The Corporate Sustainability Reporting Directive (CSRD) is the biggest overhaul of sustainability reporting in European history. Its scope and timetable have also changed twice since it was adopted, so many companies are unsure what's required of them, and when. This guide covers what you need to know.
Updated 7 Oct 2026: the scope, dates and assurance rules below reflect the Omnibus I Directive and the revised ESRS adopted on 3 July 2026.
What is CSRD?
The CSRD is a European Union directive that requires detailed sustainability reporting from companies operating in the EU. It replaced the earlier Non-Financial Reporting Directive (NFRD) and greatly expanded the depth of disclosure required.
At its core, the CSRD requires companies to report on environmental, social and governance (ESG) matters using the European Sustainability Reporting Standards (ESRS). The report sits in the company's management report and is subject to independent assurance, which brings sustainability disclosures closer to the rigour expected of financial reporting.
CSRD is not just a reporting exercise. It's a fundamental shift in how companies measure, manage and communicate their impact on people and planet.
Who needs to comply?
The CSRD was designed to apply in waves, starting with large public-interest companies that reported on 2024 in 2025. That timetable has since changed twice:
- April 2025, “stop the clock”: Directive (EU) 2025/794 postponed reporting for the second and third waves by two years.
- February 2026, Omnibus I: Directive (EU) 2026/470 narrowed the scope. It entered into force on 18 March 2026, and EU countries have until 19 March 2027 to write it into national law.
After those changes, this is who reports:
- EU companies with more than 1,000 employees and more than €450 million net turnover: those not already reporting publish their first report in 2028, covering financial years starting on or after 1 January 2027.
- Companies already reporting (the first wave): they started with 2024. EU countries may exempt those that now fall below the new thresholds.
- Listed SMEs: no longer in scope. The Commission adopted a separate voluntary standard on 3 July 2026 for smaller companies that want to report.
- Non-EU groups, including UK groups: in scope if they generate more than €450 million net turnover in the EU and have an EU subsidiary or branch with more than €200 million. Their first report is due in 2029, covering 2028. An EU subsidiary that passes the thresholds itself reports in its own right.
If you're below the thresholds, larger customers and lenders may still ask for your figures, although the Omnibus limits what in-scope companies can demand from value-chain partners with fewer than 1,000 employees. Having your own figures ready is still a strategic advantage. (Sources: Directive (EU) 2026/470; Arthur Cox summary.)
Understanding the ESRS standards
The European Sustainability Reporting Standards are the backbone of CSRD reporting. The first set, adopted in July 2023, contains 12 standards in three groups:
Cross-cutting standards
- ESRS 1 (General requirements): sets out the architecture and principles of sustainability reporting, including double materiality.
- ESRS 2 (General disclosures): core disclosures that apply to every company, whatever its materiality assessment finds.
Environmental standards
- ESRS E1 (Climate change): greenhouse gas emissions across Scope 1, 2 and 3 (Scope 3 being the emissions in your supply chain), plus transition plans and climate targets.
- ESRS E2 (Pollution): air, water and soil pollution.
- ESRS E3 (Water and marine resources): water consumption and impacts on marine ecosystems.
- ESRS E4 (Biodiversity and ecosystems): impacts and dependencies on biodiversity.
- ESRS E5 (Resource use and circular economy): material flows and waste.
Social and governance standards
- ESRS S1 to S4: own workforce, workers in the value chain, affected communities, and consumers and end-users.
- ESRS G1 (Business conduct): corporate culture, anti-corruption and lobbying.
On 3 July 2026 the Commission adopted a revised, simpler set of ESRS. It cuts the number of mandatory datapoints by more than 60% and keeps double materiality and the overall structure (European Commission, 3 July 2026). Once the Parliament and Council's scrutiny period ends, companies use it from financial year 2027, with the option to start earlier (EY summary).
For most organisations focused on carbon accounting, ESRS E1 (Climate change) is the standard that needs detailed emissions data. The cross-cutting requirements of ESRS 1 and ESRS 2 still apply to every reporting company.
Key deadlines
If you're newly in scope and your financial year follows the calendar year, your first report covers 2027 and is published in 2028. Working back from that:
- 2026: check whether you pass both thresholds, then complete your double materiality assessment and identify which ESRS topics are material to you.
- By the end of 2026: set up data collection for 2027, your first reporting year. Make sure your Scope 1, 2 and 3 data is complete and traceable to its source.
- During 2027: collect the data, and run a dry run on your 2026 figures to find the gaps.
- Early 2028: draft your sustainability statement to the revised ESRS and bring in your assurance provider for a limited assurance review.
- 2028: publish your sustainability statement as part of your management report.
The exact deadlines depend on how your EU country writes the directive into national law.
Double materiality: the foundation
One of the most distinctive features of CSRD is double materiality. Traditional financial materiality asks “which ESG issues affect the company's value?”. Double materiality also asks the reverse: “what impact does the company have on the environment and society?”
A robust double materiality assessment usually involves:
- Mapping your value chain to identify potential impacts and dependencies.
- Engaging stakeholders, including employees, suppliers, customers and communities.
- Assessing both the financial risks and opportunities of sustainability topics and the company's actual impacts on people and planet.
- Documenting your method and conclusions so they can be assured.
The outcome decides which ESRS topics need full disclosure. ESRS 2 (General disclosures) always applies, but the topical standards (E1 to G1) only need reporting on matters the assessment finds material.
How to prepare: a practical roadmap
CSRD compliance can't be achieved overnight. Here's a practical framework for getting your organisation ready:
1. Assemble your team
CSRD compliance needs sustainability, finance, legal, operations and IT to work together. Appoint a project lead and set up a cross-functional steering group with clear accountability.
2. Conduct a gap analysis
Map what you report today against the ESRS requirements. Identify where you already have data, where the gaps are, and where processes need to be created or strengthened.
3. Invest in data infrastructure
Assurance needs every figure to be traceable to its source. Spreadsheets passed between teams make that hard. Whatever system you use, it should keep the evidence with each figure, record who changed what, and keep approved figures fixed.
4. Tackle Scope 3 early
Scope 3 emissions are usually the largest and most complex part of a company's carbon footprint. Start supplier engagement and data collection now, because building those supplier relationships takes time.
5. Engage assurance early
Don't wait until your report is finished to talk to your assurance provider. Early dialogue surfaces problems while there's still time to fix them. CSRD assurance is limited assurance: the Omnibus I changes dropped the planned move to reasonable assurance.
The organisations that treat CSRD as a strategic opportunity rather than a compliance burden will be the ones that gain an advantage from the process.
How Zoru can help
Zoru doesn't produce CSRD reports. It gives you the climate data that sits underneath ESRS E1, and a readiness checklist that shows what you still need for the climate standard.
- Scope 1, 2 and 3, measured: priced with official UK government (DESNZ) factors, matched to your reporting year wherever DESNZ publishes them year by year, plus one UK spend database, with all 15 Scope 3 categories listed so you can give each one a figure or a reason.
- Built for assurance: every entry starts as a draft that counts in your totals, marked not yet reviewed, until someone approves it, and the year can't be closed until every draft is reviewed. Report versions are numbered and approved by a named admin, changes have a tamper-evident history, and you can give a verifier access for a set period.
- Reports from one data set: a SECR disclosure, ISO 14064-1 report, GRI content index and Carbon Reduction Plan to PPN 006 from the same GHG Protocol data, with readiness checklists for CSRD (ESRS E1) and CDP.
Whether you're in scope now or preparing for what's next, strong data foundations will pay off for years to come.