The Regulatory Architecture: What CSRD Actually Requires

Adopted on 16 December 2022 as Directive 2022/2464, CSRD replaces the Non-Financial Reporting Directive (NFRD) that applied to roughly 11,700 EU companies. The new regime is fundamentally different in scope, granularity, and enforceability. Companies must report against the European Sustainability Reporting Standards (ESRS), developed by the European Financial Reporting Advisory Group (EFRAG), which comprise 12 standards spanning environmental, social, and governance topics — from climate change (ESRS E1) to business conduct (ESRS G1).

The reporting is not optional narrative. ESRS mandates approximately 1,100 individual data points across 82 disclosure requirements. Reports must be digitally tagged in XHTML format using the European Single Electronic Format (ESEF), and — this is the critical enforcement mechanism — they require limited assurance from an independent auditor, with the EU’s stated trajectory towards reasonable assurance by 2028.

CSRD reports are filed as part of the management report, not as a standalone sustainability report. This elevates ESG data to the same legal standing as financial statements, with the same director liability implications. Boards that have historically treated sustainability reporting as a communications exercise must fundamentally recalibrate.

Who Is in Scope — and When

CSRD applies in a phased rollout determined by company size, listing status, and domicile. The thresholds are unambiguous:

The extraterritorial provision under Article 40a of the Accounting Directive (as amended by CSRD) is particularly consequential for UK businesses post-Brexit. A UK-headquartered group with an EU subsidiary that meets the thresholds cannot simply instruct the subsidiary to file — the parent company must produce a consolidated sustainability report under ESRS, or demonstrate equivalent reporting under a framework the EU Commission recognises as adequate. As of April 2026, no equivalence determination has been granted to any non-EU jurisdiction.

The ESRS Standards: What Must Be Disclosed

The 12 ESRS standards are organised into cross-cutting standards (ESRS 1 and ESRS 2, which are mandatory for all in-scope companies), five environmental standards (E1–E5), four social standards (S1–S4), and one governance standard (G1). ESRS 2 requires a double materiality assessment — the outcome of which determines which of the topical standards (E1–E5, S1–S4, G1) a company must report against. However, climate (ESRS E1) has limited opt-out provisions; companies that determine climate is not material must provide a detailed explanation of why.

The standards demand forward-looking information: transition plans aligned with the 1.5°C pathway, biodiversity targets, workforce policies with quantitative metrics, and due diligence processes across the value chain. This is not a backward-looking compliance exercise. It requires companies to articulate strategy under sustainability constraints — something many organisations have never committed to in a legally auditable format.

Sector-specific standards are under development by EFRAG and expected to be adopted progressively from 2026. These will impose additional disclosure requirements tailored to high-impact sectors including oil and gas, mining, agriculture, and financial services.

Penalties and Enforcement

CSRD is transposed into national law by each EU Member State, meaning penalties vary by jurisdiction. However, the Directive requires that sanctions be “effective, proportionate and dissuasive.” In practice, this means:

• Germany’s transposition (Nachhaltigkeitsberichterstattungsgesetz) provides for fines up to €10 million or 5% of annual turnover for the most serious breaches.
• France’s transposition allows for director-level liability, including personal fines and potential criminal sanctions for knowingly false sustainability statements.
• The Netherlands has integrated CSRD enforcement into its financial markets authority (AFM) supervisory framework, treating sustainability misstatements with the same severity as financial misstatements.

Beyond regulatory penalties, the commercial consequences are equally significant. CSRD data feeds directly into the EU’s Sustainable Finance Disclosure Regulation (SFDR) and EU Taxonomy frameworks. Asset managers subject to SFDR will use CSRD disclosures to make investment allocation decisions. Non-compliance or low-quality reporting translates directly into restricted access to EU capital markets.

Impact on Non-EU Companies: The UK Dimension

For UK companies, CSRD creates a dual compliance challenge. First, any UK group with EU subsidiaries meeting the size thresholds will face direct CSRD obligations through those subsidiaries. Second, the UK’s own Sustainability Disclosure Requirements (SDR) framework, while less prescriptive, creates a parallel reporting obligation that is not identical to CSRD. Managing both regimes without duplication requires careful architectural planning of data systems and reporting processes.

The practical challenge is data infrastructure. CSRD’s approximately 1,100 data points demand granular, auditable information across environmental metrics, social KPIs, and governance practices — much of which sits in systems never designed for external reporting. Companies that began CSRD readiness programmes in 2023 are reporting 12–18 month lead times to establish reliable data pipelines. Those beginning now face significant execution risk for the 2025 and 2028 deadlines.

There is a strategic dimension as well. CSRD-mandated transition plans and double materiality assessments are not merely disclosure exercises — they force boards to confront strategic trade-offs that have historically been deferred. The companies that treat CSRD as a catalyst for strategic clarity, rather than merely a compliance burden, will extract disproportionate value from the process.

Common Pitfalls in CSRD Preparation

Having advised organisations across multiple jurisdictions on CSRD readiness, three recurring failure modes stand out. First, underestimating the double materiality assessment: this is not a desktop exercise but a structured stakeholder engagement process with documented methodology that auditors will scrutinise. Companies that short-cut the assessment find their entire reporting scope challenged at audit.

Second, treating CSRD as a sustainability team project. The data requirements span finance, HR, procurement, legal, and operations. Without C-suite sponsorship and cross-functional governance, programmes stall at the data-collection phase. The most effective implementations assign CSRD programme ownership to the CFO’s office, not the sustainability function.

Third, assuming existing ESG reports can be “upgraded” to ESRS compliance. The gap between voluntary frameworks (GRI, TCFD, CDP) and mandatory ESRS is substantial. While EFRAG has published interoperability guidance, ESRS requires specific metrics, formats, and assurance-ready evidence trails that voluntary reports rarely provide.