Skip to main content
Skip to main content

How to prepare for CSRD

The first step is not a gap analysis but a scope check. Directive (EU) 2026/470 cut CSRD's reach by roughly 85–90%, and preparation work under way in 2026 may be being done by companies no longer in scope.

In short

Confirm scope against the current thresholds — more than 1,000 employees and more than €450m net turnover, cumulatively, for financial years beginning on or after 1 January 2027. If in scope, work in this order: double materiality assessment, data gap analysis against the ESRS datapoints that survive, control design for assurance, then drafting. If out of scope, decide deliberately whether to report voluntarily rather than continuing by momentum.

Step zero: are you still in scope?

Both thresholds must be met, cumulatively. A company with 1,400 employees and €300m turnover is out. A company with €600m turnover and 700 employees is out. Only companies over both are in.

The revised thresholds apply to financial years beginning on or after 1 January 2027, so the first report on the new basis lands in 2028.

If you are out of scope, decide rather than drift

Voluntary reporting may still be appropriate — customers, lenders and investors may ask for it regardless of the law, and a group with obligations in other jurisdictions may already produce most of the content.

Continuing a full CSRD programme by inertia because it was budgeted last year is an avoidable cost.

Assurance shapes upstream work

CSRD requires limited assurance, and that requirement reaches back into how data is produced, not only how it is presented. An assurance provider will ask for evidence of controls and traceability; retrofitting either costs more than designing them in.

Decide who owns each datapoint and how its value can be reproduced from source before drafting narrative.

Penalties are national, and the range is wide

Where this usually goes wrong

There is no EU-wide CSRD fine. Verified maximums run from roughly €600 in Romania to €10,000,000 in Italy — and in Italy a transitional cap of €2.5m applies until 25 September 2026. A group reporting in several member states faces several different regimes at once.

In order

  1. Confirm scopeAgainst the current cumulative thresholds, not the pre-Omnibus ones.
  2. Decide voluntary or not, if out of scopeA deliberate decision, documented, rather than momentum.
  3. Double materiality assessmentIt determines which ESRS datapoints you owe at all.
  4. Data gap analysisAgainst the surviving datapoints only. Assign an owner to each.
  5. Design controls for assuranceTraceability from source to disclosure. Do this before drafting.
  6. Identify the member states you report inBecause the penalty regime and any transitional caps are national.

Questions people actually ask

Is my company still in scope of CSRD after the Omnibus?
Only if it exceeds both thresholds: more than 1,000 employees and more than €450m net turnover. The revised thresholds apply to financial years beginning on or after 1 January 2027.
Where should CSRD preparation start?
With a scope check, then a double materiality assessment. Materiality decides which datapoints you owe, so a gap analysis before materiality may analyse gaps you do not need to close.
What happens if we do not comply with CSRD?
It depends on the member state. There is no EU-level penalty; verified national maximums range from roughly €600 to €10,000,000.

Still not sure what binds you?

XG tracks obligations like these across 119 jurisdictions.

Check what applies to your companyTalk to us