Two new EU directives are rewriting what “sustainability reporting” means — and the scope is far wider than most companies realise.
The Corporate Sustainability Reporting Directive (CSRD) and the Corporate Sustainability Due Diligence Directive (CSDDD) together represent the most significant expansion of mandatory sustainability disclosure in EU history. If your company sells into the EU, has EU subsidiaries, or sits in the supply chain of a company that does, these rules likely apply to you sooner than you think.
Overview
What CSRD and CSDDD Actually Require
CSRD replaces the earlier Non-Financial Reporting Directive and dramatically widens both the number of companies in scope and the depth of what must be reported. Instead of a short narrative statement, companies must now report against detailed European Sustainability Reporting Standards (ESRS), covering environmental, social, and governance topics in a structured, auditable format.
CSDDD operates alongside CSRD but with a different focus: due diligence. It requires large companies to identify, prevent, and account for actual and potential adverse human rights and environmental impacts across their own operations, subsidiaries, and value chains — not just to report on them, but to actively address them.
Double Materiality
Companies must report both how sustainability issues affect their financial performance, and how their operations affect people and the environment.
Mandatory External Audit
Sustainability disclosures must be independently assured, initially at limited assurance level, moving toward reasonable assurance over time.
Digital Tagging Requirements
Reports must be published in a machine-readable digital format, tagged according to a common EU taxonomy for comparability.
Value Chain Due Diligence
Under CSDDD, obligations extend beyond a company’s own operations into its suppliers, contractors, and business partners.
Phased Application Timeline
Wave 1
Large public-interest entities already subject to reporting rules
Wave 2
Large companies meeting size thresholds not previously in scope
Wave 3
Listed SMEs, with a lighter-touch reporting standard
Wave 4
Non-EU companies with substantial EU turnover
Scope
Who Is Actually Caught by These Rules?
The most common mistake companies make is assuming CSRD and CSDDD are “EU company” problems. In reality, both directives explicitly extend to non-EU companies once they cross certain EU-derived turnover thresholds — meaning a US, UK, or Asia-headquartered business with meaningful EU sales can find itself in scope even without an EU subsidiary.
| Company Type | CSRD Applies | CSDDD Applies |
|---|---|---|
| Large EU public-interest entity | Yes — earliest wave | Yes, if size thresholds met |
| Large EU private company | Yes, phased in | Yes, if size thresholds met |
| Listed SME (EU) | Yes, lighter standard | Generally out of scope |
| Non-EU company, high EU turnover | Yes, if threshold met | Yes, if threshold met |
| Supplier to an in-scope company | Indirect — data requests | Indirect — due diligence flows down |
Even companies below the direct thresholds are affected indirectly. In-scope customers and business partners will increasingly request ESG data as part of their own CSRD and CSDDD compliance — meaning the practical reporting burden reaches far beyond the companies formally required to report.
Consequences
The Cost of Getting It Wrong
Non-compliance with CSRD and CSDDD is enforced at the member-state level, meaning penalty regimes vary — but all are designed to be a meaningful deterrent, not a token fine.
5%
Maximum penalty as a share of annual global turnover under several member-state CSDDD implementations
Civil
CSDDD introduces civil liability — affected parties can sue for damages caused by unaddressed adverse impacts
Beyond formal penalties, inaccurate or unsubstantiated sustainability disclosures under CSRD carry the same reputational and regulatory exposure as any other misleading green claim — auditors, investors, and regulators are now all reading the same report.
Getting Ready
Where to Start
The companies managing this transition well are treating CSRD and CSDDD data collection as an extension of the same claims-substantiation discipline that already applies to marketing and product claims — rather than building a separate, siloed reporting process from scratch. A single evidence base, reviewed once and used everywhere a claim is made, is significantly more defensible than parallel, inconsistent processes across departments.
Start with a gap analysis against the ESRS topics relevant to your sector, identify which data points you can already evidence and which require new collection processes, and build in independent assurance early — retrofitting audit-readiness after the fact is far more expensive than designing for it from the outset.
Not Sure If CSRD or CSDDD Applies to You?
Our team can assess your exposure across both directives and map out exactly what your reporting obligations will look like.
Get a Scope Assessment
