CSRD Explained: What It Means for Companies in Europe (Updated Guide)
Updated: Aug 28
Ørsted's 2025 annual report runs past 350 pages. That's not a typo, and it's not because the Danish offshore wind company suddenly found 300 extra pages of things to say. It's because, for the first time, its sustainability disclosures are woven directly into the same document as its financial statements, tagged, structured, and assured to the same standard investors expect from a balance sheet. EY's own analysis of 200 early sustainability statements found the same pattern across the board: reports got noticeably longer in their first year under the new EU rules, and interestingly, EY's researchers concluded that length wasn't always driven by how many topics a company's own materiality assessment actually flagged as important. Often it was driven simply by companies following the suggested structure in the standard itself, filling in every section the template offered, whether or not it was the most relevant way to tell their story.
That's a genuinely useful thing to know before you open any European sustainability report for the first time: a long report doesn't necessarily mean a company has more to disclose. It might just mean the company followed the template closely. This updated guide walks through what CSRD actually requires, using real, current disclosures from three companies in very different industries, a chemicals giant, a telecom operator, and a renewable energy company, to show how the same law produces genuinely different reports depending on who's writing them.
Starting With the Basics: What CSRD Actually Is
CSRD, the Corporate Sustainability Reporting Directive, is EU Directive (EU) 2022/2464. It replaced an older, looser rule called the Non-Financial Reporting Directive, and the difference between the two is really the whole story. NFRD asked companies to say something about their sustainability performance, in more or less whatever format they chose. CSRD asks for something structurally closer to a financial statement: a defined format, a defined set of standards behind it, and a mandatory sign-off from an independent assurance provider. It isn't a framework a company can pick up voluntarily and put down when it's inconvenient. It's binding law, written into the national legislation of every EU member state.
That last point is worth sitting with for a second, because it explains something that surprised even companies with years of sustainability reporting experience. Deutsche Telekom had already been publishing detailed corporate responsibility reports for years before CSRD applied to it. And yet, in preparing its 2024 sustainability statement, the company explicitly notes it applied the ESRS framework voluntarily, ahead of Germany's own national transposition of CSRD into law, specifically to be ready for what was coming. A company that size doesn't do that lightly. It did it because the shift from "here's our sustainability story" to "here's our legally structured sustainability disclosure" is a genuinely different undertaking, and getting a head start mattered.
Key takeaway: CSRD isn't a rebrand of sustainability reporting. It's a change in legal category, from communications to compliance, and companies that treated it as the former were consistently the ones scrambling once it became the latter.
Who's Actually In Scope, After the Rules Changed in 2026
This is where an older explanation of CSRD, including an earlier version of this article, would now be actively wrong. The scope thresholds shifted meaningfully in 2026, and it matters that a reader has the current numbers, not the ones that were floating around in 2023.
CSRD's scope was narrowed through the EU's Omnibus simplification package, which became binding law as Directive (EU) 2026/470, published in the EU's Official Journal on 26 February 2026 and in force since 18 March 2026. Under the current rules, a company falls in scope if it's a large EU company meeting both of two conditions together, more than 1,000 employees and more than €450 million in net turnover, a meaningfully higher bar than the original 2022 text set. Non-EU parent companies can still be pulled in too, specifically if they generate more than €450 million in turnover within the EU and have a qualifying branch or subsidiary there. Listed small and medium companies, which were on a near-term path into CSRD's scope under the original rules, no longer have a firm near-term timeline following the Omnibus changes.
The European Securities and Markets Authority, ESMA, the EU's own securities regulator, published a detailed fact-finding report in October 2025 looking specifically at how the first wave of large, listed companies actually applied ESRS in their 2024 sustainability statements. It's a genuinely rare thing: a regulator publicly reviewing real companies' real first attempts and reporting back on what it found, rather than a private consultancy's summary. That report exists precisely because the first wave of companies, the ones now potentially eligible for member-state exemptions under the Omnibus transition rules, were the test case the rest of the market is learning from.
Key takeaway: if your mental model of "who has to comply with CSRD" still involves a company with 250 employees, that model is describing rules that no longer exist. The bar roughly quadrupled in employee count and rose sharply in turnover, and the two conditions must both be true at once.
What Actually Gets Reported, and What Doesn't
CSRD is the law. The detailed rulebook underneath it is the European Sustainability Reporting Standards, ESRS, developed by EFRAG and adopted by the European Commission. ESRS splits disclosure into general, cross-cutting requirements plus topical standards across three areas, environmental (climate change, pollution, water and marine resources, biodiversity and ecosystems, resource use and circular economy), social (a company's own workforce, workers across its value chain, affected communities, and consumers or end users), and governance (business conduct).
Here's the part that a first-time reader often misses: a company doesn't report on all of these by default. It reports on whichever ones its own double materiality assessment identifies as relevant to its business, and every other topic gets a brief, explicit statement explaining why it was excluded. In practice, that produces a surprisingly consistent pattern across very different industries. A 2025 benchmark by consulting firm Wavestone, reviewing a broad set of early CSRD reports, found that four specific standards showed up as material almost universally, climate change (E1), circular economy (E5), own workforce (S1), and workers in the value chain (S2), while others, pollution (E2), water and marine resources (E3), biodiversity (E4), and affected communities (S3), were selected far less often, sometimes for genuinely good industry-specific reasons, and sometimes, Wavestone notes, simply because companies' measurement systems for those topics are still less mature.
BASF, the German chemicals company, is a useful real illustration of how seriously a large industrial company now treats this exercise. Its 2025 report describes running a fresh double materiality assessment that year, building directly on the 2024 assessment rather than starting from scratch, drawing on both direct stakeholder input, gathered through its Advisory Councils and its own Civil Society Forum, and indirect input, drawn from big data analysis of customer and capital market interests. That's a notably more structured, ongoing process than a once-and-done exercise, and BASF's report explicitly states the company intends to update the assessment annually going forward, treating it as a living process rather than a box checked once and forgotten.
Key takeaway: the topics a company reports on are never fixed by ESRS itself. They're the output of that company's own assessment, and the Wavestone data shows a real, industry-spanning pattern in which topics companies consistently flag as material, and which ones still lag behind in measurement maturity.
Where CSRD Gets Genuinely Hard: The Value Chain
CSRD's reporting obligation doesn't stop at a company's own four walls. ESRS explicitly extends both the materiality assessment and the resulting disclosures into a company's value chain, upstream to suppliers and raw material sources, downstream to distributors, customers, and end-of-life handling. That's a meaningfully bigger ask than it sounds, because a company can control the quality of its own internal data with reasonable confidence. It generally can't directly control whether a supplier several tiers removed even measures its own emissions consistently, let alone whether that data is reliable enough to survive an assurance review.
Ørsted's approach offers a useful contrast here, precisely because of a decision the company made a decade before CSRD existed. Since 2015, Ørsted has had its ESG accounting and reporting function sit inside its finance department, not a separate sustainability team. According to the company's own account, that decision, aligning sustainability data with the same processes, deadlines, and tools already used for financial data, turned out to be exactly the kind of infrastructure CSRD's more rigorous assurance expectations now reward. A company that built financial-grade discipline into its sustainability data collection years in advance had a real head start once the law caught up and started requiring that discipline of everyone.
Key takeaway: the hardest part of CSRD compliance, consistently, is not writing the report. It's building the underlying systems, especially the ones reaching outside a company's own operations, capable of producing data that can survive an audit-grade review, and companies that started that infrastructure work years early, for reasons that had nothing to do with CSRD at the time, are visibly ahead now.
Double Materiality, and What Regulators Are Actually Finding When They Check
Double materiality, the requirement to assess a topic from both an impact angle and a financial angle independently, is covered in full technical depth in a dedicated article elsewhere on this site, including the specific ESRS scoring criteria. It's worth revisiting briefly here for one reason: ESMA's October 2025 fact-finding report gives a rare, regulator's-eye view of how well companies are actually doing this in practice, not just how well consultants say they're doing it.
The picture that emerges is mixed. Multiple independent reviewers of the first wave of ESRS reports, including the corporate reporting consultancy Black Sun in its analysis of the first 20 CSRD-compliant reports published by Danish companies, found real variation in how transparently companies disclosed their process. Some, like pharmaceutical company Lundbeck, went further than required, disclosing material issues that technically fell just below their own significance thresholds, a more transparent approach than most peers took. Others provided only a list of topics without the full, consolidated reasoning regulators and reviewers say is the preferred practice. Wavestone's benchmark adds a related observation worth knowing if you're hunting for a company's materiality matrix specifically: very few companies have actually published a visual version of it. Most consider the underlying scoring too commercially sensitive to put in front of the public, even though the resulting topic list is disclosed.
Key takeaway: double materiality assessments are now being reviewed by an actual EU regulator, not just graded informally by outside observers, and the first round of findings shows genuine variation in rigor and transparency, with a small number of companies, Lundbeck among them, setting a visibly higher bar than the rest of the market.
The 2026 Omnibus Package, Precisely
"Omnibus" gets thrown around loosely in a lot of coverage, so it's worth being exact about what actually changed, now that it's settled law rather than a live proposal. Directive (EU) 2026/470 did three concrete things. It narrowed CSRD's scope to the 1,000-employee, €450 million turnover thresholds described above, which removed a substantial number of previously in-scope companies, particularly listed SMEs. It pushed first reporting under the revised rules out to financial year 2027, filed in 2028, a two-year delay from the original schedule. And, in a related but separate move, it narrowed the EU's Corporate Sustainability Due Diligence Directive even further, to companies above 5,000 employees and €1.5 billion in worldwide turnover, while removing the previously mandatory requirement for companies to adopt a formal, Paris-aligned climate transition plan and capping the associated penalties.
Separately, EFRAG's own simplified ESRS technical advice, delivered to the European Commission in stages through 2025, cuts the total number of mandatory ESRS data points by roughly 61 percent compared with the original 2023 standard. That's a substantial reduction in sheer disclosure volume, even though the underlying legal obligation, the double materiality requirement, and the assurance requirement all remain fully intact for whichever companies stay in scope.
Key takeaway: the Omnibus reforms made CSRD apply to fewer companies and ask less of the ones still in scope. They did not weaken the core legal architecture, mandatory reporting, double materiality, and independent assurance, for the companies the law still covers.
What Happens If a Company Just Doesn't Comply
CSRD itself doesn't set specific fine amounts. It requires each member state, under Article 51 of the Accounting Directive as amended, to establish penalties that are "effective, proportionate, and dissuasive," and leaves the actual mechanics to national law, which is exactly why the consequences genuinely differ depending on where a company is registered. A few real, current examples make the pattern concrete. France's ordonnance of 6 December 2023 allows for criminal liability specifically where a company knowingly publishes false sustainability information, with reported fines up to roughly €375,000 for a company and €75,000 for an individual, alongside separate criminal exposure for obstructing a statutory auditor's sustainability assurance work. Ireland's transposing regulations go further in one specific respect: they allow for imprisonment of directors who knowingly authorize a non-compliant report, not just a fine. Layered on top of all of this, the Omnibus package introduced an EU-wide ceiling, capping financial penalties imposed by national supervisory authorities at 3 percent of a company's net worldwide turnover in the preceding financial year, which now sets an outer boundary across every member state's own specific rules.
Key takeaway: the exact number a non-compliant company might face depends entirely on its country of registration, but every version of it involves real financial exposure, and in more than one jurisdiction, personal legal risk for the directors who signed off on the report.
CSRD Next to Everything Else
CSRD is mandatory EU law with double materiality built in by design. GRI, SASB, TCFD, and ISSB, covered in depth in the alphabet soup article elsewhere on this site, are a mix of voluntary standards and standards that only carry legal force where a specific jurisdiction has separately adopted them. In practice, the two worlds constantly overlap in the same document. Deutsche Telekom's 2024 sustainability statement is a clean illustration: alongside its ESRS-structured disclosures, the same document folds in Germany's own national non-financial statement requirements under the Handelsgesetzbuch, the German Commercial Code, plus separate EU Taxonomy disclosures that have applied to the company since as far back as the 2021 reporting year, all stitched into one combined report rather than kept as separate documents.
Key takeaway: don't expect a European sustainability report to cite just one standard. The realistic pattern, visible across BASF, Deutsche Telekom, and Ørsted alike, is several legal and voluntary frameworks layered into a single document, with ESRS providing the mandatory backbone and everything else built around it.
What This Actually Means If You're Preparing a Report for the First Time
Pulling the real examples in this article together into practical advice: start the materiality assessment earlier than seems necessary, since BASF's process shows it's genuinely meant to be an annually refreshed exercise, not a one-time project, and Deutsche Telekom's early voluntary adoption shows the value of not waiting for a legal deadline to force the timeline. Get finance involved in owning sustainability data early, ideally before it's mandatory, since Ørsted's decade-old decision to do exactly that is now paying off directly in report quality and assurance readiness. Resist the urge to fill in every section a template offers, since EY's own analysis of the first 200 reports found that a lot of added length reflected following the suggested structure rather than genuine materiality, and a shorter, better-targeted report is not a weaker one. And expect scrutiny on the materiality process itself, not just the final numbers, since ESMA is now actively reviewing exactly that, and the companies setting the best example, Lundbeck among them, are the ones disclosing more of their reasoning, not less.
References
Directive (EU) 2022/2464 of the European Parliament and of the Council, the Corporate Sustainability Reporting Directive
Directive (EU) 2026/470 of the European Parliament and of the Council (the "Omnibus" amending directive), Official Journal, published 26 February 2026, in force 18 March 2026
European Commission, Corporate Sustainability Reporting Directive, overview and implementation timeline, ec.europa.eu
EFRAG, European Sustainability Reporting Standards (ESRS), and Simplified ESRS Technical Advice to the European Commission, 2025
European Securities and Markets Authority (ESMA), Materiality Matters: Results of a Fact-Finding Exercise on 2024 Corporate Reporting Practices under ESRS Set 1, ESMA32-846262651-5288, 14 October 2025
Directive 2013/34/EU (the Accounting Directive), Article 51, as amended, on member state penalties for non-compliance
Ordonnance n° 2023-1142 of 6 December 2023 (France), transposing CSRD into French law
BASF SE, Combined Management's Report, Consolidated Sustainability Statement, Double Materiality Assessment, Report 2025, report.basf.com
Deutsche Telekom AG, Annual Report 2024, Sustainability Statement, ESRS 2: General Disclosures, report.telekom.com
Ørsted A/S, Annual Report 2025
EY, CSRD Barometer 2025: Setting the Baseline, May 2025
Wavestone, CSRD Benchmark 2025: What the First Sustainability Reports Reveal
Black Sun, Corporate Sustainability Reporting Directive (CSRD): The First 20 Compliant Sustainability Statements
Comments