CSRD and ESRS Requirements

Start with legal scope, not with a disclosure template. The original CSRD covered Accounting Directive categories including large undertakings, large-group parents, and listed SMEs other than micro-undertakings. From financial years beginning in 2027, Directive (EU) 2026/470 applies the main Articles 19a and 29a route where the undertaking or parent group exceeds both EUR 450 million net turnover and 1,000 average employees. For financial years beginning in 2025 or 2026, check whether the Member State used the optional exemption for an undertaking below either new threshold. Check issuer and sector provisions and national transposition separately.

Third-country groups need a separate screen. For financial years beginning in 2028, Directive (EU) 2026/470 sets a more-than-EUR-450-million Union net-turnover threshold for the third-country undertaking and a more-than-EUR-200-million threshold for the qualifying EU subsidiary or branch. Do not treat a non-EU parent, EU subsidiary, listed issuer, branch, or group exemption as the same fact pattern.

For an individual undertaking, Article 19a requires sustainability information in a clearly identifiable dedicated section of the management report. The statement must explain both the undertaking's impacts on sustainability matters and how sustainability matters affect its development, performance, and position. For a parent undertaking of a large group, Article 29a applies the same logic to the consolidated management report.

The core content areas are business model and strategy, sustainability-related opportunities and resilience, transition plans where relevant, stakeholder interests, time-bound targets, governance roles and expertise, policies, incentive schemes, due diligence, principal actual or potential adverse impacts, actions taken, principal risks and dependencies, and indicators. The adopted ESRS then specifies the structure and disclosure requirements. Record the legal version used: the Commission adopted revised ESRS on 3 July 2026, but its official acts page says the delegated act is not in force until it is published in the Official Journal.

CSRD reporting uses double materiality. The undertaking reports material impacts on people and the environment, and material risks and opportunities arising from sustainability matters that affect the undertaking. EFRAG IG 1 describes the materiality assessment as the process for determining material impacts, risks, and opportunities (IROs), and says it should use objective criteria, supportable evidence, and the undertaking's facts and circumstances.

A defensible assessment should not end at a heatmap. It should show the sustainability matters considered, the actual and potential impacts, risks, and opportunities identified, the thresholds used, the stakeholder inputs considered, whether the issue is material from impact materiality, financial materiality, or both, and the resulting ESRS disclosure requirements covered by the statement.

CSRD and ESRS extend beyond the reporting entity's own operations where material impacts, risks, or opportunities arise in the upstream or downstream value chain. Article 19a and Article 29a require own-operations and value-chain information where applicable, including products and services, business relationships, and supply chain.

EFRAG IG 2 makes the practical limit clear: value-chain information is not required in every disclosure. It is required when connected to material IROs beyond own operations and when the disclosure requirement calls for it. If primary value-chain information is unavailable after reasonable efforts, ESRS allows estimation using reasonable and supportable information such as proxies, sector data, and indirect sources, with disclosure of the basis for preparation, accuracy, and improvement actions where metrics use estimated value-chain data.

CSRD reporting must be built for assurance. The Directive requires an assurance opinion on sustainability reporting and sets expectations for the assurance report, including identification of the reporting entity, period, reporting framework, assurance scope, standards used, and opinion. The materiality assessment, value-chain estimates, data lineage, and review controls therefore need to be ready before the statement is finalized.

Publication and digital reporting are also part of the requirement set. CSRD links sustainability reporting to the management report and annual financial report framework. Directive (EU) 2026/470 states that undertakings are not required to mark up sustainability reporting until the marking rules are adopted through Delegated Regulation (EU) 2019/815. Until then, taxonomy mapping and validation are readiness work, not a completed statutory sustainability-tagging filing.

A useful CSRD control environment connects legal scope, materiality, data, drafting, assurance, publication, and tagging. The control objective is simple: a reviewer should be able to trace every material statement from requirement to IRO conclusion, source data, calculation or estimate, approval, assurance evidence, and final published disclosure.

The minimum control set should cover scope changes, materiality methodology, value-chain data limitations, ESRS datapoint ownership, narrative consistency, financial-statement connectivity, assurance requests, publication approval, and digital tagging review. Record the legal basis for each omission, such as non-material information, a permitted sensitive-information exception, or an applicable phase-in. Track unavailable required value-chain data as an evidence gap and apply the relevant estimation and disclosure rules; unavailability alone does not permit omission.