Guide
How to prepare for CSRD
The first step is not a gap analysis but a scope check. Directive (EU) 2026/470 cut CSRD's reach by roughly 85–90%, and preparation work under way in 2026 may be being done by companies no longer in scope.
Confirm scope against the current thresholds — more than 1,000 employees and more than €450m net turnover, cumulatively, for financial years beginning on or after 1 January 2027. If in scope, work in this order: double materiality assessment, data gap analysis against the ESRS datapoints that survive, control design for assurance, then drafting. If out of scope, decide deliberately whether to report voluntarily rather than continuing by momentum.
Step zero: are you still in scope?
Both thresholds must be met, cumulatively. A company with 1,400 employees and €300m turnover is out. A company with €600m turnover and 700 employees is out. Only companies over both are in.
The revised thresholds apply to financial years beginning on or after 1 January 2027, so the first report on the new basis lands in 2028.
If you are out of scope, decide rather than drift
Voluntary reporting may still be appropriate — customers, lenders and investors may ask for it regardless of the law, and a group with obligations in other jurisdictions may already produce most of the content.
Continuing a full CSRD programme by inertia because it was budgeted last year is an avoidable cost.
How does assurance shape the upstream work?
CSRD requires limited assurance, and that requirement reaches back into how data is produced, not only how it is presented. An assurance provider will ask for evidence of controls and traceability; retrofitting either costs more than designing them in.
Decide who owns each datapoint and how its value can be reproduced from source before drafting narrative.
Penalties are national, and the range is wide
There is no EU-wide CSRD fine. Verified maximums run from €5,000 in Ireland to €10,000,000 in Italy — and in Italy a transitional cap of €2.5m applies until 25 September 2026. A group reporting in several member states faces several different regimes at once.
In order
- Confirm scopeAgainst the current cumulative thresholds, not the pre-Omnibus ones.
- Decide voluntary or not, if out of scopeA deliberate decision, documented, rather than momentum.
- Double materiality assessmentIt determines which ESRS datapoints you owe at all.
- Data gap analysisAgainst the surviving datapoints only. Assign an owner to each.
- Design controls for assuranceTraceability from source to disclosure. Do this before drafting.
- Identify the member states you report inBecause the penalty regime and any transitional caps are national.
Questions people actually ask
- Is my company still in scope of CSRD after the Omnibus?
- Only if it exceeds both thresholds: more than 1,000 employees and more than €450m net turnover. The revised thresholds apply to financial years beginning on or after 1 January 2027.
- Where should CSRD preparation start?
- With a scope check, then a double materiality assessment. Materiality decides which datapoints you owe, so a gap analysis before materiality may analyse gaps you do not need to close.
- What happens if we do not comply with CSRD?
- It depends on the member state. There is no EU-level penalty; verified national maximums range from €5,000 to €10,000,000.
Next step
Talk to Carolina about How to prepare for CSRD
Carolina Ramirez — ESG Expert in Latin America
XG tracks 850 regulations across 119 jurisdictions.
30 minutes · a consultant who knows this file
Audit & Disclosure Readiness
Disclosure regimes are judged on evidence rather than intent. XG reviews documentation, maps it to the framework and finds the gaps before an assurance provider does — XG does not author or submit the final report.
Still not sure what binds you?
XG tracks obligations like these across 119 jurisdictions.
XG Regulation Register · 850 regulations · 119 jurisdictions