The Corporate ESG Reporting Directive (CSRD) expands ESG Reporting obligations to thousands of European companies starting in January 2024. If you're a GRC leader at an organization operating in or selling into EU markets, you're facing a crucial question: does your company fall under CSRD's scope, and if so, which compliance path applies to you?
The answer depends on three variables: your company's size, listing status, and timeline. Here's how to make the right decision.
The Decision You're Facing
CSRD replaces the Non-Financial Reporting Directive (NFRD) with a phased rollout that brings different company categories into scope at different times. Your compliance obligation isn't binary. You need to determine:
- Whether you're subject to CSRD at all.
- Which reporting timeline applies to your organization.
- Whether simplified reporting standards are available to you.
Getting this wrong means either over-investing in premature compliance infrastructure or missing your actual reporting deadline.
Key Factors That Affect Your Choice
Company size thresholds. CSRD applies to companies meeting at least two of three criteria: 250 or more employees, a balance sheet total exceeding €20 million, or turnover exceeding €40 million. This represents a significant expansion from the previous 500-employee threshold under NFRD.
Listing status. Public interest entities face different timelines than unlisted companies. If you're listed on an EU-regulated market, you enter scope earlier.
SME classification. Listed SMEs get access to simplified reporting standards, but they're not exempt. The directive distinguishes between listed SMEs (which must comply) and the smallest organizations (which remain exempt).
Geographic footprint. If you're a non-EU company with significant EU operations or subsidiaries, you may have reporting obligations through those entities.
Path A: Full CSRD Compliance Starting January 2024
Choose this path if: You're a large company (meeting the size thresholds above) that was already subject to NFRD, meaning you're a public interest entity with more than 500 employees.
What this means: You must include ESG Reporting as part of your management report for the 2023 financial year, with the report due in 2024. This isn't a separate sustainability document anymore. It's integrated into your annual report and subject to the same governance standards.
Your immediate actions:
- Establish dual materiality assessment processes. You'll report both how sustainability issues affect your business (financial materiality) and how your operations affect people and the environment (impact materiality).
- Prepare for limited assurance audits. Management becomes liable for ESG Reporting accuracy, and external assurance is mandatory, though initially at a limited level.
- Implement ESEF-compliant digital tagging. Your sustainability data must be machine-readable and formatted according to the European Single Electronic Format Regulation so it can feed into the European Single Access Point platform.
- Build reporting infrastructure around EFRAG standards. The European Financial Reporting Advisory Group is developing the detailed reporting standards you'll follow.
Critical requirement: Your sustainability report must cover intangible assets including human and intellectual capital, provide both retrospective and forward-looking disclosures, and address governance factors with specific targets and progress metrics.
Path B: Phased Compliance Starting January 2025
Choose this path if: You're a large company meeting the size thresholds (250+ employees, plus balance sheet or turnover criteria) but you weren't previously subject to NFRD because you're not a public interest entity or you fell below the old 500-employee threshold.
What this means: You have an extra year to prepare. Your first reporting obligation covers the 2024 financial year, with the report due in 2025.
Your immediate actions:
- Use 2024 as a dry-run year. Start collecting sustainability data and testing your dual materiality assessment even though you're not required to publish yet.
- Observe how Path A companies handle their first CSRD audits. You'll benefit from seeing what auditors focus on and where early adopters struggle.
- Build your data processing register now. Don't wait until 2024 to start tracking the information flows you'll need for comprehensive ESG Reporting.
- Align your existing ESG initiatives with CSRD structure. If you're already doing voluntary ESG Reporting, map those efforts to EFRAG standards to identify gaps.
Path C: Simplified SME Standards Starting January 2026
Choose this path if: You're a listed SME that doesn't meet the large company thresholds.
What this means: You enter scope on January 1, 2026, and the directive provides for simplified reporting obligations to minimize your compliance burden. The exact nature of these simplifications is still being defined through EFRAG's standard-setting process.
Your immediate actions:
- Monitor EFRAG's SME-specific standard development. These standards will determine what "simplified" actually means in practice.
- Assess whether voluntary early adoption makes sense. Some listed SMEs may choose to adopt earlier to meet investor expectations or competitive positioning needs.
- Build sustainability data collection incrementally. You have more time, but don't ignore the foundational work of identifying your material sustainability impacts.
Important note: If you're an unlisted SME below the large company thresholds, you remain exempt from CSRD. However, if you're in the supply chain of companies that must report, expect sustainability due diligence requirements to flow down to you through vendor risk management programs.
Summary Matrix
| Company Type | Employee Count | First Report Due | Reporting Standard | Assurance Required |
|---|---|---|---|---|
| Large, previously under NFRD | 500+ | 2024 (FY 2023) | Full CSRD via EFRAG | Limited assurance |
| Large, newly in scope | 250+ (plus size criteria) | 2025 (FY 2024) | Full CSRD via EFRAG | Limited assurance |
| Listed SME | Below large company threshold | 2026 (FY 2025) | Simplified CSRD standards | Limited assurance |
| Unlisted SME | Below large company threshold | Exempt | N/A | N/A |
The compliance path you're on determines your timeline, but it doesn't change the fundamental shift CSRD represents. ESG Reporting now carries the same weight as financial reporting, with management liability and audit requirements to match. Your GRC framework needs to treat ESG data with the same rigor you apply to financial controls.
If you're uncertain which path applies to your organization, the question to answer first is whether you meet the large company criteria across at least two of the three size metrics. That single determination drives everything else.
