Assurance of CSRD Reporting: Limited Assurance, Who Provides It and What the Opinion Covers

The statutory auditor or audit firm that audits the financial statements gives the opinion, and each Member State may open two further routes. The EU limited-assurance standard is not adopted as of 29 October 2026 (due by 1 July 2027), and until it is, Member States may apply national assurance standards (Article 26a(2) of Directive 2006/43/EC). The opinion checks a reporting duty, and that duty is set out where the Corporate Sustainability Reporting Directive (CSRD) is explained.

This page sets out the required level and the deleted reasonable-assurance step, the objects of the opinion, who may give it, which standard an assurer applies today, the assurance report, the five tasks of the audit committee and the dated status. What readers search for as a "CSRD audit" is this assurance engagement.

Assurance Defined: The Opinion Required by Article 34

Assurance of sustainability reporting means, in Article 2(22) of Directive 2006/43/EC, the procedures that result in the opinion under Article 34(1), second subparagraph, point (aa) and Article 34(2) of Directive 2013/34/EU. The CSRD, Directive (EU) 2022/2464, built this split: its Article 3 inserted the assurance provisions into the Audit Directive, and its Article 1 placed the opinion in the Accounting Directive. The provisions therefore sit in two directives, listed below.

• Accounting Directive 2013/34/EU: Article 34 (the opinion, its objects and who gives it), Article 2(20) (the independent assurance services provider) and Article 30(1) (publication).
• Audit Directive 2006/43/EC: Article 2(22) (the definition), Article 24b (the key sustainability partner), Article 26a (assurance standards), Articles 27a and 28a (group assurance and the assurance report) and Article 39 (the audit committee).

The opinion is published together with the management report, which contains the sustainability statement, within a reasonable period not exceeding 12 months after the balance sheet date (Article 30(1) of Directive 2013/34/EU). The assurance changes of Directive (EU) 2026/470 reach companies through national law, because Member States must transpose its Articles 1 to 3 by 19 March 2027 (Article 5(1)). The amended wording of each provision can be read in Article 34 in the CSRD consolidated version and the acts it amends.

Limited Assurance Is the Only Required Level

Limited assurance is the only level the CSRD requires: Article 34(1), second subparagraph, point (aa) of Directive 2013/34/EU, as replaced by Article 2(12)(a) of Directive (EU) 2026/470, asks for a limited-assurance opinion and no longer foresees a move to reasonable assurance. The replaced point of Directive (EU) 2026/470 has been in force since 18 March 2026 and binds companies once national law transposes it, with a transposition deadline of 19 March 2027.

How a Limited Conclusion Differs from Reasonable Assurance

A limited-assurance conclusion is expressed in negative form: the assurer states that no matter has been identified to conclude that the subject matter is materially misstated (recital 60 of Directive (EU) 2022/2464). Under the same recital, a limited-assurance engagement involves fewer procedures than a reasonable-assurance engagement.

The higher level stays open to an undertaking that wants it. Under recital 60, an undertaking may choose reasonable assurance of its sustainability reporting, and it is then deemed to comply with the limited-assurance obligation.

The Deleted Reasonable-Assurance Step

Directive (EU) 2026/470 removed the Commission's power to adopt reasonable-assurance standards: Article 26a(3) of Directive 2006/43/EC, as replaced by its Article 1(3), no longer contains it, and recital 5 gives the reason, "To avoid an increase in the costs of assurance for undertakings". Recital 5 states the consequence in its own words: "the requirement to adopt reasonable assurance standards should be removed". The package's other changes are set out under what Omnibus I changed in the reporting and assurance rules.

Before Directive (EU) 2026/470, the second subparagraph of Article 26a(3), inserted by Article 3(15) of the CSRD, had the Commission adopt reasonable-assurance standards by 1 October 2028 after a feasibility assessment. That date was a deadline for the Commission, never an obligation date for companies. The Commission proposal COM(2025) 81 of 26 February 2025 had already proposed removing the empowerment, as the Commission described it in its letter to the CEAOB, together with removing the deadline for the limited-assurance standard and first issuing targeted guidelines by 2026. The adopted text instead set 1 July 2027 for the limited-assurance standard.

What the Assurance Opinion Covers

The limited-assurance opinion covers four objects under Article 34(1), second subparagraph, point (aa) of Directive 2013/34/EU as replaced by Directive (EU) 2026/470: compliance of the sustainability reporting with the Directive, including the standards adopted under Article 29b; the process the undertaking carried out to identify the information reported; compliance with the mark-up requirement of Article 29d; and compliance with Article 8 of Regulation (EU) 2020/852. Before Directive (EU) 2026/470, the first object referred to "standards adopted pursuant to Article 29b or Article 29c". The reference to Article 29c, the standards for listed SMEs, is gone. Table A lists the four objects and the limit that Article 34(2a) adds.

Article 29d of Directive 2013/34/EU, as replaced by Article 2(9) of Directive (EU) 2026/470, provides that undertakings "shall not be required to mark up their sustainability reporting" until rules on the marking-up are adopted in Delegated Regulation (EU) 2019/815, and no such rules are adopted as of 29 October 2026. The reported information itself sits in the management report, in the sustainability statement covered by the opinion.

The Opinion and Suppliers' Right to Decline Data

Article 34(2a) of Directive 2013/34/EU, inserted by Article 2(12)(b) of Directive (EU) 2026/470, requires Member States to ensure that the opinion is prepared in a manner that fully respects the right of value-chain undertakings not exceeding an average of 1,000 employees in the preceding financial year to decline information exceeding the standards for voluntary use referred to in Article 29ca.

Article 34(2a) reaches companies through national law, with the same transposition deadline of 19 March 2027 (Article 5(1) of Directive (EU) 2026/470).

Who May Give the Opinion

The opinion is expressed by the statutory auditor or audit firm that carries out the statutory audit of the financial statements (Article 34(1), second subparagraph, point (aa) of Directive 2013/34/EU), and Member States may open two further routes. Under Article 34(3), a Member State may allow a statutory auditor or audit firm other than the financial auditor to give the opinion. Under Article 34(4), it may allow an independent assurance services provider established in its territory, provided that provider is subject to requirements equivalent to those for statutory auditors in the eight areas listed below.

• Training and examination
• Continuing education
• Quality assurance
• Ethics and independence
• Appointment and dismissal
• Investigations and sanctions
• Organisation of work
• Reporting of irregularities

A Member State that allows independent assurance services providers must also allow a statutory auditor other than the financial auditor (Article 34(4)). Article 2(20) of Directive 2013/34/EU defines the independent assurance services provider as a conformity assessment body accredited under Regulation (EC) No 765/2008 for the specific conformity assessment activity referred to in Article 34(1), second subparagraph, point (aa).

Each option takes effect only through the national law of the Member State that uses it, and the tracker shows who may give the opinion in each Member State.

Which Standard the Assurer Applies Today

No EU assurance standard has been adopted as of 29 October 2026: the Commission must adopt limited-assurance standards by delegated act by 1 July 2027 (Article 26a(3) of Directive 2006/43/EC as replaced by Article 1(3) of Directive (EU) 2026/470), and until it does, Member States may apply national assurance standards, procedures or requirements (Article 26a(2)). A Member State communicates such national standards to the Commission at least three months before their entry into force. Before Directive (EU) 2026/470, the deadline for the Commission's limited-assurance standard was 1 October 2026.

The Committee of European Auditing Oversight Bodies (CEAOB) adopted its guidelines on limited assurance on sustainability reporting on 30 September 2024. The guidelines are non-binding, do not constitute a standard and do not override national pronouncements, and Member States may recommend or require their use. The CEAOB technical advice of 25 September 2026 (CEAOB 2026-026) proposes an EU standard based on ISSA 5000, effective for periods beginning on or after 15 December 2027. That date is advice to the Commission, not law.

ISSA 5000 is a standard of the International Auditing and Assurance Standards Board (IAASB), not EU law. The IAASB lists its EU adoption as "Under consideration subject to the outcome of the European Commission's development of a Delegated Act". The Commission's letters to the CEAOB of 7 March 2024 and 27 January 2026 describe a delegated act that would adopt limited-assurance standards based on the final version of ISSA 5000, with EU-specific add-ons and possible carve-outs.

The Assurance Report and Group Assurance

The assurance report is governed by Article 28a of Directive 2006/43/EC: it identifies the undertaking, the sustainability reporting, its date and period and the reporting framework, describes the scope including the assurance standards used, contains the opinion under Article 34(1), second subparagraph, point (aa) of Directive 2013/34/EU, and is signed and dated. Article 28a was inserted by Article 3(18) of the CSRD, and Directive (EU) 2026/470 did not amend it.

Under Article 27a(1) of Directive 2006/43/EC, the group auditor bears full responsibility for the assurance report on the consolidated sustainability reporting and evaluates and reviews the assurance work of other assurers for the group. Where an independent assurance services provider gives the opinion, that opinion is published together with the management report (Article 30(1) of Directive 2013/34/EU).

Duties of the Audit Committee

The audit committee oversees sustainability reporting and its assurance under Article 39(6), points (a) to (e) of Directive 2006/43/EC: it informs the board of the outcome of the assurance, monitors the reporting process including electronic reporting and the process to identify the information reported, monitors internal control and risk management, monitors the assurance and reviews the assurer's independence. These tasks were set by Article 3(27) of the CSRD and are not amended by Directive (EU) 2026/470. Member States may let the administrative or supervisory body as a whole, or a dedicated body, perform these functions (Article 39(4a)). Where an independent assurance services provider gives the opinion, the audit committee or a dedicated committee reviews and monitors that provider's independence (Article 34(4), second subparagraph of Directive 2013/34/EU).

Public-interest entities face two further rules in Regulation (EU) No 537/2014, as amended by Article 4 of the CSRD. The statutory auditor of such an entity may not prepare its sustainability reporting (Article 5(1), second subparagraph, point (c)), and assurance of sustainability reporting is excluded from the non-audit fee limit of Article 4(2) and needs no audit committee approval (Article 5(4)).

Where Assurance Stands on 2026-10-29

As of 29 October 2026, limited assurance is the only level in Directive 2013/34/EU as amended by Directive (EU) 2026/470, Member States have until 19 March 2027 to transpose its assurance changes, and the EU limited-assurance standard has not been adopted (due by 1 July 2027). Table B lists the dated steps from entry into force to the end of the third-country transition in 2030.

For an in-scope company, the CSRD compliance up to assurance steps run from scope through double materiality and the sustainability statement to the opinion.

Assurance in Depth: Standards and Providers

Two parts of the assurance framework have their own pages: the standards an assurer applies, and who may give the opinion on which conditions. Table C lists both.

What the Assurance Duty Does Not Cover

The CSRD assurance duty does not replace national supervision, does not reach voluntary reports and does not turn a training certificate into an assurance opinion.

Does an Assurance Opinion Replace Supervision?

No: the opinion is the assurer's, while penalties are set nationally under Article 51 of Directive 2013/34/EU, which requires them to be "effective, proportionate and dissuasive" and sets no EU amount. The national rules are covered under national supervision and penalties under the CSRD.

For issuers listed on an EU regulated market, the ESMA Guidelines on Enforcement of Sustainability Information (ESMA32-992851010-1815) apply to the enforcement by national competent authorities of sustainability information published from 1 January 2025.

Do Voluntary Reporters Need Assurance?

No: undertakings that report under Delegated Regulation (EU) 2026/1560 "are not obliged to seek assurance" (recital 5).

The CEAOB guidelines may be used for voluntary limited-assurance engagements. The standard those undertakings apply is the voluntary standard (VS, formerly VSME).

Is a Training Certificate the Same as Assurance?

No: the CSRD sets no EU licence or mandatory training for preparers and consultants, and assurance is the procedure that results in the Article 34 opinion (Article 2(22) of Directive 2006/43/EC).

Statutory training rules apply only to statutory auditors, with at least eight months of the practical training on assurance of sustainability reporting or other sustainability-related services (Article 10(1) of Directive 2006/43/EC as amended by the CSRD).

Courses for preparers are compared under CSRD training courses and certificates.