EU ESG Reporting 2026: Which CSRD Rules Apply to Your Company? [Free Checklist]

Since the omnibus package became law, the questions that matter about EU ESG reporting have changed: who is still in scope, what an EU ESG report has to contain, and when the first one is due. This page answers those three in order.

Which EU rules require ESG reporting, and who is in scope after the omnibus package

Five instruments carry the substance. The Corporate Sustainability Reporting Directive (CSRD) sets who reports, the European Sustainability Reporting Standards (ESRS) set the content, the EU Taxonomy Regulation adds alignment figures for turnover, capex and opex, the Corporate Sustainability Due Diligence Directive (CSDDD) governs conduct rather than disclosure, and the SFDR applies to financial market participants. The EU Deforestation Regulation and the Emissions Trading System sit alongside them with narrower obligations.

Directive (EU) 2026/470, the omnibus package, has been in force since 18 March 2026 and reset the scope. A company files under CSRD only if it exceeds both thresholds at once: more than 1,000 employees and more than 450 million euros in net turnover. The staged wave structure by company category is gone, listed SMEs are exempt regardless of size, and non-EU parents come into scope only through the EU turnover test.

Mid-sized companies that were preparing for wave two or wave three under the original CSRD now have no filing obligation of their own. What still reaches them is the value chain: large filers need supplier data to complete their own ESRS disclosures, and the value chain cap limits what they may demand to the content of the Voluntary Standard.

My position on the package: it is not bureaucratic relief, it is data deletion in instalments. Data points that are never collected will not appear in anyone's financial risk model later, and that gap is paid by lenders and investors, not by the lobbyists who pushed for it.

What an EU ESG report must contain: ESRS, double materiality and value chain data

The ESRS are built in two layers. ESRS 1 and ESRS 2 are cross-cutting and always apply: reporting basis, governance, strategy and how the company arrived at its material topics. The topical environmental, social and governance standards apply only where the materiality result says they do. The omnibus package cut the mandatory data points by well over half and removed the sector-specific standards, so the set is smaller, but the logic that selects it is unchanged.

Double materiality is that selection logic. A topic is material if the company has a significant impact on people or the environment through it, or if it creates a financial risk or opportunity, or both. In practice this is a documented process with evidence, stakeholder input and a threshold you can defend to an auditor, not a workshop opinion. It also decides how long everything else takes, because a narrow, well-argued materiality result removes whole standards from the workload.

Value chain data is where CSRD reporting becomes a logistics problem. Scope 3 emissions, supplier working conditions and, for commodities in scope, geolocation data under the EU Deforestation Regulation all originate outside the reporting entity.

From building VSEasy, my reporting tool, the data points that break are rarely the exotic ones. Scope 3 category boundaries drift between years because somebody reclassifies a spend category. Headcount by contract type has to be reconciled across payroll systems that count differently. And the year-on-year comparison logic, which nobody treats as a data point at all, forces a methodology rebuild in year two if it was not designed in year one.

What EU companies actually disclose: evidence from more than 1,000 analysed reports

Published reports show what companies do once a deadline is real. I extract CSRD and ESRS reports into a database that currently holds more than 1,000 analysed reports and read them by size class and NACE sector: whether a transition plan is present, how far Scope 3 coverage reaches, which social data points are filled rather than declared immaterial, and whether the figures can be compared with the previous year.

The pattern worth stating outright: compliance-first reporting is not sustainability management. A report that satisfies the ESRS and changes no decision inside the company has consumed a budget and produced an artefact. The value of that data sits in procurement, capex and site decisions. Where a company treats the ESRS data set as a controlling data set rather than a filing obligation, the second reporting year costs a fraction of the first.

Comparing reporting scope and vendor cost before committing

Most tool comparisons compare features. The question that decides cost is narrower: how much of the work does a tool actually remove for the reporting set you are subject to? Criteria for a shortlist:

• Data point coverage: not "ESRS-ready" as a label, but the specific data points that follow from your materiality result.
• Audit trail: a source, a timestamp and a responsible person per figure. Limited assurance fails on evidence, not on presentation.
• Value chain collection: how suppliers submit data without a licence of their own, and what the tool does when one never answers.
• Comparability: whether last year's figures survive a methodology change, or get overwritten.
• Pricing basis: per report, per user or per legal entity. In a group structure those three prices diverge sharply.

Getting ready: timeline, transposition status and the next twelve months

The EU-level dates are fixed. Obligations apply to financial years starting on or after 1 January 2027, so the first reports appear in 2028. Assurance starts at limited level, with reasonable assurance foreseen for large companies from 2028. The Voluntary Standard for SMEs, adopted as a delegated act on 3 July 2026, is what companies outside the scope can use, and it is what the value chain cap points at from financial year 2027.

National transposition has to be tracked separately. It governs which national act carries the obligation, how assurance providers are licensed and what enforcement looks like, and member states have moved at very different speeds. Check the implementing act in the country of registration before fixing an internal deadline, and follow the European Commission and EFRAG pages rather than secondary summaries.

Twelve months of useful work, in sequence:

• Confirm scope for every legal entity in the group, including the non-EU turnover test.
• Run or refresh the double materiality assessment and document the threshold you applied.
• Map each surviving data point to a system, an owner and a collection frequency.
• Collect one full year in parallel with current reporting, as a dry run, and track the core metrics from day one.
• Have an assurance provider review the evidence trail before the figures are final.

Frequently Asked Questions