What is the CSRD and what does it require?

CSRD stands for Corporate Sustainability Reporting Directive. The directive establishes which companies must disclose information about their environmental and social impacts, sustainability-related risks and opportunities, and how these matters are managed.

The information must be included in the management report, prepared in accordance with the applicable ESRS and subject to assurance by an auditor or another authorised assurance provider. The CSRD Directive must now be read together with its subsequent amendments, including the European directive adopted in February 2026.

The content of the report depends on double materiality, which considers both the company’s impacts on people and the environment and the financial effects that sustainability matters may have on the business.

The materiality assessment identifies the topics that must be covered in the report. Reporting therefore does not involve automatically completing every ESRS datapoint. Companies must determine which information is applicable, while complying with cross-cutting provisions and mandatory disclosure requirements.

CSRD sustainability reporting requires a process that connects the materiality assessment, data collection, controls, documentation and preparation of the final report. The quality of the result depends largely on how these activities are organised throughout the year.

For more information about the final document and the differences between mandatory and voluntary reporting, read our guide on what a sustainability report is and when it matters for companies.

CSRD 2026: latest regulatory updates

The changes to the CSRD regulatory framework affect three main areas: reporting deadlines, the number of companies directly subject to the requirements and the content of the reporting standards.

The postponement of reporting deadlines

The “stop-the-clock” directive, adopted in 2025, postponed the application of the reporting requirements by two years for companies that were expected to start reporting on the 2025 and 2026 financial years.

The postponement has given companies in the later reporting waves more time, but it has not removed the preparatory work that is already required. Collecting the necessary information involves several business functions and may require historical data, documented methodologies and supplier engagement.

A summary of the amendments and their timeline is available in our article on the Omnibus package and the “stop-the-clock” directive.

The new CSRD scope

Directive (EU) 2026/470, published on 26 February 2026 and effective from 18 March, amended the scope of the CSRD and several elements of the reporting framework. Member States must transpose it by 19 March 2027.

The new rules raise the application thresholds, remove the requirement for mandatory sector-specific standards and introduce a limit on the information that companies subject to the directive can request from smaller businesses in their value chains.

The reduction in the number of companies directly required to report changes the size of the regulated market, but it does not stop ESG data from moving between companies. A group subject to the CSRD must still have the information required to describe its impacts, risks and dependencies, including those associated with upstream and downstream activities.

The revision of the ESRS

On 3 July 2026, the European Commission adopted the revised ESRS. In addition to reducing the number of datapoints, the revision simplifies certain elements of the materiality assessment, removes several disclosure requirements and introduces greater flexibility in how the standards are applied.

According to the Commission’s estimates, the changes could reduce reporting costs for individual companies by more than 30%. At the time this article was updated, however, the revised standards were not yet applicable, as they still had to complete the European scrutiny process and be published in the Official Journal.

Companies already working on CSRD reporting must therefore verify which version of the standards applies to each reporting year. An updated regulatory matrix documents the references used and reduces the risk of applying new provisions before they become effective.

Which companies are subject to the CSRD?

Following the revision adopted in 2026, the CSRD applies to European companies that exceed both of the following thresholds:

• more than 1,000 employees on average;

• more than €450 million in annual net turnover.

The new scope is considerably narrower than the original version of the directive.

For non-EU groups, the new provisions apply to companies generating more than €450 million in net turnover within the European Union and operating through an EU subsidiary or branch that generates more than €200 million in EU turnover.

Determining whether an organisation falls within the scope should not be based solely on the figures of an individual legal entity. Corporate groups must also consider the consolidation perimeter, the position of the parent company, any exemptions available to subsidiaries and the presence of a non-EU ultimate parent.

Acquisitions, disposals and changes in employee numbers can also alter the applicable scope over time. Companies should therefore document the thresholds assessed each year and the corporate level at which reporting is performed.

First-wave companies that still meet the new thresholds must continue their reporting process. Companies that fall outside the revised scope must decide whether to stop reporting, adapt their process to a voluntary standard or retain part of the system they have already developed to respond to commercial and financial requests.

How the CSRD affects companies outside its direct scope

Being outside the direct scope of the CSRD does not mean being excluded from ESG data requests.

A smaller supplier may still be asked to disclose its emissions, energy consumption, material origins, workforce information or corporate policies. The request will depend on the material topics of the customer and on the supplier’s role within its value chain.

Similar data may also be requested by banks, insurance providers and international groups as part of risk assessments, access-to-finance processes or supplier qualification procedures.

The 2026 directive introduced a limit on value-chain information requests. Companies subject to the CSRD cannot ask businesses covered by this limitation for more information than is included in the European voluntary standard. This reduces the reporting burden, while confirming that some information will continue to be collected from companies that are not directly required to report.

On 3 July 2026, the Commission also adopted the voluntary standard connected to this limitation. It provides a shared reference for responding to requests from large customers and financial institutions, reducing the need to complete a completely different questionnaire for each stakeholder. This act will also become applicable after scrutiny by the European Parliament and the Council and its final publication.

Companies outside the direct scope should therefore measure how many ESG requests they receive, which indicators are requested most frequently and how much time is required to retrieve them. When requests are recurring, a structured voluntary reporting process can reduce duplicated work and accelerate responses to customers and financial institutions.

For more information about the voluntary framework for smaller companies, read our guide to the VSME reporting standards.

How to prepare for the CSRD and avoid reporting errors

The postponement of the CSRD deadline gives affected companies more time, but it does not resolve difficulties related to data availability, quality and traceability.

The information required may come from finance, human resources, procurement, production, logistics, property management and suppliers. The main source of complexity is the fragmentation of data sources and responsibilities, particularly when the information is collected only at the end of the reporting year.

Define the reporting perimeter and responsibilities

The first step is to connect legal entities, sites and activities to the reporting perimeter. A change in the consolidation perimeter or the opening of a new facility can affect the values included and undermine comparability with previous years.

For each piece of information, the company should identify who collects the data, who reviews it, which source is used and how frequently it must be updated. Separating data entry from approval strengthens internal controls and reduces the risk of errors or inconsistencies reaching the assurance stage.

Establish consistent data-collection rules

ESG data must remain comparable over time. Units of measurement, reporting periods, organisational boundaries and calculation methods should therefore be defined before data collection begins.

When calculating emissions, for example, companies must document activity data, emission factors, the sources used, any estimates and the consolidation criteria. When these rules are defined only at the end of the year, the number of corrections increases and it becomes more difficult to reconstruct how the results were calculated.

The classification of emissions is explained in our guide to Scope 1, Scope 2 and Scope 3 emissions. Companies that need to structure their calculation process can also use carbon footprint software to connect consumption data, emission factors, results and supporting documents.

Retain evidence and changes

The assurance process requires every reported figure to be traceable to its source. Energy invoices, exports from company systems, registers, contracts, certificates and supplier communications should be stored together with the data they support.

Changes must also leave a clear audit trail. A repository based solely on spreadsheets may contain the final figure, but it often does not show who changed it, why it was corrected or which version was ultimately approved.

Measure the quality of the process

The preparation of the report can be monitored through operational indicators such as:

• the percentage of information completed and approved;

• the proportion of data supported by evidence;

• the number of estimated or adjusted values;

• overdue activities by function or legal entity;

• the average time required to complete a request;

• unusual changes compared with the previous reporting year.

These controls help identify delays and gaps before the assurance stage, when correcting the process requires more time and involves a larger number of people.

CSRD penalties depend on the national legislation through which the directive is transposed. Software does not automatically guarantee compliance, but it can reduce operational risks such as missing data, inconsistent formulas, undocumented approvals and the loss of historical records.

To centralise data collection, controls and evidence, sustainability reporting software can help organise the work of different business functions and prepare information that is easier to verify.

Which software should companies choose to manage the CSRD in 2026?

The best software platforms for managing the CSRD in 2026 combine ESRS mapping, data collection, responsibility assignment, completion tracking and evidence management. They should also retain a history of changes and prepare information that can be verified efficiently.

The right choice depends on the structure of the company. A group with several legal entities and facilities will need to consolidate data across multiple reporting boundaries, while a less complex organisation may focus on internal data collection and the preparation of its first report.

Software comparisons should begin with measurable operational problems: the time needed to retrieve data, the percentage of missing information, the number of overdue requests, corrections made during assurance and the availability of supporting evidence. The number of features matters less than the platform’s ability to keep the process under control throughout the year.

What features should CSRD software include?

CSRD software should manage the full reporting process, from configuring the reporting perimeter to preparing data for assurance. This includes analysing the applicable ESRS, collecting information, assigning activities, monitoring deadlines and retaining supporting documentation.

The platform should clearly show which sections are complete, which require additional data and which are awaiting approval. A completion percentage makes it easier to identify the areas that could delay the finalisation of the report.

For corporate groups, the system should make it possible to analyse information at both consolidated and individual legal-entity, facility or geographical levels. It should also distinguish between actual data, estimates and adjustments, while retaining the methodologies used across reporting years.

Which tools help map the 12 ESRS and mandatory datapoints?

Tools for ESRS mapping should connect the 12 European Sustainability Reporting Standards, their disclosure requirements and the related datapoints to the company’s double materiality assessment.

Simply including the complete ESRS list within a platform is not enough. The software should help determine which information is applicable, who is responsible for providing it and which documents are needed to support it.

For each datapoint, the platform should show the owner, the relevant legal entity or site, the reporting period, the source, the methodology, the attached evidence and the approval status. It should also allow the mapping to be updated when the standards change, without losing the history of earlier versions.

An effective tool turns the ESRS datapoint list into an assignable and verifiable work plan. The company can see how much has been completed, which data is missing and which functions still need to contribute.

Which tools reduce the risk of CSRD errors and penalties?

No software can automatically guarantee CSRD compliance or eliminate the risk of penalties. Responsibility for the accuracy of the information and the correct application of the regulation remains with the company.

A platform can, however, reduce the operational conditions that increase the risk of non-compliance. These include missing data, the use of different formulas across legal entities, unavailable evidence, undocumented approvals and the application of outdated versions of the standards.

Deadline monitoring helps identify missing information before assurance begins. The change history makes it possible to reconstruct how the final figure was calculated, while evidence management connects each disclosure to the documents supporting it.

The most useful tools for reducing CSRD risk are therefore those that make data, methodologies, responsibilities and approvals traceable. The software should be supported by internal procedures, suitable expertise and periodic controls.

How to compare the best CSRD platforms in 2026

Before choosing a platform, companies should test it using a representative sample of real business data. A demonstration based solely on pre-populated screens is unlikely to show how the system manages missing information, adjustments, multiple legal entities or changes made after approval.

During the test, the company should verify that the software can:

• configure the corporate perimeter and applicable ESRS;

• assign datapoints and activities to the relevant owners;

• connect formulas, methodologies and supporting evidence;

• monitor the completion percentage;

• record changes and approvals;

• update standards while retaining historical records;

• export data and documents for assurance.

A good platform should also make it possible to reuse the same information for other standards or ESG requests. Sustainability reporting software aligned with the CSRD can connect the data used for CSRD reporting with the ESRS and with questionnaires received from customers or financial institutions.

How Metrikflow supports CSRD reporting

Metrikflow has already supported several companies in preparing for and managing their CSRD reporting requirements.

The platform enables companies to report through the ESRS, organising requirements, datapoints, activities, documents and evidence in a single environment. For every section, users can see which information is complete, which data is still missing and which content requires review.

A progress percentage shows the completion level of the reporting process. The teams involved can therefore monitor the status of the work without reconstructing it across separate spreadsheets, folders and email conversations.

Metrikflow allows companies to assign data and activities to responsible owners, connect evidence to reported information and retain a history of changes and approvals. The platform manages the datapoints required by the ESRS and supports the calculation of Scope 1, Scope 2 and Scope 3 emissions.

Connecting carbon footprint calculations with reporting reduces manual transfers between separate systems. Consumption data, emission factors, methodologies and results can be used directly within the reporting process, maintaining a clear connection between figures, sources and ESRS requirements.

The completion percentage does not constitute automatic certification of legal compliance. It is an operational indicator that helps identify missing information, documents and approvals before the reporting process is finalised.