Search every question across sub-FAQs

Article 40a applies only when both the third-country undertaking test and an EU presence test are met. At group level, or individual level if group-level reporting does not apply, the third-country undertaking must have generated more than EUR 450 million net turnover in the Union in each of the last two consecutive financial years.

A qualifying EU subsidiary exceeded EUR 200 million net turnover in the preceding financial year. A branch qualifies at the same turnover level only if the third-country undertaking has no qualifying EU subsidiary. The reporting requirement starts with financial years beginning in 2028.

The Article 40a report is published through a qualifying EU subsidiary or, if there is no qualifying EU subsidiary, a qualifying EU branch. A subsidiary publishes a report covering the ultimate third-country parent at group level. A branch publishes a report covering the third-country undertaking at group level, or at individual level if group-level reporting is not applicable.

The EU subsidiary or branch must publish and make the report accessible, but Article 40a does not expressly assign preparation to that entity. The third-country parent may prepare the report, or the EU entity may prepare it on the parent's behalf. Commission guidance says at least one report must be disclosed by a subsidiary or branch in each Member State concerned; national law may allow one entity to comply by linking to a report published by another EU subsidiary or branch.

Article 40a does not let the EU subsidiary or branch stay silent because the third-country undertaking withholds information. The subsidiary or branch must request the information needed to meet its obligation.

If not all required information is provided, the EU subsidiary or branch must publish the report using the information it has, and issue a statement that the third-country undertaking did not make the necessary information available.

Yes. Member States must require the Article 40a sustainability report to be published with an assurance opinion from a person or firm authorised to give an opinion on sustainability reporting assurance under the law of the third-country undertaking or of a Member State.

If the third-country undertaking does not provide the assurance opinion, the EU subsidiary or branch must issue a statement that the necessary assurance opinion was not made available.

The Article 40a reporting route applies for financial years beginning in 2028. Article 40d requires the EU subsidiary or branch to publish the report, assurance opinion, and any applicable Article 40a(2) missing-information statement within 12 months after the balance-sheet date for the reported financial year.

Publication follows the process provided by the relevant Member State. If the documents are not freely available through the business register, they must be made available free of charge on the subsidiary's or branch's website in at least one official EU language by the same 12-month deadline. Confirm the applicable language, register, website, and filing mechanics under national law.

The core evidence traces each ESRS requirement to the reported disclosure: materiality assessment, selected disclosure requirements and datapoints, source systems, calculations, estimates, approvals, and final sustainability-statement text.

Limited assurance work still needs evidence that can be tested. Keep records for the process used to identify information included in the management report, value-chain information that was available or unavailable, references to financial-statement amounts, and any explanations for estimates, restatements, prior-period errors, or post-period updates.

CSRD sustainability reporting is placed in a clearly identifiable dedicated section of the management report. Evidence should match the version that management approves for issuance. Preserve working spreadsheets and draft narratives as supporting records, clearly separated from the published version.

If a subsidiary relies on a parent report exemption, the evidence should also retain the parent name, registered office, web links to the consolidated management report and assurance opinion, and the statement that the subsidiary is exempt from its own Article 19a reporting.

The assurance report must identify the entity, the sustainability reporting covered, the date and period covered, and the reporting framework applied. It must also describe the assurance scope, identify the assurance standards used, and include the assurance opinion required by the Accounting Directive as amended by CSRD.

Evidence should let the assurance provider verify the reporting framework, period, scope boundary, standard or national procedure used, and final disclosures covered by the opinion. The opinion covers compliance with ESRS, the process used to identify reported information, digital marking when the marking rules apply, and Article 8 Taxonomy reporting. Where more than one statutory auditor or audit firm is engaged, keep the joint report or separate opinions and reasons for disagreement.

CSRD says Member States must require statutory auditors and audit firms to use assurance standards adopted by the Commission. Until the Commission has adopted an assurance standard covering the same subject matter, Member States may apply national assurance standards, procedures, or requirements.

The evidence file should name the assurance basis actually used for the engagement. If the basis is national, retain the national standard, procedure, or requirement, the Member State communication or adoption reference where available, and the engagement instructions that show how the assurance provider applied it. ISSA 5000 is an international standard, but its publication or general effective date does not by itself make it the legal basis for a CSRD engagement in every Member State.

The current EU-level milestone is the Commission's delegated acts for limited assurance standards. Directive (EU) 2026/470 moves that deadline to 1 July 2027. Until applicable EU standards take effect, teams need to identify the national standards or procedures used for the engagement.

Directive (EU) 2026/470 also removes the former requirement to adopt reasonable assurance standards by 1 October 2028. The superseded date is no longer a future EU obligation.

Start from ESRS disclosure requirements and data points, then add company-specific reporting controls. EFRAG IG 3 describes a data point as a clearly separable and specific piece of information required by ESRS Disclosure Requirements, generally at paragraph, subparagraph, or sub-subparagraph level.

The inventory should therefore track the ESRS standard, Disclosure Requirement, paragraph reference, short data point description, data type, materiality status, phase-in or conditional status where applicable, owner, source system, evidence location, consolidation boundary, value-chain dependency, review status, and XBRL readiness.

Apply the correct materiality status to each ESRS row. EFRAG IG 3 distinguishes data points that are mandatory irrespective of materiality from data points that depend on the materiality assessment, and EFRAG IG 1 explains that materiality of information applies at the Disclosure Requirement or data point level.

A useful inventory has an explicit status for each row: always reported, reported because the related matter or information is material, omitted because the metric or information is not material, voluntary, conditional or not applicable, entity-specific, phased in, estimated, or unavailable with an explanation. The status should point back to the double materiality assessment, thresholds, and IRO conclusions.

Evidence ownership should follow the data, not the reporting calendar. A data point about workforce headcount, greenhouse gas emissions, supplier policies, remediation channels, or financial effects usually needs a different process owner, source system, control, and approval trail.

For each data point, assign one accountable evidence owner and name the contributors who supply inputs. The owner should be able to explain the method, source, calculation, estimate, approval, and change history for the reported value or narrative. If a data point depends on value-chain information, record the supplier, customer, investee, public source, proxy, or sector-data basis used. Under Directive (EU) 2026/470, undertakings with no more than 1,000 average employees may qualify as protected undertakings and decline CSRD-purpose requests that exceed the information in the voluntary standards.

EFRAG IG 3 can reduce rework by helping teams structure human-readable reports for later digitalisation. It cannot serve as the basis for machine-readable reporting because it is not the ESRS XBRL Taxonomy.

Add XBRL-readiness fields during preparation: expected XBRL element or tag family, data type, unit, period type, dimensions or breakdowns, table structure, narrative location, continuation risk, entity-specific extension need, validation status, and reviewer comments. For narrative disclosures, keep the text granular enough that a tag can be applied without spreading the same data point across unrelated sections. Directive (EU) 2026/470 states that undertakings are not required to mark up sustainability reporting until the relevant marking-up rules are adopted.

An assurance-ready CSRD data point inventory is traceable, versioned, and reviewable. It should show the reporting framework applied, the disclosure period, the ESRS requirement, the materiality conclusion, the evidence owner, the control performed, the evidence retained, and any unresolved limitation or estimate.

CSRD introduced assurance of sustainability reporting, and the assurance process needs a record that can be tested. Keep undocumented overrides, orphan calculations, unsupported narrative claims, and source records that cannot be tied to the final sustainability statement out of the reporting package.