CSRD Compliance after the Omnibus: A Step-by-Step Reporting Plan for In-Scope Companies

From financial years starting on or after 1 January 2027, the duty covers undertakings and groups with an average of more than 1,000 employees and a net turnover of more than EUR 450 million, both values together. Directive (EU) 2026/470 amends the CSRD, and how that reporting regime works is set out where the Corporate Sustainability Reporting Directive (CSRD) is explained.

This plan gives seven steps, each with its article, then the dates, the dated cost estimates and the support services; in that order they answer the readiness and implementation question.

What Compliance with the CSRD Requires of an In-Scope Company

An in-scope undertaking complies with the CSRD when its management report contains a clearly identifiable sustainability statement prepared under the ESRS, marked up once mark-up rules exist, and published within 12 months of the balance sheet date together with a limited assurance opinion. The duties sit in Directive 2013/34/EU as amended by the CSRD, Directive (EU) 2022/2464. Companies are bound by national law: Directive (EU) 2026/470, in force since 18 March 2026, provides that "Member States shall bring into force the laws, regulations and administrative provisions necessary to comply with Articles 1, 2 and 3 by 19 March 2027" (Article 5(1)).

The content of the statement is defined in Article 19a(1) of the consolidated Directive 2013/34/EU: "information necessary to understand the undertaking's impacts on sustainability matters, and information necessary to understand how sustainability matters affect the undertaking's development, performance and position". That two-sided content is why materiality comes before any disclosure. Directive (EU) 2026/470 kept this wording; what the Sustainability Omnibus changed in the CSRD has its own page.

The Steps at a Glance

The plan runs in seven steps, from the scope check to publication, and each step answers a provision of Directive 2013/34/EU or of Delegated Regulation (EU) 2026/1563.

Table 1 maps each step to its requirement, its provision and the page that covers it.

Step 1: Confirm the Company Is above Both Size Values

An undertaking is in scope from financial years starting on or after 1 January 2027 only if it exceeds a net turnover of EUR 450 million and an average of 1,000 employees during the financial year, both conditions together, individually under Article 19a(1) or for a group on a consolidated basis under Article 29a(1) of Directive 2013/34/EU, as replaced by Article 2(4)(a) and 2(5)(a) of Directive (EU) 2026/470. Exceed means more than: exactly 1,000 employees or exactly EUR 450 million is not in scope. Wave 1, the large public-interest entities and parents with more than 500 employees, reports for financial years 2024 to 2026 only (CSRD Article 5(2)(a) as amended by Article 3(1)(a)(i) of Directive (EU) 2026/470). For financial years starting between 1 January 2025 and 31 December 2026, Member States may exempt wave-1 undertakings not exceeding EUR 450 million net turnover or 1,000 employees (Article 3(1)(c)).

The check follows national law until a Member State transposes Directive (EU) 2026/470, and it is run for each group entity and for the group. How the employee average and net turnover are counted is set out under both size values of the CSRD thresholds.

Step 2: Gap Analysis against the Standard Set That Applies

A gap analysis compares the data and policies the company already has with the disclosure requirements of the ESRS set it will apply: Delegated Regulation (EU) 2026/1563, which enters into force on 10 November 2026 and is mandatory for financial years beginning on or after 1 January 2027. The revised ESRS of 3 July 2026 replace Annexes I and II of Delegated Regulation (EU) 2023/2772 and do not repeal it.

For financial year 2026, Article 2(1) lets a reporter choose (a) the 2023 set as last amended by Delegated Regulation (EU) 2025/1416 or the 2026 set, or (b) the 2023 set with eight reliefs from the 2026 ESRS 1; the statement states the version applied (Article 2(2)). Every code in the gap list carries its set: gross Scope 1, 2 and 3 GHG emissions are E1-6 in the 2023 set and E1-8 in the 2026 set. The French AMF's thematic file on sustainability reporting of 7 February 2024, which does not mention the Omnibus, lists gap analysis among the project elements.

Step 3: Assess Which Sustainability Topics Are Material

The materiality assessment decides which sustainability topics the statement covers: a matter is material when it meets the criteria for impact materiality or financial materiality, or both (ESRS 1 paragraph 28 in the 2023 set), and the 2026 set runs it in two steps, first the topics tied to material impacts, risks and opportunities, then the information on each (ESRS 1 paragraph 25). The five working rules of the 2026 ESRS 1 are listed below.

• Start point: in general, the assessment of impacts (paragraph 36).
• Evidence: reasonable and supportable information without undue cost or effort; no duty to assess every possible impact, risk and opportunity (paragraph 32).
• Method: a qualitative analysis may be sufficient (AR 13).
• Groups: assessed at consolidated level, regardless of legal structure (paragraph 55).
• Output: information that is not material "shall not" be disclosed, except supplementary information under section 8.2 (paragraph 24).

Neither set requires a materiality matrix, and the limited assurance opinion covers the process used to identify the reported information (Article 34(1)(aa) of Directive 2013/34/EU). EFRAG's guidance IG 1 to IG 3 was issued on 31 May 2024 for the 2023 set and is not updated for Delegated Regulation (EU) 2026/1563, and the ESRS Q&A platform has been on hold since the end of 2025, according to EFRAG's implementation support page. Their status is tracked under EFRAG guidance on material topics.

Step 4: Data, Internal Controls and Value-Chain Requests

Data work turns each material topic into datapoints with an owner, a source, a calculation method and an internal control, because the statement goes to limited assurance before it is published. The EFRAG cost-benefit analysis of December 2025 attributes 20 % of internal effort to the materiality assessment, 20 % to preparing disclosures and about 15 % to understanding the standards.

A protected undertaking is a value-chain undertaking that, on its balance sheet date, does not exceed an average of 1,000 employees during the preceding financial year (Articles 19a(3) and 29a(3) of Directive 2013/34/EU as amended by Article 2(4)(b) and 2(5)(b) of Directive (EU) 2026/470). It may decline requests for information beyond the standards for voluntary use adopted under Article 29ca, now Delegated Regulation (EU) 2026/1560. The limited assurance opinion must fully respect that right to decline (Article 34(2a), inserted by Article 2(12)(b)).

Step 5: Prepare the Disclosures under the Revised Standards

Disclosures are drafted only for material topics, with the ESRS 2 general disclosures and the topical standards that the assessment selected, in the version stated for the financial year. The 12 standards (ESRS 1, ESRS 2, E1 to E5, S1 to S4 and G1) exist in both sets, adopted under Article 29b of Directive 2013/34/EU and applying directly. Policies, actions, targets and metrics follow the GDR (GDR-P, GDR-A, GDR-T, GDR-M) in the 2026 set, which renamed the minimum disclosure requirements (MDR) of the 2023 set.

The 2026 set splits its phase-ins between three populations: wave-1 undertakings with net turnover above EUR 450 million and more than 1,000 employees (ESRS 1 paragraph 125), other wave-1 undertakings (paragraph 126) and other undertakings (paragraph 127). Which items can wait, and for whom, is listed under phase-in provisions for the disclosures.

Step 6: The Statement in the Management Report and Its Mark-Up

The disclosures form the sustainability statement, a dedicated and clearly identifiable section of the management report (Article 19a(1) and 29a(1), second subparagraphs, of Directive 2013/34/EU), not a separate sustainability report.

The management report is prepared in the electronic reporting format of Article 3 of Delegated Regulation (EU) 2019/815 (ESEF). Under Article 29d of Directive 2013/34/EU, as replaced by Article 2(9) of Directive (EU) 2026/470, undertakings "shall not be required to mark up their sustainability reporting" until marking-up rules are adopted in that Delegated Regulation.

No such marking-up rules are adopted as of 29 October 2026. The taxonomy and the ESEF route are covered under digital tagging of the statement.

Step 7: Limited Assurance and Publication

The statement is assured at the limited level only (Article 34(1), second subparagraph, point (aa), of Directive 2013/34/EU as replaced by Article 2(12)(a) of Directive (EU) 2026/470), and the management report is then published within a reasonable period not exceeding 12 months after the balance sheet date together with the assurance opinion (Article 30(1)). The four objects of the opinion are listed below.

• Compliance with the Directive, including the standards adopted under Article 29b.
• The process carried out to identify the information reported.
• Compliance with the mark-up requirement of Article 29d.
• Compliance with Article 8 of Regulation (EU) 2020/852.

The provider is by default the statutory auditor or audit firm of the financial statements; Member States may allow another statutory auditor (Article 34(3)) or an independent assurance services provider (Article 34(4)). A public-interest entity's statutory auditor may not also prepare its sustainability reporting (Article 5(1), second subparagraph, point (c), of Regulation (EU) No 537/2014 as replaced by Article 4(2)(a) of Directive (EU) 2022/2464).

Penalties are set by each Member State: Article 51 of Directive 2013/34/EU requires them to be "effective, proportionate and dissuasive" and sets no EU amount. National enforcers and penalty rules are covered under penalties for late or missing publication.

Timing the Plan: Which Financial Year Comes First

For a company newly in scope, the first reporting year is the first financial year starting on or after 1 January 2027, reported in 2028, a date set by the Stop-the-clock Directive (EU) 2025/794 and kept by Directive (EU) 2026/470. The rule sits in CSRD Article 5(2), first subparagraph, point (b).

The EU limited-assurance standard is not adopted as of 29 October 2026 (due by 1 July 2027 under Article 26a(3) of Directive 2006/43/EC as replaced by Article 1(3) of Directive (EU) 2026/470; 1 October 2026 before Directive (EU) 2026/470). Until then, Member States may apply national assurance standards, procedures or requirements (Article 26a(2)). The CEAOB adopted technical advice on 25 September 2026 that proposes an EU standard based on ISSA 5000, an IAASB standard that is not EU law.

Article 29e of Directive 2013/34/EU, inserted by Article 2(10) of Directive (EU) 2026/470, requires a Commission portal with information, guidance and templates, with no deadline. The Commission CSRD page was last updated on 3 July 2026, and its FAQ notice C/2024/6792 of 7 August 2024 predates the Omnibus. The dates in force for a company follow the Member State laws that set the first financial year.

Table 2 lists the six dates that frame the plan, as of 29 October 2026.

What a Reporting Programme Costs: Dated Public Estimates

The public cost figures for CSRD reporting are dated estimates from the Commission and from an EFRAG cost-benefit study, and each refers to an earlier text than the law now in force: the 2021 proposal, the 2025 proposal COM(2025) 81 or EFRAG's technical advice of December 2025. The Commission's impact assessment SWD(2021) 150 of 21 April 2021 estimated preparer costs for the original proposal at EUR 1,200 million one-off and EUR 3,600 million per year across all preparers. The staff working document SWD(2025) 80 of 26 February 2025, on proposal COM(2025) 81, used cost inputs of EUR 65,000 for reporting and EUR 120,000 for audit per year for an undertaking with more than 1,000 employees.

The EFRAG study, dated December 2025, drew on 158 preparers, 106 with quantitative estimates, and assessed EFRAG's advice, not Delegated Regulation (EU) 2026/1563. Its median first-year cost for wave-1 preparers under the 2023 set is EUR 287,000 below 10,000 employees and EUR 1,972,000 above, with recurring costs of EUR 202,000 and EUR 1,365,000 per year. Table 3 gives each figure with its source and what it measures.

Estimates, not prices; none refers to Directive (EU) 2026/470 or Delegated Regulation (EU) 2026/1563. Sources: SWD(2021) 150, SWD(2025) 80, EFRAG cost-benefit analysis.

Support for the Plan: Checklist, Software, Consultants and Training

Four services support the steps above, and each has its own page here: a readiness checklist, reporting software, consultants and training. Table 4 lists the four pages with the question each answers and the legal fact behind it.

What CSRD Compliance Does Not Cover

CSRD compliance in this sense applies only to undertakings and groups that exceed both values or report under Article 40a, and it does not require any certificate, licence or listed tool.

Non-EU Groups with EU Turnover

A third-country group reports under Article 40a(1) of Directive 2013/34/EU, as amended by Article 2(13) of Directive (EU) 2026/470, when its Union net turnover exceeds EUR 450 million in each of the last two consecutive financial years and it has an EU subsidiary or branch with net turnover above EUR 200 million in the preceding financial year, from financial years starting on or after 1 January 2028. The group report is covered under CSRD for non-EU companies.

An EU subsidiary of a US or other non-EU group that itself exceeds both values follows Steps 1 to 7 for its own statement.

Companies below the Values: The Voluntary Route

Undertakings that do not exceed both values have no CSRD reporting duty for financial years starting on or after 1 January 2027, and their main reporting task is answering value-chain requests within the cap.

The voluntary standard (VS, formerly VSME) is Annex I of Delegated Regulation (EU) 2026/1560, in force since 24 September 2026, and is voluntary; its modules are set out under the voluntary standard (VS, formerly VSME).

Does Compliance Need a Certificate or a Licence?

No: as of 29 October 2026 there is no EU certification or approved list for CSRD or VSME software, no EU licence for CSRD consultants and no mandatory training for preparers; statutory training rules apply only to statutory auditors who assure sustainability reporting. Those auditors need at least eight months of practical training on sustainability assurance (Article 10(1) of Directive 2006/43/EC as amended by Directive (EU) 2022/2464).