CSRD: who does it apply to and what must you disclose?
The CSRD requires large companies to report on sustainability according to fixed European standards, in the management report and with assurance from an auditor. Since the Omnibus I package of March 2026 the group of companies caught is considerably smaller: the directive applies only from more than 1,000 employees on average and more than EUR 450 million in net turnover, with the first report covering financial years beginning on or after 1 January 2027. Separate disclosure duties flow from the Taxonomy Regulation and, for the financial sector, from the SFDR. Companies outside all of those regimes still face the information request, but it reaches them through the supply chain.
The short answer
CSRD stands for Corporate Sustainability Reporting Directive. The directive makes sustainability information part of annual reporting: not as a standalone sustainability report, but as a section of the management report, prepared under the European reporting standards and accompanied by an assurance opinion. The thinking behind it is that financiers, customers and supervisors should be able to compare and rely on sustainability information in the same way as on financial figures.
Three further layers sit around that core. The Taxonomy Regulation requires the same companies to publish figures on environmentally sustainable activities. The SFDR requires financial market participants to disclose information on their products and policies. Companies outside all of these regimes owe no statutory reporting duty, but they do face questions from customers, banks and insurers.
The NFRD has been absorbed into the CSRD
Directive 2014/95/EU, the non-financial reporting directive or NFRD, applied to large public-interest entities with more than 500 employees. It is no longer the framework in force. The CSRD, Directive (EU) 2022/2464, has replaced and extended those provisions. Where a text still treats the NFRD as the governing regime, that text is out of date.
Who does the CSRD apply to after the Omnibus package?
The original scheme worked in four waves, with thresholds that would in time have caught medium-sized companies and listed small companies as well. That approach has been abandoned. The Omnibus I package entered into force in March 2026 and now sets two cumulative thresholds.
| Company | Threshold | First report |
|---|---|---|
| EU company | More than 1,000 employees on average and more than EUR 450 million in net turnover | Financial year beginning on or after 1 January 2027 |
| Company established outside the EU | More than EUR 450 million turnover in the EU, with a subsidiary or branch of significance | Financial year 2028 |
| Listed small and medium-sized company | Falls outside the directive | No obligation |
Both thresholds must be met: employees and turnover. Meet only one of them and you fall outside the CSRD. A company with 1,200 employees and EUR 300 million turnover is therefore out of scope. Companies that already reported under the original first wave remain subject to the duty for as long as they meet both new thresholds; they do benefit from the relaxations.
What must the statement contain?
The CSRD works on the principle of double materiality. You report on two sides of the same coin.
- Impact outwards. The effects your company has on people and the environment, in its own operations and in the chain.
- Financial consequences inwards. The sustainability risks and opportunities that affect your turnover, costs, assets and access to capital.
Which topics actually enter the statement is determined by a materiality assessment. That assessment is no formality: it is the document an auditor, and later a supervisor, will fall back on when asking why a topic was or was not addressed.
The form and location of the reporting are fixed as well.
- Location. The information belongs in a separately identifiable section of the management report, not in a standalone sustainability report.
- Standards. The reporting follows the European Sustainability Reporting Standards. Those standards have been simplified and sector-specific standards will not be introduced.
- Format. The information is filed in digitally tagged form.
What assurance is required?
The auditor assesses the sustainability statement with limited assurance. The move to reasonable assurance announced earlier has been dropped under Omnibus. That saves cost, but it changes nothing about the essentials: the information must be traceable to a source, and that source must be there when it is asked for.
The Taxonomy Regulation: figures alongside the statement
Regulation (EU) 2020/852 requires companies within the scope of the CSRD to publish separate figures. You state what proportion of your turnover, capital expenditure and operating expenditure relates to environmentally sustainable activities.
Here too Omnibus has cut back. Mandatory taxonomy reporting now follows the CSRD thresholds. Large companies with more than 1,000 employees but net turnover of no more than EUR 450 million may report voluntarily. The reporting itself has also been simplified. See our explanation of the Taxonomy Regulation.
SFDR: disclosure in the financial sector
Regulation (EU) 2019/2088, the Sustainable Finance Disclosure Regulation, applies in full. It addresses financial market participants and financial advisers, such as managers of investment funds, insurers offering insurance products with an investment component, and pension institutions. The SFDR provides for disclosure at two levels.
- Entity level. Website information on the policy on sustainability risks, on remuneration policy and on adverse impacts on sustainability factors.
- Product level. Information in pre-contractual documentation and periodic reports. Products that promote environmental or social characteristics, and products with sustainable investment as their objective, are subject to heavier requirements.
A revision of the SFDR is under way. It has not been completed and is not yet law in force. Until then the current framework applies in full. In the Netherlands the AFM supervises.
Overview of the four regimes
| Regime | Who | Where disclosed | From |
|---|---|---|---|
| CSRD | More than 1,000 employees and more than EUR 450 million turnover | Management report | Financial years from 1 January 2027 |
| Taxonomy Regulation | Companies within the CSRD scope | Management report | Ongoing |
| SFDR | Financial market participants and advisers | Website, prospectus, periodic report | 2021 |
| VSME | Voluntary, mainly SMEs in the chain | At your discretion | Voluntary |
And if you fall outside the scope?
The answer to that common question is less reassuring than it looks. You owe no statutory sustainability statement; the ordinary rules for the management report in Article 2:391 of the Dutch Civil Code (Burgerlijk Wetboek) continue to apply. But companies outside the direct scope still find the CSRD on their desk through the chain: a customer, bank or insurer that is itself caught needs data on your emissions, your working conditions or your use of materials.
Omnibus I has drawn a line here. Companies with no more than 1,000 employees on average are protected: no more information may be requested from them than the voluntary reporting standard for SMEs, the VSME, prescribes. A contractual provision that goes further is not enforceable. That is a useful argument in negotiations on purchasing terms and financing documentation, and it pays to know it before you sign.
Reporting voluntarily under the VSME can nevertheless be attractive. It gives you a single set of data with which to answer every question from the chain. You can read more about setting that up on our page on ESG reporting.
Where and when does the information become public?
Disclosure is a financial statements question, and that has practical consequences. The sustainability information shares the timetable of the management report: it is adopted by the board, audited and filed with the trade register. The general meeting therefore receives it at the same moment as the figures.
That means you have to set up your data collection well before the financial year ends. Value chain data cannot be gathered in a matter of weeks. Start with a baseline measurement and an inventory of your information sources.
Listed companies also have to deal with the Dutch Corporate Governance Code. It calls for an explanation of the company’s view on sustainable long-term value creation, even where the company falls outside the CSRD. See our page on sustainability and the Corporate Governance Code.
Sanctions and supervision
Failing to disclose statutorily prescribed information in the management report, or disclosing it incompletely, is not without consequence.
- Interested parties can bring annual accounts proceedings before the Enterprise Chamber (Ondernemingskamer).
- A missing or incorrect management report affects the filing obligation.
- For listed companies the AFM supervises financial reporting.
- Directors may be internally liable under Article 2:9 of the Dutch Civil Code.
- Misleading public statements may lead to enforcement by the Netherlands Authority for Consumers and Markets (ACM).
Mind the content of what you publish
What you publish can be used against you. Incorrect or incomplete sustainability information may amount to an unfair commercial practice. From 27 September 2026 stricter rules against misleading sustainability claims apply under Directive (EU) 2024/825, the EmpCo Directive. Generic claims without substantiation, and climate neutrality claims resting on offsetting alone, will then be prohibited. See greenwashing and environmental claims.
Dutch implementation
The amendments must be transposed into Dutch law by 19 March 2027 at the latest. The bill that anchors the CSRD in Book 2 of the Dutch Civil Code had not been completed when Omnibus was adopted and is now being aligned with the new framework. In practice that means: work on the European thresholds and timeline, and keep an eye on the national rules for the details on the management report and the audit. The final text will only be settled once the bill is complete.
What to do now
- Establish whether you meet the two thresholds, on a consolidated basis and over time as well. A company that grows moves into scope of its own accord.
- If you are caught, start with the materiality assessment. That is the longest step and it shapes the rest.
- Set up your data collection before the financial year ends, beginning with a baseline measurement.
- If you are not caught, map out who in your chain does report and what that party will ask of you.
- Check your contracts for information obligations that go beyond the voluntary SME standard.
- Keep sustainability claims in advertising strictly separate from reporting data.
Frequently asked questions
Does the CSRD also apply to a Dutch subsidiary of a foreign group?
A subsidiary may be exempt where it is included in the consolidated sustainability statement of the parent, provided that statement meets the European requirements. Groups established outside the EU are subject to a regime of their own, with a threshold of EUR 450 million in EU turnover.
May I publish my sustainability information in a separate report?
Not under the CSRD. The information belongs in the management report, in a separately identifiable section. A standalone report is permitted alongside it, but does not replace the statutory reporting.
We fell within the old CSRD thresholds. Do we now have to report after all?
Only if you meet both of the new thresholds. For companies that fall out of scope because of the increase, the package provides a transitional arrangement for the intervening financial years.
What level of assurance does the auditor give on sustainability information?
Limited assurance. The move to reasonable assurance has been dropped.
Is the CSRD the same as the CSDDD?
No. The CSRD is about reporting; the CSDDD is about acting: actually investigating and addressing adverse impacts in the chain. After Omnibus the CSDDD has much higher thresholds and will only apply from 2029.
What happens if we do not report, or report late?
The sustainability statement forms part of the management report. If it is missing or incorrect, that affects the filing obligation and may give rise to director liability, alongside enforcement by the supervisor.
Questions about your CSRD obligation?
Law & More assesses whether your company falls within the CSRD and the Taxonomy Regulation, provides legal guidance on the materiality assessment, and reviews chain contracts for information obligations that go further than is permitted. Our lawyers in Eindhoven and Amsterdam will be glad to advise you. You are welcome to contact us.
