standard based on your assessment. If you conclude E1 is not material, you must give a detailed written explanation. It's also where regulators look first: the European Securities and Markets Authority (ESMA) found that 40% of enforcement actions against Wave 1 companies related to E1 disclosures.
The revised rules include several reliefs:
- Value chain cap: suppliers with fewer than 1,000 employees can refuse data requests that go beyond the VSME.
- Undue cost or effort: you can omit data that would be too costly or difficult to collect. This doesn't apply to GHG emissions, which must still be complete.
- M&A: new acquisitions can join the report the following year, and divested entities can be excluded in the exit year.
- Confidentiality: commercially sensitive information can be omitted.
- Joint operations: those you don't operationally control are excluded from environmental metrics.
- Estimates: the original preference for actual data over estimates has been removed.
What should companies do in 2027?
With the Omnibus settled and the Simplified ESRS in law, companies can stop tracking proposals and start implementing. If your first report is due in 2028, start in late 2026 rather than waiting for the new year. What you do next depends on where you're starting from.
If you're reporting for the first time
You're building from scratch, so focus on foundations.
- Refresh your legal entity scoping. The new thresholds have moved companies in both directions. Check each entity against the current tests, confirm your first reporting year and choose your consolidation approach. This decides which entities report, which data you need and who signs off.
- Run a targeted double materiality assessment. Choose top-down, bottom-up or hybrid. The Simplified ESRS lets you rule a topic in or out at the topic level when the answer is clear, supported by a documented rationale from an internal expert. Concentrate on the impacts, risks and opportunities that matter most to your business model rather than assessing everything at the same depth.
- Map each material data point to an owner and a system. CSRD data sits across finance, operations, HR, procurement and regional teams. Work through the checklist below for every data point and record the gaps.
- Build data collection and quality controls. Give every data point a named owner, document your methods and estimates, and keep one source of truth. Start with GHG emissions: undue cost relief doesn't cover them, and scope 3 data takes time to collect.
- Get ready for assurance. Your assurer will need an evidence trail behind every reported number, version control and documented internal controls. Agree the approach with your provider before the engagement starts. Until the EU standard arrives in July 2027, no single standard applies. Design processes you can run every year, not just once: the aim is reporting that's credible, compliant and efficient.
- Do a dry run. A practice report under the Simplified ESRS will surface gaps while there's still time to fix them before your first reporting year.
Data readiness checklist
Connect the data to business value
You can run CSRD as a pure compliance exercise: send data requests across the business and push through the resistance. Or you can show each function how the metrics it reports protect the business, build resilience, cut costs or support growth. The second approach takes more effort up front, but data owners respond faster when they understand why the data matters, and leadership gets information it can actually use.
“There's a real opportunity to connect sustainability to business value. When you explain how a metric protects the business, builds resilience, saves costs or supports growth, people understand why they need to provide the data, and management can use it to run the business. It stops being a one-off annual exercise.”
Laura Saavedra, Director of Climate Change and Sustainability Services, EY
If you've already reported under the original ESRS
Your 2027 job is to learn from past cycles and migrate. The Simplified ESRS are mandatory from FY2027, so your 2028 report will use them whether or not you switch early for FY2026.
- Re-check your scope. Some former NFRD reporters now fall below the thresholds. See what to do if you're below the thresholds section above for details.
- Review last year's assurance findings. Close the gaps your assurer raised before they appear again.
- Find efficiency. Look for data you collected that the Simplified ESRS no longer require, and processes you can automate or merge.
- Refresh your double materiality assessment against the new standards.
- Retire data points that no longer exist. There are 61% fewer, mostly qualitative and voluntary disclosures.
- Plan for E4, S2, S3 and S4. If they're material, they return in your 2028 report when the Quick Fix relief ends.
Many companies will report under the original ESRS one last time in 2027 while running the migration in parallel. The What changed in the Simplified ESRS guide walks through every standard.
If you're a non-EU group
ESRS 40a will set your reporting requirements, but it won't be adopted until mid-2027, and it applies from FY2028. That leaves little time between final rules and your first reporting year, so start now:
- Confirm your scope. Check both tests: more than €450 million in EU net turnover in each of the last two years, and an EU subsidiary or branch with more than €200 million in net turnover.
- Run a light-touch double materiality assessment to identify the topics and KPIs you're most likely to report.
- Assess your data. An early read on availability and quality shows where the biggest gaps are.
Watch for three open questions as the standard is finalised:
- Whether ESRS 40a covers impacts only, or impacts, risks and opportunities.
- Whether reporting happens at group level or EU subsidiary level.
- Where the reporting boundaries fall.
If your member state hasn't transposed yet
Member states have until 19 March 2027 to transpose the revised CSRD into national law, and some will miss the deadline. That isn't a reason to pause. The revised directive is already EU law, and the work it requires (scoping, materiality, data ownership, controls) takes months whatever your national timeline.
Implement against the EU-level requirements, then track each member state where you have in-scope entities and keep a log of any differences. The main risk is a member state adding its own requirements, such as extra assurance rules.
“Delays in transposition don't mean companies should wait. Implement based on what you know at EU level, but track each member state's status and keep a log of exceptions.”
Laura Saavedra, Director of Climate Change and Sustainability Services, EY
For help structuring your team, learn more from our How to build your CSRD team post. If you're comparing platforms, see our guide to the best CSRD software.
Watershed helps companies collect audit-ready CSRD data and produce their sustainability statement in one place. See how Watershed's CSRD solution works.
How do you file and assure your report?
Assurance. All in-scope companies need limited assurance from their first reporting year. The Omnibus removed the planned move to reasonable assurance. The Commission will adopt a dedicated EU limited assurance standard by July 2027.
Filing. There's no single EU portal. You file your sustainability statement wherever you file your financial statements, and deadlines follow your member state's financial reporting deadlines. Some member states require a translation into the local language. Ropes & Gray's CSRD transposition tracker keeps track of national requirements.
Digital tagging. Reports will eventually need to be tagged in iXBRL. This becomes mandatory once the Commission adopts the XBRL taxonomy, expected in the first half of 2027.
What happens if you don't comply?
Member states enforce the CSRD, so penalties are set nationally. Monetary fines are the most common. Depending on your jurisdiction, you could also face:
- Restrictions on bidding for government tenders
- Trading freezes or delisting procedures (for listed companies)
- Personal liability for directors
Regulators are already acting on Wave 1 reports, starting with climate disclosures. Investors, lenders and customers also ask for the same data, so a weak report creates commercial risk as well as legal risk.
How does the CSRD relate to other regulations?
EU Taxonomy. Non-financial EU companies reporting under the full ESRS must disclose the share of their turnover, capex and opex that is Taxonomy-aligned. These KPIs sit inside the environmental section of the sustainability statement.
CSDDD. The Corporate Sustainability Due Diligence Directive is a separate law. It requires companies to identify and address human rights and environmental impacts across their operations and value chains. It applies to companies with more than €1.5 billion in net turnover and more than 5,000 employees, starting in 2029 on FY2028 data. After the Omnibus, it no longer requires a climate transition plan.
ISSB. ESRS E1 and IFRS S2 overlap significantly but aren't identical. If you report under both, map the differences early.
Build a common core. If you report under several frameworks, start with the disclosures they share instead of treating each one separately.
Get the common core right first. You can deprioritise the rare topics unless they're material to your business or a regulator or stakeholder specifically asks for them.
Track upcoming deadlines across jurisdictions with our climate policy calendar.
