The way companies report on their business has changed deeply. For years, non-financial reporting stayed marginal: a few pages in the annual report, broad commitments, little verified data. The CSRD (Corporate Sustainability Reporting Directive) ended that era. It turns environmental, social and governance disclosure into a structured, standardised and audited obligation. The framework was then narrowed in 2026: fewer companies in scope, shorter standards, and a cap to protect suppliers. This article sets out the essentials without legal jargon: what the directive says, who it covers today, what it requires and how to prepare your organisation. To place this obligation in a wider approach, you can also read our complete guide to CSR in companies.
Contents
What is the CSRD?
The CSRD is a European directive adopted in late 2022. It sets the rules companies follow to publish sustainability information: their impact on the environment and society, and the risks and opportunities these topics create for their business. It aims to let investors, customers, employees and regulators compare companies on reliable, detailed and verified data.
The directive replaces an earlier framework, the NFRD on non-financial disclosure, adopted in 2014. In France, the extra-financial performance statement (DPEF) was until then the main instrument of this reporting. The French ordinance of 6 December 2023, which transposes the CSRD into French law, replaced the DPEF with the new European requirements for companies in scope. The logic stays close to that of the DPEF. The level of detail, the method and the level of control, however, go much further.
Double materiality and IROs
The directive rests on one principle: double materiality. The idea comes down to two questions. First question: what effect does my activity have on the world, meaning on climate, resources, health or communities? Second question: what effects does the world have on my company, for example through rising energy costs, new regulations or changing customer expectations?
The European standards give a name to the result of this analysis: "material impacts, risks and opportunities", often shortened to IROs. An industrial site that releases pollutants illustrates an impact. A company that depends on fossil fuels whose price rises illustrates a risk. The same topic can fall under both angles at once. The list of IROs retained then determines the whole content of the report.
Who is subject to the CSRD since the Omnibus directive?
The CSRD was designed to apply in successive waves: first the large companies already subject to the NFRD, then other large companies, listed SMEs and some groups from outside the European Union. That design has been deeply revised. In late February 2025, the European Commission presented the Omnibus package, a set of texts meant to simplify several regulations, including the CSRD.
The outcome is now settled. Directive (EU) 2026/470 of 24 February 2026 limits the obligation to companies that meet two conditions at once: net turnover above 450 million euros and an average of more than 1,000 employees over the financial year. Source: Directive (EU) 2026/470, Official Journal of the European Union. According to the French Treasury, the vast majority of SMEs and mid-sized companies are therefore no longer in scope. Source: Direction générale du Trésor, 21 October 2026 (in French).
One date matters. Member States must transpose these new rules by 19 March 2027 at the latest. Until then, have your exact situation confirmed by your legal adviser or your auditor.
Companies outside the scope are still concerned by the topic, for two reasons. They are exposed to the ripple effect described below. And structuring sustainability data takes time: organisations that start late pay for it in the quality of their first publication.
What the CSRD requires you to disclose: the ESRS
The expected content is defined by the ESRS, the European Sustainability Reporting Standards. They were prepared by EFRAG, a European technical body, then adopted by the Commission. They work as a common framework: the same topics, the same definitions and the same indicators from one company to the next.
The ESRS contain 12 standards. Two cross-cutting standards set out general requirements and general disclosures: sustainability governance, strategy and materiality assessment. Five standards cover the environment: climate change, pollution, water, biodiversity and ecosystems, and resource use and the circular economy. Four standards deal with social matters: own workforce, workers in the value chain, affected communities, and consumers and end-users. A final standard covers business conduct, which includes ethics and the fight against corruption.
The CSRD does not ask everyone to publish everything in the same way. The double materiality analysis determines which topics matter for your business. A digital services company and a chemical manufacturer will not produce the same report. The analysis method, however, must be documented and justified.
Revised ESRS from financial year 2027
The ESRS have just been simplified by Delegated Regulation (EU) 2026/1563, published in the Official Journal on 21 September 2026. The revised standards apply to financial years starting on or after 1 January 2027. Source: Delegated Regulation (EU) 2026/1563. They require much less data, with priority given to figures over narrative text. The detail of the changes, the option open for financial year 2026 and their effects for HR teams are in our article on the revised ESRS.
CSRD report: indicators, format and assurance
The sustainability report is part of the management report, in a dedicated section. It is published in a tagged electronic format, which makes the data automatically comparable. It is also assured by a statutory auditor or an independent assurance provider. This assurance takes the form of limited assurance. This consistency check is less thorough than a full audit. It requires traceable and documented data.
Social indicators show well what the standards expect. The own workforce standard (S1), for example, asks for information on employee characteristics, collective bargaining coverage, gender diversity in senior management, training, health and safety, work-life balance and remuneration. To draft your report, start from your IROs, then list for each one the related policy, actions, targets and indicators. If you are looking for support on this part, our page on employee engagement for CSR presents our approach.
The ripple effect: when the CSRD reaches companies outside its scope
Even outside the scope, your company will feel the CSRD. The first channel runs through large customers. A large company in scope must document its value chain, including the impacts of its suppliers. Its procurement teams therefore send questionnaires: carbon footprint of delivered products, working conditions, environmental policy, social compliance. Answering in a structured way becomes a selection criterion, just like price or quality.
These requests are now regulated. Delegated Regulation (EU) 2026/1560 creates a voluntary standard, based on the VSME standard for SMEs. It also works as a cap: a company subject to the CSRD cannot require a partner that had an average of 1,000 employees or fewer over the previous financial year to provide information beyond this standard. Source: Delegated Regulation (EU) 2026/1560. The French Treasury notes that this cap does not cover requests made for purposes other than the CSRD.
The second channel runs through funders. According to the French Treasury, companies outside the scope can receive information requests from their customers as well as from their funders. The quality of your ESG data therefore also matters in your relationship with your bank. A company that anticipates these requests answers tenders faster and turns this into a sales argument.
How to prepare in practice
Preparing for the CSRD is mostly a project management task. Four workstreams structure the approach.
Set up governance
Appoint a sponsor at executive level. Build a steering group that brings together CSR, finance, HR and procurement, because the required data sits across these functions. Set an internal timeline with clear milestones: materiality analysis, data inventory, drafting, review and external assurance. Without explicit governance, the project stalls between departments.
Map the data
List the information the standards require and find where it sits today. Energy and travel belong to operations. Supplier emissions belong to procurement. Headcount, training, health and safety, absenteeism and turnover belong to HR. For each data point, note its owner, its update frequency and its reliability. This mapping almost always reveals gaps. It is better to find them early and start the missing measurements now.
Choose useful indicators
Resist the temptation to measure everything. Select a small number of indicators aligned with your material topics, and keep them stable from one financial year to the next. Document the calculation method: reproducible data is worth more than impressive data that cannot be verified. These indicators will also serve as an internal dashboard to steer the transition.
Involve employees
The social side of the CSRD relies on living data: well-being at work, cohesion, health and safety, training and engagement in change. These signals are built throughout the year, with programmes that get teams acting day to day.
At United Heroes, our solution gets employees involved across four use cases: well-being, cohesion and social connection, solidarity and CSR engagement, and change enablement. Challenges, daily streaks and short events create measurable participation, useful for your internal steering as well as for your social indicators. Used by more than 1,000 organisations, B Corp certified and ISO/IEC 27001 certified for data security, our solution bets on the team in action. Discover our approach to employee CSR engagement.
One last recommendation: treat the CSRD as the translation of your strategy into a report. Some companies choose to go beyond the obligation, for example by becoming a purpose-driven company and writing their purpose into their articles of association.
This article explains the framework for information purposes. It does not replace legal advice tailored to your company.
FAQ
What are the new CSRD thresholds?
Since the Omnibus directive (EU) 2026/470, the obligation targets companies that exceed both 450 million euros of net turnover and an average of 1,000 employees over the financial year. Both conditions must be met. Member States must transpose these thresholds by 19 March 2027: have your situation confirmed by your adviser.
Does the CSRD apply to SMEs?
Not directly: with the new thresholds, the vast majority of SMEs and mid-sized companies are out of scope. Indirectly, they remain exposed, because their large customers and their banks ask them for data. The voluntary standard adopted in 2026 gives them a recognised format to answer. It also caps what a customer subject to the CSRD can ask them for its own report. The right reflex is to prepare a standard answer rather than improvise at each tender.
What is the difference between the CSRD and the ESRS?
The CSRD is the directive: it says who must report, when and under what control. The ESRS are the standards: they say what to disclose and how, topic by topic. The revised ESRS apply to financial years starting on or after 1 January 2027.
What is the difference between the CSRD and the EU taxonomy?
The taxonomy is a classification system: it defines which economic activities can be considered sustainable according to precise technical criteria. The CSRD is a disclosure obligation: it governs how and what to report on sustainability. The two texts meet: companies subject to the CSRD prepare their sustainability report in line with both the directive and the taxonomy.
What happens to the French DPEF?
For companies subject to the CSRD, it has been replaced by the sustainability report. The French ordinance of 6 December 2023 replaced the extra-financial performance statement with the obligations arising from the CSRD and the ESRS. Companies that mastered the DPEF start with an advantage: the documentation logic stays close, but the level of detail and external control increase sharply. Past DPEF statements remain a good starting point for the materiality analysis.
Will the published data be checked?
Yes. The report is assured by a statutory auditor or an independent assurance provider, in the form of limited assurance. This is a consistency and compliance check, less thorough than a full financial audit. Your collection processes must therefore be traceable and documented: an assurance provider must be able to trace each published indicator back to its source.
Where should you start?
First check whether your company exceeds the new thresholds. If it does, run a gap analysis between your practices and the revised ESRS, then set up the steering group with CSR, finance, HR and procurement. Next, carry out the double materiality analysis, because it determines the whole content of the report. If you are out of scope, prepare an answer to your customers' questionnaires based on the voluntary standard.
Product Marketing Manager at United Heroes
