Many companies built a CSRD roadmap between 2023 and 2025, based on a text that has been amended twice since. Most of what is still published online describes a regime that no longer exists: a two-out-of-three criteria test, successive reporting waves, and the prospect of reasonable assurance. All three have been removed from the law.

This article sets out the CSRD directive as it stands today: what it is, where it came from, what it requires, who it now covers under Directive (EU) 2026/470, on what timeline, and how it interacts with national non-financial reporting, the EU taxonomy and the due diligence regime.

Dates, thresholds and legal references were verified on 3 September 2026 against the primary text of Directive (EU) 2026/470 (Publications Office of the European Union, CELEX 32026L0470) and the European Commission's own pages.

Contents

  • What is the CSRD directive?
  • From the NFRD to the Omnibus: how the text evolved
  • What the CSRD directive actually requires
  • Who the CSRD directive applies to today
  • The application timeline
  • CSRD versus the old non-financial statement
  • CSRD and the EU taxonomy
  • Assurance and penalties
  • How it connects to the CS3D
  • How to prepare
  • How Kabaun supports CSRD compliance
  • FAQ

What is the CSRD directive?

The CSRD, or Corporate Sustainability Reporting Directive, is Directive (EU) 2022/2464 of 14 December 2022. It requires the companies it covers to publish an annual sustainability report inside their management report, setting out environmental, social and governance performance in a standardised format that a third party has verified.

Three features set it apart from what came before:

  • The content is standardised by the ESRS, adopted through Commission Delegated Regulation (EU) 2023/2772 of 31 July 2023, rather than left to a free format.
  • The report is verified by a statutory auditor or an accredited independent assurance services provider.
  • The analysis runs in two directions: the company's impact on its environment, and the effect of sustainability matters on its own financial position.

The directive belongs to the European Green Deal and its 2050 climate neutrality objective. It never applies directly: each member state has to transpose it into national law, which is why penalty regimes differ from one country to the next.

From the NFRD to the Omnibus: how the text evolved

The CSRD has been amended twice since it was adopted, and that is the main source of confusion around it.

2014, the NFRD. The Non-Financial Reporting Directive required large public interest entities to publish a non-financial statement. The format was free, verification was largely absent, and reports were hard to compare across companies.

2022, the CSRD. Directive (EU) 2022/2464 replaced the NFRD, standardised content through the ESRS, made verification mandatory and introduced double materiality. It phased companies in by waves, the first covering financial year 2024 for large public interest entities already under the NFRD.

April 2025, Stop the Clock. Directive (EU) 2025/794 of 14 April 2025, published in the Official Journal of the European Union on 16 April 2025, pushed the later waves back by two years. That text only touched the timetable. It remains a milestone in the file's history, but it no longer describes the applicable regime.

February 2026, substantive simplification. Directive (EU) 2026/470 changed the CSRD on substance. The European Parliament settled its position on 16 December 2025, the final act was signed on 24 February 2026 and published in the Official Journal of the European Union on 26 February 2026, entering into force on 18 March 2026. It amends four texts at once: statutory audit (2006/43/EC), the Accounting Directive (2013/34/EU), the CSRD itself (2022/2464) and the due diligence directive (2024/1760).

Any description of the CSRD built on waves, on a 250 employee threshold or on a balance sheet criterion is therefore out of date.

What the CSRD directive actually requires

A report structured by the ESRS

A company in scope publishes a sustainability report within its management report, built on the European Sustainability Reporting Standards. These twelve standards cover general requirements and general disclosures (ESRS 1 and 2), five environmental topics (E1 climate change, E2 pollution, E3 water, E4 biodiversity, E5 circular economy), four social topics (S1 own workforce, S2 value chain workers, S3 affected communities, S4 consumers) and one governance topic (G1).

ESRS 1 and ESRS 2 apply unconditionally. The others apply only where the topic is assessed as material. ESRS E1 is what drives the carbon workload: scope 1, 2 and 3 emissions under the GHG Protocol, a reduction pathway and a transition plan.

The Commission adopted a delegated regulation on 3 July 2026 simplifying these standards, amending Regulation (EU) 2023/2772. Its own page states that the act does not enter into force until it is published in the Official Journal, which had not happened at the time of writing. Sector-specific standards, meanwhile, will not be produced: the Commission's mandate to adopt them has been withdrawn.

Double materiality

This is the principle that decides which standards actually apply. A topic is material if it qualifies under at least one of two lenses:

  • Impact materiality: the effect of the company's activity on climate, biodiversity and working conditions across its supply chain.
  • Financial materiality: the effect of sustainability matters on the company's financial position, cash flows and asset values.

The assessment has to be documented, approved at the right governance level and reviewed annually. Without a materiality assessment, there is no way to know which standards apply, and therefore which data to collect.

A cap on what suppliers can be asked for

Directive (EU) 2026/470 sets a value chain cap: the reporting standards cannot require a company in scope to obtain, from a value chain company with no more than 1,000 employees on average, information going beyond the voluntary standards provided for in the new Article 29ca of Directive 2013/34/EU. A company protected by that cap has the right to refuse to disclose more. On 3 July 2026 the Commission adopted a delegated regulation establishing that voluntary standard for undertakings protected by the value chain cap. Like the ESRS simplification act, it only enters into force on publication in the Official Journal.

The practical consequence is that ESG reporting clauses in framework supplier contracts signed before 2026 need to be reviewed against this cap.

Who the CSRD directive applies to today

Since Directive (EU) 2026/470, an EU company, standalone or on a consolidated basis, is in scope only if it exceeds two thresholds at the same time:

  • more than 1,000 employees on average over the financial year,
  • and more than 450 million euros in net turnover.

Both conditions have to be met together. This is no longer a two-out-of-three test: the balance sheet criterion has been removed entirely. Exceeding only one of the two thresholds takes a company out of the legal scope.

Two further changes complete the picture:

  • Listed SMEs on an EU regulated market are permanently excluded from the CSRD scope, whatever their headcount or turnover. There is no longer a wave dedicated to them.
  • Third country undertakings are only covered above 450 million euros of net group turnover generated in the Union in each of the last two consecutive financial years, with an EU subsidiary or branch whose own net turnover exceeds 200 million euros in the preceding financial year. The third country turnover threshold was raised from 150 to 450 million euros.

A subsidiary can also be exempted from its own individual report where its parent is in scope and publishes a consolidated report covering it.

Our companion article on the new CSRD thresholds works this test through concrete cases: a mid-sized company with 1,200 employees and 300 million euros in turnover, a group with 800 employees and 900 million euros, and the French subsidiary of a foreign group.

The application timeline

  • 1 January 2024: large public interest entities already under the NFRD enter the regime, with first reports published in 2025 for financial year 2024. No postponement applied to them, but Directive (EU) 2026/470 now limits that first regime to financial years starting between 1 January 2024 and 31 December 2026.
  • 18 March 2026: Directive (EU) 2026/470 enters into force.
  • 3 July 2026: adoption of the two delegated regulations, ESRS simplification and the voluntary standard, both awaiting publication in the Official Journal.
  • 19 March 2027: deadline for member states to transpose the CSRD provisions.
  • 1 July 2027: deadline for the Commission to adopt the final limited assurance standard.
  • Financial years starting on or after 1 January 2027: the new cumulative thresholds apply.
  • 2028: first sustainability reports published under the new scope, covering financial year 2027.
  • 26 July 2028: deadline for transposing the due diligence provisions.

The directive also allows member states to grant a transitional exemption, for financial years starting between 1 January 2025 and 31 December 2026, to companies that no longer meet the new thresholds.

CSRD versus the old non-financial statement

The non-financial statement regime derived from the NFRD is what the CSRD replaces for the companies it covers. Five practical differences:

  • Format: free and embedded in the management report before, standardised by the ESRS under the CSRD.
  • Verification: optional in most cases before, mandatory under the CSRD.
  • Double materiality: absent before, structural under the CSRD.
  • Scope 3: not required before, required under ESRS E1 wherever climate is material.
  • Scope of application: the thresholds do not line up. Leaving the CSRD scope does not settle a company's position under national law.

Leaving the CSRD scope does not remove the expectations of large corporate customers, banks and investors either. On what a sustainability report covers from the company's side, see our article on the CSR report.

CSRD and the EU taxonomy

The EU taxonomy, established by Regulation (EU) 2020/852, classifies economic activities according to their contribution to six environmental objectives. The link to the CSRD is direct: a company in scope discloses the share of its turnover, capital expenditure and operating expenditure aligned with the taxonomy. The recurring pitfall is the confusion between two distinct notions:

  • An activity is eligible when it is among those covered by the taxonomy.
  • An activity is aligned when it additionally meets the technical screening criteria for substantial contribution, the do no significant harm principle and the minimum social safeguards.

A high eligibility share alongside a low alignment share is entirely normal, and the two figures do not say the same thing.

Assurance and penalties

The report has to be verified by an authorised statutory auditor or an accredited independent assurance services provider. Directive (EU) 2026/470 changed two things here.

First, the requirement is settled at limited assurance: the Commission's mandate to eventually adopt reasonable assurance standards has been withdrawn from the text. That prospect, often presented as an end-of-decade deadline, no longer exists.

Second, the final methodological standard for limited assurance is due to be adopted by 1 July 2027 at the latest, a deferred deadline. Companies in scope will therefore start financial year 2027 before the verification framework is settled, which is a good reason to involve the auditor early.

On penalties, the directive sets no monetary amount. National transpositions do, and they differ from one member state to another. In France, the applicable regime stems from Ordinance no. 2023-1142 of 6 December 2023 and Decree no. 2023-1394 of 30 December 2023, which transposed the original CSRD. The detail of the penalties should be checked against those texts with legal counsel: no figure is quoted here, and as of 3 September 2026, no French national measure transposing Directive (EU) 2026/470 had been notified to the European Commission. The transposition deadline remains 19 March 2027 for the CSRD provisions.

How it connects to the CS3D

The CS3D, Directive (EU) 2024/1760 on corporate sustainability due diligence, is a separate text that Directive (EU) 2026/470 also amends. The two are often confused, but the distinction is simple:

  • The CSRD is about publishing standardised, verified sustainability information.
  • The CS3D is about acting: identifying, preventing and remediating human rights and environmental harms across the chain of activities.

They feed each other. A value chain mapping carried out for due diligence purposes supports ESRS S2 reporting and the scope 3 side of ESRS E1. Their transposition deadlines differ: 19 March 2027 for the CSRD, 26 July 2028 for due diligence.

How to prepare

  • Rerun the scope test using actual figures for the financial year, on a consolidated basis, and document the analysis. This is the first priority for any roadmap built before March 2026.
  • Run or refresh the double materiality assessment, which sets the real perimeter of the report and the data collection workload.
  • Structure carbon data collection across scopes 1, 2 and 3, with source-level traceability that will hold up in front of an auditor. This is the longest item to put in place.
  • Review ESG clauses in supplier contracts to bring them into line with the value chain cap.
  • Involve the auditor early, without waiting for the limited assurance standard.

How Kabaun supports CSRD compliance

Kabaun is a carbon management platform for groups and mid-sized companies. On the ground covered by ESRS E1, it works on four fronts:

  • Multi-entity and multi-site consolidation: several legal entities and sites in a single account, consolidated at group level, which is what makes the scope test as documentable as the report itself. Covered in detail in our article on carbon accounting for multi-entity corporate groups.
  • Scope 1, 2 and 3 coverage under the GHG Protocol, including the 15 standard scope 3 categories, across 270,000 emission factors from 8 public databases including the ADEME Base Carbone.
  • CSRD and ESRS E1 reports generated from collected data, with an assessment of activity alignment against the EU taxonomy.
  • Audit trail and documentary evidence: every data point is tied to a traceable source and its supporting documents, with timestamping. That is what makes a file defensible under limited assurance.

A regulatory watch module tracks CSRD, ESRS and taxonomy developments.

FAQ

What is the CSRD directive in one sentence?

It is Directive (EU) 2022/2464, as amended by Directive (EU) 2026/470, requiring the largest European companies to publish an annual sustainability report standardised under the ESRS and verified by an independent third party.

Is my company with 800 employees covered by the CSRD?

No, at that headcount. Being in scope means exceeding 1,000 employees and 450 million euros in net turnover at the same time. Meeting only one of the two thresholds is not enough.

Does the wave 2 and wave 3 timetable still apply?

No. That structure came from the 2022 text and its postponement under Stop the Clock. Directive (EU) 2026/470 replaced it with a two cumulative threshold test, applying to financial years starting on or after 1 January 2027, for first reports in 2028.

Do listed SMEs have to publish a CSRD report?

No. Directive (EU) 2026/470 permanently excludes them from the scope, whatever their turnover or headcount.

Will the report eventually need reasonable assurance?

No, as the law stands. Directive (EU) 2026/470 withdrew the Commission's mandate to adopt such standards. Only limited assurance is provided for, with a final standard expected by 1 July 2027 at the latest.

Does the CSRD require scope 3 calculation?

Yes wherever climate change comes out as material in the double materiality assessment, which is the case for the large majority of companies. ESRS E1 then requires all three scopes under the GHG Protocol.

What is the difference between the CSRD and the CS3D?

The CSRD governs the publication of sustainability information. The CS3D, Directive (EU) 2024/1760, governs the duty to act to prevent human rights and environmental harm across the chain of activities. Both were amended by Directive (EU) 2026/470 and carry different transposition deadlines.

What should a company that has left the CSRD scope do?

Document its scope analysis, then decide what to keep: requests from large corporate customers and banks do not go away. The voluntary standard adopted on 3 July 2026 for undertakings protected by the value chain cap is the benchmark to follow once published in the Official Journal.

Official sources

  • Directive (EU) 2022/2464 of 14 December 2022, the original CSRD
  • Directive (EU) 2025/794 of 14 April 2025, published in the Official Journal on 16 April 2025, timetable postponement
  • Directive (EU) 2026/470 of 24 February 2026, scope and assurance simplification
  • Commission Delegated Regulation (EU) 2023/2772 of 31 July 2023, the ESRS
  • Regulation (EU) 2020/852, the EU taxonomy
  • European Commission, CSRD delegated acts page
  • European Parliament, procedure 2025/0045(COD)

Conclusion

The CSRD has not been repealed, it has been narrowed: a two cumulative threshold test, permanent exclusion of listed SMEs, limited assurance with no prospect of reasonable assurance, and application to financial years starting on or after 1 January 2027 for first reports in 2028.

The first thing to do is not to resume an existing compliance plan but to rerun the scope test with actual figures for the current financial year, on a consolidated basis, and keep a written record of it.

Kabaun supports the collection and consolidation of multi-entity carbon data: kabaun.com/contact