Requirements, Implementation, and Best Practices for Companies
Regulatory status: 17 September 2026
Sustainability reporting in the European Union has entered a more focused phase. The Corporate Sustainability Reporting Directive (CSRD) and the European Sustainability Reporting Standards (ESRS) continue to make sustainability information part of regulated, assurance-ready management reporting. At the same time, the EU’s Omnibus I reform has substantially reduced the number of companies subject to mandatory reporting and simplified the reporting standards.
This page provides an end-to-end perspective on sustainability reporting under the current framework. It explains the relationship between the CSRD and ESRS, the revised scope of mandatory reporting, the role of double materiality, and the practical steps required to establish a scalable and audit-ready reporting process. It also shows how companies outside the mandatory scope can use the EU’s voluntary standard and how digital tools can reduce effort, improve evidence management, and strengthen data quality.
1. Why ESG reporting has become a strategic necessity
For many years, companies treated sustainability reporting mainly as a reputational or communications exercise. The CSRD changed that approach by bringing sustainability information into the management report, governance processes, internal controls, and external assurance.
The legal scope is now narrower than originally planned. Under Directive (EU) 2026/470, the main EU reporting obligation will generally apply, for financial years beginning on or after 1 January 2027, to EU undertakings or parent undertakings of groups that exceed both of the following thresholds:
- an average of 1,000 employees; and
- EUR 450 million in net turnover.
The thresholds must be assessed at group level where applicable. Separate rules apply to certain third-country groups operating in the EU. Member States must transpose the relevant amendments by 19 March 2027, so companies should also check the law of the country in which they report.
Companies that reported in the first CSRD wave but fall below the new thresholds will leave the mandatory scope for financial years beginning on or after 1 January 2027. For financial years beginning in 2025 or 2026, Member States may exempt first-wave companies that do not exceed either EUR 450 million in net turnover or 1,000 employees. Whether that exemption is available in practice therefore depends on national implementation.
Despite the reduced scope, sustainability information remains commercially important. Banks, investors, insurers, customers, and tendering organisations continue to request reliable environmental, social, and governance data. Companies outside the CSRD may also need structured information to support financing, customer requirements, transition planning, or internal risk management.
2. CSRD and ESRS: understanding the new reporting framework
The CSRD and ESRS perform different but connected functions.
The CSRD, implemented through the EU Accounting Directive and national law, determines which companies must report, where the sustainability statement appears, which governance responsibilities apply, and how assurance and digital reporting are handled.
The ESRS determine what an in-scope company reports. They translate the legal obligation into disclosure requirements covering strategy, governance, policies, actions, targets, metrics, and material impacts, risks, and opportunities.
The Omnibus I reform changed both levels of the system:
- Directive (EU) 2026/470 narrowed the CSRD scope, introduced a value-chain cap, removed mandatory reporting for listed SMEs, and adjusted the timing and assurance framework.
- The revised ESRS adopted on 3 July 2026 are shorter and more focused. According to the European Commission, they reduce mandatory datapoints by more than 60% and total datapoints by more than 70%, while clarifying materiality and adding practical flexibility.
Until the revised ESRS are published in the Official Journal and enter into force, the legally applicable standards remain the 2023 ESRS in Delegated Regulation (EU) 2023/2772, as amended by the 2025 “quick-fix” regulation.
3. Structure of the ESRS standards
The ESRS framework retains two cross-cutting standards and ten topical standards:
- ESRS 1 – General Requirements
- ESRS 2 – General Disclosures
- ESRS E1-E5 – Climate change, pollution, water and marine resources, biodiversity and ecosystems, and resource use and circular economy
- ESRS S1-S4 – Own workforce, workers in the value chain, affected communities, and consumers and end-users
- ESRS G1 – Business conduct
The standards are sector-agnostic. The Omnibus I reform removed the requirement for the Commission to adopt mandatory sector-specific ESRS. The Commission may instead support implementation through non-binding sector guidance where there is sufficient demand.
ESRS 2 provides the general disclosure foundation. The topical standards are applied on the basis of materiality, subject to the detailed applicability rules in the relevant ESRS version. Companies should therefore not treat the complete ESRS datapoint list as a checklist to be filled in mechanically. They need a documented process that connects material topics and IROs—impacts, risks, and opportunities—to the relevant disclosures.
4. Double materiality remains the foundation
Double materiality remains the central decision principle under the revised framework. A sustainability matter is material if it is material from an impact perspective, a financial perspective, or both.
- Impact materiality considers how the company causes, contributes to, or is directly linked to actual or potential impacts on people or the environment across its operations and value chain.
- Financial materiality considers whether sustainability-related risks or opportunities could reasonably affect the company’s financial position, financial performance, cash flows, access to finance, or cost of capital.
A company does not need to report every topical disclosure. It reports information connected to material sustainability matters and must be able to explain and evidence the judgments that led to that conclusion.
The 2026 revision is intended to make materiality assessment more proportionate and easier to apply. That does not remove the need for a defensible process. Companies should retain evidence of their methodology, thresholds, assumptions, stakeholder inputs, value-chain considerations, management validation, and changes from the prior year.
5. The sustainability reporting process in practice
Effective ESRS implementation is a recurring management process, not a one-off writing exercise.
Step 1: Confirm scope and the applicable rule set
Determine which legal entity or group is the reporting undertaking, test the employee and turnover thresholds, assess any consolidation exemption, and identify the relevant national implementation rules. During the 2026-2027 transition, companies must also document which ESRS version applies to the reporting period.
Step 2: Establish governance
Assign responsibility across the management board, sustainability, finance, risk, legal, HR, procurement, operations, and internal audit. Define review, approval, escalation, and change-control procedures. Treat the sustainability statement as controlled corporate reporting.
Step 3: Conduct the double materiality assessment
Identify sustainability matters and IROs across own operations and the upstream and downstream value chain. Evaluate them using consistent criteria, validate the result with management, and preserve the supporting evidence. Update the assessment when the business model, value chain, transactions, regulation, or risk profile changes materially.
Step 4: Map requirements and perform a gap analysis
Map material IROs to the applicable disclosure requirements and datapoints. Compare those requirements with existing policies, metrics, processes, controls, and source documents. The gap analysis should distinguish between missing disclosure text, missing data, missing evidence, and missing management action.
Step 5: Build the data and evidence model
For every reportable metric or narrative disclosure, define the owner, source, methodology, reporting boundary, unit, calculation, control, approval status, and evidence location. Align sustainability and financial reporting boundaries wherever required and document any differences.
Step 6: Draft, review, and assure
Prepare the sustainability statement with clear links between IROs, policies, actions, targets, and metrics. Run consistency checks across the sustainability statement, financial statements, risk reporting, and public communications. In-scope reporting remains subject to limited assurance. The EU deadline for Commission-level limited-assurance standards is now 1 July 2027; national requirements and professional standards remain relevant in the meantime.
Step 7: Prepare for digital reporting
The legal framework provides for the management report to be prepared in the European single electronic format and for sustainability information to be marked up. Companies should structure data and disclosures so they can support digital tagging once the applicable technical rules and taxonomy are in place, without presenting future tagging as already operational where it is not.
6. What the revised ESRS change in practice
The revised ESRS preserve the core architecture of sustainability reporting but aim to reduce complexity. The main operational effects are:
- fewer mandatory and total datapoints;
- clearer application of materiality;
- shorter and more focused disclosures;
- greater emphasis on decision-useful quantitative information;
- more flexibility where data or value-chain information is difficult to obtain; and
- closer alignment with other EU rules and international sustainability-reporting standards.
Companies should not simply delete datapoints from an old checklist. They should update their materiality-to-disclosure mapping, identify changed definitions and phase-ins, revise data-owner instructions, and test whether existing controls still cover the information required by the new standards.
For reports governed by the current 2023 ESRS, the 2026 standards can inform transition planning but do not replace the legally applicable text before entry into force.
7. Sustainability reporting for companies outside the CSRD
Most small and medium-sized companies, and many larger companies, will not fall within the revised mandatory CSRD scope. They may nevertheless receive sustainability-data requests from customers, lenders, investors, or insurers.
The EU framework now offers two relevant reference points:
- The 2025 VSME Recommendation remains a voluntary tool that companies can use immediately.
- The new Voluntary Standard adopted on 3 July 2026 is designed for undertakings outside mandatory CSRD reporting and for companies protected by the value-chain cap. It will supersede the interim VSME framework when it enters into force.
Under the amended Accounting Directive, companies in the value chain with no more than 1,000 employees are “protected undertakings” for CSRD information requests. For the purpose of a reporting company’s CSRD compliance, they may refuse requests that exceed the information specified in the Voluntary Standard. This protection does not automatically limit information required for other legal, contractual, due-diligence, or risk-management purposes.
A pragmatic voluntary approach should focus on decision-useful information, consistent definitions, documented methods, and a manageable annual process. The objective is not to reproduce full ESRS reporting, but to provide credible data that can be reused across customer, finance, and management requests.
8. Data, systems, and operating model
High-quality sustainability reporting depends on traceable data. Relevant information is often distributed across finance, HR, procurement, operations, environmental systems, and document repositories. The challenge is therefore not only collecting data but also governing it.
A robust operating model should provide:
- a central register of disclosure requirements and material IROs;
- named owners and reviewers for every metric and narrative disclosure;
- controlled methodologies, reporting boundaries, and calculation logic;
- links from reported information to source evidence;
- approval histories and version control;
- automated validation and exception workflows; and
- a documented audit trail from source to final disclosure.
Automation can reduce repetitive work and improve consistency, especially for recurring data requests, evidence collection, approvals, and cross-references. However, tools do not replace management judgment, accountability, or controls. AI-generated analysis should be source-bound, reviewable, and approved before it enters regulated reporting.
9. Common challenges and how to address them
Companies commonly struggle with the following issues:
Late assurance involvement: Engage assurance providers and internal control functions early enough to test methodologies, boundaries, estimates, and evidence.
Outdated scope assumptions: Reassess CSRD applicability using the new thresholds and national implementation, rather than relying on an earlier wave plan.
Mixing current and future standards: Maintain explicit version control for the 2023 ESRS, the 2025 quick fix, and the adopted 2026 ESRS.
Checklist-driven materiality: Start with the business model, value chain, and IROs, then map to disclosures.
Weak evidence: Store the source, owner, calculation, review, and approval for each significant statement or metric.
Fragmented data ownership: Assign clear accountability and integrate sustainability controls into established finance, risk, HR, procurement, and operational processes.
Excessive supplier questionnaires: Align CSRD-related requests with the value-chain cap and the Voluntary Standard, while clearly separating other legal or commercial requests.
10. Conclusion: ESG reporting as a management capability
The 2026 reforms make EU sustainability reporting more targeted and proportionate, but they do not make sustainability information irrelevant. Companies that remain in scope need a controlled, assurance-ready process. Companies outside scope still benefit from credible data that supports customer requirements, finance, risk management, and strategic decisions.
The best approach is to build a reusable reporting capability: confirm the applicable legal scope, apply the correct version of the standards, focus on material IROs, govern data and evidence, and use automation where it improves control and efficiency.
Next step:
Use ESGlink to analyse ESRS requirements in your specific context and Hublink to automate ESG workflows, data collection, and documentation.
