CSRD compliance and reporting overview: understanding the Corporate Sustainability Reporting Directive and its timeline
Comprehensive overview of the European Union’s Corporate Sustainability Reporting Directive (CSRD), including scope, phased implementation timeline, reporting standards, obligations and a roadmap for compliance.
The European Union’s Corporate Sustainability Reporting Directive (CSRD) is a sweeping overhaul of sustainability disclosure rules. It aims to give investors, consumers and civil‑society groups a clearer picture of how companies manage environmental, social and governance (ESG) issues and how their activities affect people and the planet. By replacing the Non‑Financial Reporting Directive (NFRD) and aligning with the European Green Deal, the CSRD responds to criticism that earlier rules reached too few companies and led to inconsistent, hard‑to‑compare disclosures【929106229731488†L190-L220】. The directive requires companies to use the European Sustainability Reporting Standards (ESRS) and to publish sustainability data in digital (XHTML) form【929106229731488†L190-L211】. It is expected to transform corporate reporting across Europe and to influence global practices.
Scope and applicability
The CSRD dramatically expands the number of companies subject to mandatory sustainability reporting. Under the directive, large EU companies—including publicly traded firms and subsidiaries of foreign groups—must report when they exceed at least two of three thresholds: more than 250 employees, turnover above €40 million or total assets over €20 million【929106229731488†L190-L220】. About 50 000 companies within the EU are expected to be covered【178299226143617†L173-L179】. The directive also extends to non‑EU companies if they are listed on EU regulated markets or have significant EU operations—such as generating more than €150 million in EU revenue with an EU branch exceeding €40 million in turnover or having an EU subsidiary that meets the large‑company criteria【178299226143617†L213-L229】【953496984695551†L46-L59】. Research cited by *Lune* suggests at least 10 500 non‑EU companies will eventually fall under CSRD reporting requirements, particularly those in the United States, Canada, the United Kingdom and Japan【953496984695551†L20-L71】. To avoid overburdening micro and small businesses, the European Commission updated the company‑size thresholds and limited the directive to organisations most likely to influence social and environmental outcomes【178299226143617†L168-L164】.
Implementation timeline & phases
The CSRD is being rolled out in waves between 2024 and 2029. Member states had to transpose the directive into national law by 16 June 2024【178299226143617†L173-L179】. The phases are:
- Phase 1 – NFRD entities: Large companies with over 500 employees already subject to the Non‑Financial Reporting Directive start reporting in the 2024 financial year, with their first CSRD‑compliant reports due in 2025【929106229731488†L232-L237】【178299226143617†L181-L186】.
- Phase 2 – additional large companies: Large EU companies that meet two of the large‑company criteria but were not previously covered by the NFRD must report for the 2025 financial year, with reports published in 2026【929106229731488†L238-L241】【178299226143617†L188-L192】.
- Phase 3 – EU public companies and conglomerates: EU‑listed companies with more than 500 employees and large EU or non‑EU conglomerates with EU listings begin reporting for financial periods starting 1 January 2025 with reports released in 2026【929106229731488†L244-L255】【178299226143617†L194-L203】.
- Phase 4 – listed SMEs: Small and medium‑sized enterprises listed on EU regulated markets (including some non‑EU SMEs) will be required to report from 2027–2029, covering financial years beginning 1 January 2026【929106229731488†L257-L261】【178299226143617†L205-L209】. Micro‑enterprises and unlisted SMEs remain exempt.
- Phase 5 – non‑EU companies with substantial EU presence: Foreign companies generating more than €150 million of EU revenue with significant EU subsidiaries or branches must report from 2029, covering financial years starting 1 January 2028【929106229731488†L263-L266】【178299226143617†L213-L214】.
In April 2025 EU legislators adopted a “stop‑the‑clock” Directive which postponed CSRD requirements for companies originally due to report in 2025 or 2026. This measure delays the entry into application for wave 2 and wave 3 companies and provides more time for companies and regulators to implement the new standards【249586247625391†L213-L216】. A separate simplification package proposed in February 2025 suggested applying the CSRD only to the largest companies (those with more than 1 000 employees) to minimise burdens on smaller firms【249586247625391†L225-L230】.
Reporting standards and assurance
Companies must report using the European Sustainability Reporting Standards (ESRS), a set of 12 standards covering four categories: cross‑cutting, environmental, social and governance topics【178299226143617†L247-L269】. These standards require disclosure of climate targets, progress towards net‑zero, resource utilisation, biodiversity impacts, workforce conditions, community impacts, and governance practices【178299226143617†L247-L273】. Firms must also conduct double materiality assessments, considering both the financial impact of sustainability risks on the business and the company’s impacts on people and the environment【178299226143617†L289-L303】. Under the CSRD, sustainability information must be subject to independent assurance; initially this is “limited assurance”, but within the next three years it is expected to become reasonable assurance, requiring auditors to examine processes and controls in depth【178299226143617†L278-L287】. Reports must be integrated into the company’s management report and published in digital XHTML format【929106229731488†L190-L211】.
Obligations and key disclosure areas
The CSRD obliges companies to:
- Adopt a comprehensive sustainability reporting framework: Companies must integrate ESRS disclosures into their management reports, covering strategy, policies, risks, targets and performance across environmental, social and governance dimensions【178299226143617†L247-L273】.
- Perform double materiality analysis: Firms must assess how sustainability issues affect financial performance and how their activities impact society and the environment【178299226143617†L289-L303】.
- Set targets and transition plans: Companies need to disclose climate targets and transition plans aligned with the EU’s 2050 net‑zero goal, and explain how they plan to meet these targets【178299226143617†L314-L319】.
- Ensure value chain transparency: Organisations must describe due diligence procedures for identifying and mitigating social and environmental impacts across their supply chain【178299226143617†L323-L327】.
- Provide third‑party assurance: Sustainability disclosures must be verified by an independent auditor, enhancing reliability【178299226143617†L278-L287】.
Strategic implications and compliance roadmap
For many companies, complying with the CSRD will require significant investments in data collection, governance and reporting capabilities. Key steps include:
- Gap analysis and materiality assessment: Identify existing sustainability data gaps and conduct a double materiality analysis to prioritise issues. Engage stakeholders across finance, sustainability, risk and legal functions.
- Develop governance and control frameworks: Establish clear roles and responsibilities for sustainability reporting, ensuring board oversight and integration with risk management. Implement internal controls for data accuracy and develop procedures for assurance.
- Enhance data systems: Create systems to capture ESG data across operations, subsidiaries and the supply chain. Consider digital reporting tools that can produce ESRS‑compliant XHTML filings.
- Align strategy with EU taxonomy: Evaluate how business activities align with the EU Taxonomy for sustainable investments and adjust strategies to improve taxonomy alignment. Integrate climate and transition planning into overall corporate strategy.
- Train and engage stakeholders: Provide training for executives, staff and suppliers on CSRD requirements and sustainability principles. Foster collaboration across departments and with external partners.
- Monitor legislative developments: Stay abreast of EU “quick‑fix” adjustments, the “stop‑the‑clock” directive and evolving ESRS guidance to ensure compliance timelines and disclosure requirements are met【249586247625391†L213-L230】.
Conclusion
The Corporate Sustainability Reporting Directive marks a turning point in corporate accountability. By mandating standardised sustainability disclosures and expanding coverage to tens of thousands of companies, it aims to improve comparability, transparency and stakeholder trust. The phased rollout and recent postponements offer organisations time to build robust reporting systems, but the obligations are far‑reaching. Companies—both inside and outside the EU—should start preparing now to integrate double materiality into their governance, align strategy with climate and social goals, and leverage the CSRD as an opportunity to drive sustainable transformation.
Continue in the Compliance pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Third-Party Risk Oversight Playbook — Zeph Tech
Operationalize OCC, Federal Reserve, EBA, and MAS outsourcing expectations with lifecycle controls, continuous monitoring, and board reporting.
-
Compliance Operations Control Room — Zeph Tech
Implement cross-border compliance operations that satisfy Sarbanes-Oxley, DOJ guidance, EU DORA, and MAS TRM requirements with verifiable evidence flows.
-
SOX Modernization Control Playbook — Zeph Tech
Modernize Sarbanes-Oxley (SOX) compliance by aligning PCAOB AS 2201, SEC management guidance, and COSO 2013 controls with data-driven testing, automation, and board reporting.