CSRD Phase 2: What UK Companies Must Do Before January 2027

The Regulatory Landscape Has Shifted

The Corporate Sustainability Reporting Directive (CSRD) is not a voluntary framework. It is a binding EU regulation that replaced the Non-Financial Reporting Directive (NFRD) and dramatically expanded both the scope of companies caught and the granularity of disclosure required. Phase 1 applied to large public-interest entities from January 2024. Phase 2, which applies from January 2026 for financial year 2025 reporting, extends the obligation to all large undertakings meeting at least two of three criteria: more than 250 employees, more than €50 million in net turnover, or more than €25 million in total assets.

For UK companies, this is not a “European problem.” The extraterritorial provisions of the CSRD mean that a significant number of UK-headquartered groups are directly in scope or will need to provide data to EU subsidiaries that are.

How UK Companies Are Caught

There are three principal routes through which UK companies fall within CSRD’s reach:

1. EU subsidiaries. If your group includes subsidiaries incorporated in an EU Member State that individually meet the size thresholds, those entities must report under CSRD. The parent company will need to provide consolidated sustainability data, and the subsidiary’s report must cover its own operations plus relevant value chain information that may extend back into UK operations.

2. EU-listed securities. Any UK company with transferable securities admitted to trading on an EU-regulated market is subject to CSRD reporting obligations, regardless of where the company is incorporated.

3. The €150 million EU revenue threshold. Under Article 40a, non-EU parent undertakings generating net turnover exceeding €150 million in the EU for each of the last two consecutive financial years, and having at least one EU subsidiary or branch exceeding €40 million in net turnover, will be required to publish a sustainability report. This provision applies from financial year 2028, but the data architecture and systems must be built well in advance.

In practice, we find that many UK companies are caught through the first route and are already behind on implementation. The assumption that Brexit insulated UK corporates from EU sustainability regulation has proven costly.

The Twelve ESRS Standards: What Each Requires

The ESRS framework comprises two cross-cutting standards and ten topical standards:

Cross-cutting:

• ESRS 1 (General Requirements) — Sets the architecture: reporting boundaries, time horizons, value chain inclusion, materiality determination process, and the relationship between ESRS and other frameworks.
• ESRS 2 (General Disclosures) — Mandatory for all companies regardless of materiality outcomes. Covers governance (GOV 1-5), strategy (SBM 1-3), impact/risk/opportunity management (IRO 1-2), and metrics/targets (MDR). This is your baseline.

Environmental:

• E1 (Climate Change) — Transition plans, GHG emissions (Scope 1, 2, and 3), energy consumption, carbon pricing exposure, climate-related financial effects. Aligned with TCFD architecture but significantly more granular.
• E2 (Pollution) — Pollution of air, water, and soil; substances of concern; microplastics. Requires quantified data on pollutant releases.
• E3 (Water and Marine Resources) — Water consumption, withdrawal, and discharge by source and quality; water stress area exposure; marine ecosystem impacts.
• E4 (Biodiversity and Ecosystems) — Land-use change, species impacts, ecosystem condition, dependencies on ecosystem services. This is where most companies have the largest data gaps.
• E5 (Resource Use and Circular Economy) — Material inflows and outflows, waste generation, recycling rates, product design for circularity.

Social:

• S1 (Own Workforce) — Working conditions, equal treatment, health and safety, training, collective bargaining. Requires granular workforce data disaggregated by category, gender, and geography.
• S2 (Workers in the Value Chain) — Due diligence processes, identified impacts on value chain workers, remediation mechanisms. This is the standard that forces supply chain transparency.
• S3 (Affected Communities) — Impacts on communities where operations are located, including indigenous peoples, land rights, and local environmental effects.
• S4 (Consumers and End-Users) — Product safety, data privacy, accessibility, responsible marketing practices.

Governance:

• G1 (Business Conduct) — Anti-corruption, whistleblowing, political engagement, supplier payment practices, corporate culture.

Not all topical standards apply to every company. The double materiality assessment determines which are material — but the process of determining materiality is itself subject to assurance.

Double Materiality: Practical Implementation

Double materiality requires assessing both impact materiality (how your company affects people and the environment) and financial materiality (how sustainability matters create risks and opportunities that affect the company’s financial position). Both dimensions must be evaluated for every sustainability matter listed in the ESRS topical standards.

In practice, this means:

1. Map your value chain. Document upstream suppliers, own operations, and downstream activities with sufficient granularity to identify where impacts and dependencies arise. This is not a stakeholder engagement exercise alone — it requires operational data.
2. Identify impacts, risks, and opportunities (IROs). For each ESRS sustainability matter, assess actual and potential impacts (positive and negative), and financial risks and opportunities. Use severity and likelihood criteria as specified in ESRS 1.
3. Apply thresholds. Determine which IROs are material using documented, repeatable criteria. The thresholds must be defensible under assurance — this is not a subjective exercise.
4. Document the process. ESRS 2 IRO-1 and IRO-2 require disclosure of the materiality assessment process itself, including stakeholder engagement, data sources, and governance sign-off.
5. Engage the board. The materiality assessment is a governance matter. Board-level sign-off on the materiality determination is expected by assurance providers.

Value Chain Data Requirements

The CSRD’s value chain requirements represent the most significant operational challenge for most companies. Scope 3 greenhouse gas emissions are only one element. ESRS S2 requires information on working conditions, human rights due diligence, and remediation mechanisms for workers throughout your value chain. ESRS E4 requires assessment of biodiversity impacts across the value chain. ESRS E5 requires circularity data for materials sourced from suppliers.

ESRS 1 provides transitional relief: for the first three years, where value chain data is not available, companies may use estimates, sector averages, or proxy data, provided the limitations are disclosed. This relief expires. Companies that do not build supplier data collection systems now will face a compliance cliff.

Our recommendation: begin supplier engagement immediately. Issue structured data requests to your top-20 suppliers by revenue and by impact intensity. Build the collection infrastructure for sustainability data alongside your existing procurement systems.

Assurance Requirements

CSRD sustainability reports must be assured from the outset. For Phase 2 reporters, limited assurance is required for FY 2025 reports published in 2026. The European Commission intends to adopt reasonable assurance standards by October 2028, which would apply from FY 2028 onwards.

The practical implication is that your sustainability data must be subject to the same internal controls, evidence trails, and governance processes as your financial data. Assurance providers will test:

• The completeness and accuracy of the double materiality assessment
• The reliability of quantitative metrics (emissions, water, waste, workforce data)
• The consistency of narrative disclosures with underlying evidence
• The effectiveness of internal controls over sustainability data
• The appropriateness of estimation methodologies and assumptions

Data Architecture: Building Audit-Grade Systems

Companies that attempt to produce CSRD-compliant reports using spreadsheets and manual data collection will fail assurance. The data architecture required includes:

• Centralised data repository with defined data ownership, input validation, and change controls
• Automated data feeds from operational systems (energy management, HR, procurement, EHS)
• Calculation engines with documented methodologies, emission factors, and conversion assumptions
• Evidence management — source documents, supplier certificates, third-party data, and audit trails linked to every reported metric
• Internal controls — maker-checker processes, variance analysis, management review, and documented sign-off at each reporting level
• XBRL tagging capability — CSRD reports must be filed in the European Single Electronic Format (ESEF) with XBRL taxonomy tags

Implementation Timeline: 2026 Quarter-by-Quarter

For companies reporting on FY 2025 under Phase 2, the following timeline applies:

Q1 2026: Finalise double materiality assessment. Confirm which ESRS topical standards are in scope. Appoint assurance provider and agree scope of engagement. Validate data collection systems and identify gaps.

Q2 2026: Complete FY 2025 data collection and consolidation. Run first-pass calculations for all quantitative metrics. Begin drafting narrative disclosures. Conduct internal review of value chain data quality.

Q3 2026: Assurance provider performs interim procedures. Address data quality issues identified. Finalise XBRL taxonomy mapping. Board review of draft sustainability statement.

Q4 2026: Finalise sustainability statement. Complete assurance engagement and obtain assurance opinion. Integrate sustainability statement into annual report. File in ESEF format. Publish.

If you are reading this in April 2026 and have not completed Q1 milestones, you are behind schedule. Immediate action is required.

UK SDR and ISSB Interoperability

UK companies face a converging regulatory landscape. The FCA’s Sustainability Disclosure Requirements (SDR) impose anti-greenwashing obligations and sustainability labelling requirements on FCA-authorised firms. The UK government is progressing endorsement of ISSB S1 and S2 standards, likely to become mandatory for large UK companies from approximately 2027.

The good news: there is substantial overlap between CSRD/ESRS, ISSB S1/S2, and UK SDR requirements. EFRAG and the ISSB have published interoperability guidance showing that compliance with ESRS provides a strong foundation for ISSB compliance. The climate disclosures under ESRS E1 are broadly aligned with ISSB S2, and the general disclosure requirements in ESRS 2 map well to ISSB S1.

The strategic approach is to design your sustainability reporting architecture once, with sufficient granularity to satisfy the most demanding framework (CSRD/ESRS), and then map outputs to ISSB and UK-specific requirements. Avoid building separate compliance silos for each framework.

Board-Level Implications

CSRD is not a reporting exercise. It is a governance obligation. The sustainability statement is part of the management report, which means it carries the same legal weight as the financial statements. Directors are personally accountable for the accuracy and completeness of the information disclosed.

Boards must ensure they have:

• Adequate sustainability expertise at board level or through advisory arrangements
• Clear delegation of responsibility for sustainability reporting, with defined accountability
• Oversight of the double materiality assessment and its outcomes
• Understanding of the assurance process and its implications for internal controls
• A transition plan that is credible, science-based, and aligned with disclosed targets