Which sustainability regulations apply to my company?
Most people start by asking which rules apply to their industry. Few sustainability regulations are industry-specific. They attach to where you are established, what you place on a market, what you operate, and how large you are — and those four tests give different answers.
Work through four tests in order. First, establishment and market access: where are your entities, and into which markets do you sell? Second, size: most disclosure regimes have hard thresholds, and the EU's were cut sharply in 2026. Third, product: rules like EUDR, CBAM, ESPR and PPWR follow goods, not companies. Fourth, what you operate: energy reporting attaches to facilities. A regulation applies if any one test catches you, which is why industry-based screening misses obligations.
Test one — establishment and market access
Two different questions, often confused. Establishment asks where your legal entities sit. Market access asks where your goods and services end up. A company established entirely outside the EU can be in scope of EUDR, CBAM and PPWR because its products reach the EU market.
Start with a list of legal entities by country and a list of markets you sell into. Most scope surprises come from the second list, not the first.
Test two — size, and thresholds that moved
Disclosure regimes are threshold-driven, and thresholds change. CSRD scope was cut by roughly 85–90% in 2026: the test is now more than 1,000 employees AND more than €450m net turnover, cumulatively, from financial year 2027. A company that built a CSRD programme against the old thresholds may no longer be in scope.
Thresholds also differ by regime. California's SB 253 tests total entity revenue, not California revenue. Australia's regime uses a two-of-three test at each tier.
Test three — what you place on a market
Product rules ignore your sector. EUDR covers seven commodities and everything derived from them, so a furniture retailer, a chocolate manufacturer and a tyre importer are all in scope by different routes. CBAM follows six goods categories above a 50-tonne annual threshold. PPWR follows the packaging around anything you ship.
If you sell physical goods into the EU, this test needs a product-level answer, not a company-level one.
Test four — what you operate
Energy reporting obligations attach to facilities rather than companies, and are often handled outside compliance teams. Data centres at or above 500 kW of installed IT power report energy and water annually under the EU Energy Efficiency Directive, and the results are published.
The cost of screening once
Where this usually goes wrong
Screening once and treating the answer as fixed is the common mistake. Between late 2025 and mid-2026 alone: CSRD scope was cut ~85–90%, CSDDD's application date moved to 2029 and its penalty rule inverted, EUDR was postponed a second time, CBAM's certificate sales moved to 2027, ETS2 slipped to 2028, and the SEC's rules were proposed for rescission having never taken effect.
A scope assessment more than a few months old may no longer be reliable.
In order
- List entities by countryEvery legal entity, with its jurisdiction of establishment.
- List markets you sell intoIncluding markets reached indirectly through distributors or online sales.
- List products you place on those marketsAt commodity level, not brand level — EUDR and CBAM test the commodity.
- List facilities you operateWith energy capacity, because some obligations attach to a threshold at the meter.
- Apply size thresholds per regimeUsing current thresholds, not those in circulation before 2026.
- Set a re-check dateQuarterly is reasonable while the EU simplification programme is still moving.
Questions people actually ask
- Do sustainability regulations apply by industry?
- Rarely. Most attach to where you are established, which markets you sell into, what products you place on those markets, what you operate, and your size. Industry-based screening misses product rules like EUDR and CBAM.
- Does a non-EU company have to comply with EU rules?
- Often yes. EUDR, CBAM and PPWR are market-access rules: they apply because goods reach the EU market, regardless of where the company is established.
- How often should scope be reassessed?
- While the EU simplification programme is in motion, quarterly. Six regimes changed materially between late 2025 and mid-2026, several in ways that moved companies out of scope.
Still not sure what binds you?
XG tracks obligations like these across 119 jurisdictions.