CSRD reporting obligations 2026: What will change in the legal requirements for companies

The most important facts in brief

Sustainability reporting is finally turning from an optional to a mandatory program for European SMEs and large corporations. With the extended CSRD reporting obligations that will take effect for many companies in 2026, the legal requirements for transparency in terms of sustainability, the environment and social responsibility are increasing massively. The EU is pursuing the clear goal of putting financial and non-financial performance indicators on an equal footing in legal and strategic terms. Companies that fail to prepare their controlling departments in good time for the implementation of the new data requirements risk not only compliance violations, but also a loss of trust among investors and customers.

From the NFRD to the CSRD: The new era of sustainability reporting

For a long time, the Non-Financial Reporting Directive (often referred to as the Financial Reporting Directive NFRD) provided the framework. In Germany, this old CSR Directive was transposed into national law by the CSR-RUG (CSR Directive Implementation Act). The problem: the regulations only affected a very small group of large capital market-oriented companies.

With the introduction of the Corporate Sustainability Reporting Directive, this landscape is changing fundamentally. This new directive replaces the NFRD, drastically expands the group of companies affected and enormously tightens the content review obligation.

The Corporate Sustainability Reporting Directive (CSRD) at a glance

The primary aim of the legislation is to effectively prevent greenwashing and provide stakeholders with standardized, comparable data. The focus is no longer just on soft declarations of intent, but on hard, auditable KPIs.

Companies must disclose in detail how their business models affect the environment and, conversely, what financial risks climate change poses for their own business model (principle of double materiality). Controlling is thus moving to the center of corporate management, as non-financial data must now be recorded and externally audited with the same rigor as the traditional annual financial statements.

Current developments: “Stop the Clock” and omnibus initiative

The regulatory landscape in Brussels is highly dynamic. In order not to overburden the economy in economically challenging times, European politicians have recently made some adjustments.

One prominent example is the so-called “Stop the Clock” decision. This postpones the publication of certain sector-specific standards (which were actually planned earlier) by two years to mid-2026. At the same time, the Omnibus Directive aims to streamline general reporting obligations at EU level by around 25% in order to avoid unnecessary bureaucracy and duplication.

But beware: despite this selective relief through “Stop the Clock” or the omnibus initiative, the strict foundation of the CSRD reporting obligations remains untouched. The time buffer should urgently be used by companies to set up internal systems for data collection now.

Scope of the CSRD: Who is required to report in 2026?

The EU is gradually extending the scope of the CSRD in order to give businesses the time they need to adapt. Exactly who has to report and when depends on the size and capital market orientation. For controlling, this means that it is absolutely essential to assess your own status quo in good time.

Thresholds: Large companies and the extension of the obligation (wave 2)

While in so-called wave 1 (for the 2024 financial year, 2025 reports) initially only those groups that were already subject to the old NFRD were required to report, wave 2 now brings the real bang for the buck for the broad market.

From the 2025 financial year – with the publication of the reports in 2026 – tens of thousands of additional large companies across Europe will fall within the scope of application. A company is considered large if it exceeds at least two of the following three thresholds on two consecutive reporting dates:

• more than 250 employees
• more than 50 million euros in net sales (recently increased by the EU Commission due to inflation)
• more than 25 million euros in total assets

Indirect impact on small and medium-sized enterprises (SMEs) in the supply chain

Even if small and medium-sized enterprises (SMEs) are often not directly legally obliged at first glance, they are feeling the effects of the extension of the directive enormously. The reason for this is the so-called “trickle-down effect” in the supply chain.

Large corporations require detailed Scope 3 emissions data and ESG key figures from their suppliers in order to be able to complete their own sustainability reports in compliance with the law. This means that SMEs are in fact indirectly forced to provide this information. For capital market-oriented SMEs, the direct, legal reporting obligation will then take effect in wave 3 at the latest.

ESRS and ESG: The content requirements for the reports

A mere declaration of intent is no longer sufficient for comparable sustainability reporting across Europe. With the European Commission’s new requirements, there is now a strict, binding set of rules that forms a uniform basis for all companies concerned.

European Sustainability Reporting Standards (ESRS) as a new basis

At the heart of the new reporting requirements are the European Sustainability Reporting Standards (ESRS). These standards, which were largely developed by the EFRAG (European Financial Reporting Advisory Group) and published in the Official Journal, are now legally binding.

In future, affected companies will have to disclose detailed information on environmental, social and governance (ESG) aspects. However, in order not to overburden the economy, the EU has built in pragmatic buffers: The so-called “Stop the Clock” directive postpones the introduction of strict industry-specific standards until 2026. Flanked by the administrative relief provided by the omnibus initiative, this gives companies valuable time to set up their internal data structures in an orderly manner.

Implementation of CSRD in controlling: practice and synergies

In practice, CSRD implementation is no longer just a PR issue, but a strategic task for the entire corporate management. It requires the full commitment of management and controlling in order to efficiently bundle the required data strands across departments.

Data collection: The link between CSRD, EU taxonomy and LkSG

Efficient reporting can only be achieved by intelligently linking existing regulations. On the one hand, a direct link must be established with the EU taxonomy, which measurably defines which economic activities are considered environmentally sustainable.

On the other hand, there are enormous synergies with the Supply Chain Due Diligence Act (LkSG): if human rights due diligence obligations along the supply chain are checked and documented anyway, these data points can be seamlessly transferred to the CSRD report. This avoids duplication of work.

Implementation aids for efficient reporting

The pressure to act is also growing from outside: as part of sustainable finance, banks, investors and insurance companies are increasingly demanding reliable ESG data for lending and policy issuance. Current studies show that there are still large data gaps, particularly in the SME sector. In order to close these gaps, companies should make use of EFRAG’s official implementation aids and professional controlling software solutions that prepare ESG data automatically and in an audit-proof manner at an early stage.

Keeping an eye on risks and stakeholder expectations

The introduction of the new reporting obligations must not be misunderstood by management as a mere compliance exercise. Rather, it is about making fundamental business risks measurable and strategically managing the massive increase in pressure from external stakeholders.

Sustainable finance and the role of investors

Investors, major customers and business partners – a company’s key stakeholders – are increasingly demanding transparent and reliable ESG data. The reason for this is obvious: banks and investors must make their own portfolios “greener” as part of the EU’s sustainable finance strategy.

For SMEs, this means that lending and interest rates are increasingly linked to their own sustainability performance. Those who report incompletely or have weak KPIs not only risk higher financing costs, but also exclusion from important supply chains and public tenders. Transitory and physical climate risks thus translate directly into hard, financial business risks.

Liability and responsibility of the management

The CSRD raises sustainability reporting to exactly the same legal level as traditional financial reporting. This is accompanied by a significant increase in responsibility for managing directors, management boards and supervisory boards.

The requirements of the European directive must be transposed into national law by the member states in a binding manner. A breach of this applicable law – be it through greenwashing, incomplete data or late submission – is no longer a trivial offense. There is a risk of severe fines and, in serious cases, even personal liability risks for the C-level. This makes it all the more important for reports to be subject to strict external auditing (assurance) by auditors in future.

Frequently asked questions

What exactly do the new sustainability reporting requirements include?

They go far beyond a voluntary declaration of intent. Affected companies must use measurable data points to demonstrate the impact of their actions on the environment and society and, conversely, the financial risks that climate change poses to their own business model.

Are there exceptions for certain industries?

The overarching reporting standards apply to all obligated companies. However, an original EU proposal to immediately introduce in-depth sector-specific requirements in parallel was postponed. This gives businesses more time to set up the data structures.

What role do social aspects play in reporting?

Companies must transparently document how they promote fair working conditions and ensure compliance with human rights along their value chain. Recording processes can be perfectly combined with the obligations arising from the Supply Chain Due Diligence Act (LkSG).

Are politicians also offering relief for SMEs?

Yes. In order to reduce the bureaucratic burden and avoid overregulation, the EU has introduced targeted simplifications. Initiatives such as the Omnibus I package aim to streamline duplicate reporting obligations and reduce the administrative burden in controlling.