Resources · Regulation
The CSRD requires assured sustainability reporting. After Omnibus I the scope is two-stage: through financial year 2026 as before, and from 2027 only above 1,000 employees and EUR 450m turnover.
Last updated:
An EU directive on mandatory, externally assured sustainability reporting. It replaces the earlier NFRD and is part of the European Green Deal.
Large public-interest entities with more than 500 employees keep reporting as before. In Austria, only entities that also exceed both thresholds from 2027 report under the new rules; the others that were already obliged report under the previous law (§ 908(2a) and (2b) UGB).
Only companies with more than 1,000 employees and more than EUR 450m net turnover — both criteria at once. Listed SMEs are no longer obliged.
Reporting under the ESRS inside the management report, externally assured at the limited level. The digital tagging duty is currently suspended.
The Corporate Sustainability Reporting Directive is the EU directive that standardises sustainability reporting and makes it subject to assurance. It replaces the NFRD. Reporting follows the European Sustainability Reporting Standards, sits in the management report, and an auditor confirms the result.
Scope is two-stage. Which rule applies to you depends on the financial year — the most common misunderstanding on this topic, because many articles still carry the old figures.
The timetable changed twice. First, Directive (EU) 2025/794 ("stop the clock") delayed the second and third reporting waves by two years. Then Omnibus I ((EU) 2026/470, in force since Mar 18, 2026) cut the scope permanently. For its proposal of Feb 26, 2025, the Commission estimated that around 80% of companies would leave the scope. Member States transpose the changes into national law by Mar 19, 2027.
Reporting follows the ESRS across environmental, social and governance topics. The starting point is the double materiality assessment: you assess both your impacts on people and the environment and your financial risks and opportunities. The version that counts is the revised ESRS set in Delegated Regulation (EU) 2026/1563 for financial years from 2027. For financial years starting in 2026, entities that already report may choose the previous or the revised set, or apply the previous set with individual reliefs from the new one (Article 2). Immaterial datapoints must not be disclosed, except as clearly marked supplementary information (ESRS 1 section 8.2) — that is new, and it keeps reports leaner.
The report is externally assured, at the limited assurance level. The originally planned move to reasonable assurance was dropped by Omnibus I. The feasibility assessment the Commission was to carry out for it was dropped as well. The Commission now only has to adopt limited assurance standards by Jul 1, 2027. Anyone reading that full assurance is "coming eventually" is reading an outdated position.
The CSRD envisaged marking up sustainability information so it is machine-readable. Omnibus I amended Article 29d: the mark-up duty rests until the ESEF regulation (EU) 2019/815 is updated. There is currently no application date. The scope also matters: the duty never applied only to listed companies, but to every reporting company.
A structured preparation starts early and works from data rather than from spreadsheets that grew over time.
That depends on the financial year. Through financial year 2026, large public-interest entities with more than 500 employees report. From financial year 2027, only companies with more than 1,000 employees and more than EUR 450m turnover are covered, and both criteria must be met at once. In Austria, only entities above both thresholds from 2027 report under the new rules through financial year 2026 (§ 908(2a) UGB).
Not for CSRD scope. Balance sheet, turnover and headcount in the two-of-three logic still define what a "large undertaking" is under the Accounting Directive. The CSRD threshold from financial year 2027 is independent of that and requires both criteria at the same time.
The CSRD is the directive and governs the "whether" and "who". The ESRS are the standards and govern the "what" and "how".
No. Listed SMEs were originally planned as the third wave but fell out of scope entirely with Omnibus I. Smaller companies can report voluntarily under the Voluntary Standard (Delegated Regulation (EU) 2026/1560). Independently of that, a binding cap applies from financial year 2027: when a CSRD-reporting customer requests data for its CSRD reporting, it may ask companies with up to 1,000 employees only for the datapoints in Annex II of that regulation. These companies may also refuse further requests made for CSRD purposes; Member States transpose this right by Mar 19, 2027. Requests based on other obligations are not affected.
Yes, externally and at the limited assurance level. The planned move to reasonable assurance was dropped, and no assessment of that move is foreseen any more. The Commission adopts limited assurance standards by Jul 1, 2027.
Not at present. Omnibus I suspended the mark-up duty in Article 29d until the ESEF regulation (EU) 2019/815 is updated, and no application date exists. EFRAG put a draft taxonomy out for consultation in September 2026. Building machine-readable data structures is sensible, but there is no deadline for it.
In the company's management report, as a dedicated sustainability statement. The Taxonomy disclosures under Article 8 of the Taxonomy Regulation belong in the same statement but are not subject to the ESRS.
The obligation ends, the data requests do not. Large customers, banks and investors often ask for ESG data regardless of who is legally obliged. A GHG inventory helps you answer, and if you import CBAM goods you need the emissions data for those goods anyway. The difference is that you can answer voluntarily and in a structured way instead of under pressure.
Book a demo
In a free demo we'll show you how NetCero guides you through ESRS, materiality and disclosure.
Book a demo