CSRD Compliance: Which Companies Need to Comply?

Whether a company needs to comply with the CSRD depends on a combination of factors, including the size of the company, the location in which it is established, its corporate structure, the size of its balance sheet, its overall number of employees, and whether or not it is listed or otherwise has been designated a “public-interest entity” within the EU. 

‍

CSRD compliance will ultimately be required for a wide and diverse range of businesses, spanning listed companies with as few as 10 employees to very large international companies based outside the EU, but with sufficient EU sales and presence.

‍

This guide aims to provide a general understanding of how the CSRD’s various applicability criteria work. Importantly though, determining whether and how the CSRD applies to a specific business will always require a careful, ongoing, case-by-case review by a legal or accounting professional to assess the unique attributes of the company and its corporate structure. 

‍

Key Takeaways

‍

• CSRD applies widely to companies of all sizes, both in and outside the EU, which must comply with CSRD based on factors like employee count, turnover, and market presence.

• Compliance starts soon, with reporting deadlines beginning in 2025 for large companies and smaller entities following through 2029.

• Non-compliance is costly — penalties for not meeting CSRD requirements can include steep fines and other legal consequences, depending on the country.

‍

What are the Main CSRD Compliance Groups?

‍

The table below sets forth the current timeline and compliance groups under the CSRD. With respect to dates, both the data year on which reporting is based (corresponding to the financial year of the company) along with the reporting year in which reports must be issued, are listed. 

‍

‍

How are the Different Company Classifications Defined?

‍

Whether and when a company must comply with the CSRD turns on a series of very fine-tuned definitions under EU law. Find summaries of key classifications below.

‍

What is a Public-Interest Entity?

‍

One of the key applicability criteria for companies that are part of the first compliance group is that they are “Public-Interest Entity.” A “public-interest entity” (also referred to as a “PIE”) is an entity that meets any of the following:

‍

1. Governed by the laws of a Member State and whose transferable securities are admitted to trading on a regulated market of any Member State;

2. Credit institution (as defined in Directive 2006/48/EC); 

3. Insurance undertakings (as defined in Directive 91/674/EEC); or

4. Specially designated by the Member State as a PIE.

5. ‍

For typical businesses (e.g., retailers and manufacturers), the most likely prong under which the entity would qualify as a PIE is under (a), having transferable securities (i.e., stock) trading on an EU regulated market. 

‍

What is a Large Undertaking?

‍

Large undertakings are defined as undertakings which exceed “at least two of the three following criteria” on their balance sheet dates (i.e., the last day of their financial reporting period):

1. Balance sheet total: EUR 25,000,000

2. Net turnover: EUR 50,000,000

3. Average number of employees during the financial year: 250

‍

Importantly, large undertakings need to comply with the CSRD regardless of listing or PIE status; simply meeting two of the three criteria above on the balance sheet date is sufficient.

‍

What is the Difference between an Undertaking and a Group?

‍

The CSRD applies to both undertakings (i.e., individual legal entities) and groups (i.e., an undertaking together with all of its underlying subsidiaries). The requirements applicable to individual undertakings also apply to corporate groups which, considered together, would meet the criteria. 

‍

What is a “Large Group”?

‍

A “large group” is defined as a group (“a parent undertaking and all is subsidiary undertakings”) which also meets the same criteria as a “large undertaking” but at the group level (i.e., considering all subsidiary entities together). Compliance dates are effectively identical to those for large undertakings, meaning:

‍

• Large groups report with the second compliance group, which must report in 2026 based on 2025 financial year data. 

• Large groups that are also (1) PIEs and (2) had 500 or more employees on average during the prior financial year must comply with the first compliance group, with reporting in 2025 based on 2024 financial year data.

‍

One distinction is the form of sustainability statement – large groups report using a consolidated sustainability statement following the requirements of Article 29 of the Accounting Directive, rather than individual sustainability statements under Article 19a.

What is a “Small” or “Medium-Sized” Undertaking? 

‍

A small or medium sized undertaking (also referred to as “SMEs”) are undertakings which are not large undertakings. While the CSRD does not distinguish between small undertaking and medium-sized undertakings, the criteria separating the two clusters are as follow: 

‍

Medium-Sized Undertaking

‍

Medium-sized undertakings are those which do not exceed the limits of at least two of the three following criteria on their balance sheet dates:

‍

(a)  Balance sheet total: EUR 25,000,000

(b)  Net turnover: EUR 50,000,000

(c)  Average number of employees during the financial year: 250

‍

Small Undertaking

‍

Small undertakings are those which do not exceed the limits of at least two of the three following criteria on their balance sheet dates:

‍

(a) balance sheet total: EUR 5,000,000

(b) net turnover: EUR 10,000,000

(c) average number of employees during the financial year: 50

‍

Even if a business qualifies as an SME, it must also be EU listed for the CSRD to apply.

‍

What is a “Micro-Undertaking”?

‍

Micro-undertakings are those which do not exceed the limits of at least two of the following three criteria on their balance sheet dates:

‍

(a) balance sheet total: EUR 450,000

(b) net turnover: EUR 900,000

(c) average number of employees during the financial year: 10

‍

Micro-undertakings do not need to comply with the CSRD.

‍

How are requirements different for EU and Non-EU (Third-Country) Companies?

‍

CSRD compliance differs depending on where you are based. The CSRD applies differently to companies established in the EU, versus companies established in third countries outside the EU. As outlined above, companies that are based outside of the EU must comply in similar fashion to EU companies, but only if they have securities listed for trading on an EU-regulated market. Additionally starting in 2029, certain non-EU companies will be required to report even if they are not listed or domiciled in the EU at all, as described below.

‍

What Third-Country Companies Need to Comply?

‍

The CSRD is designed to apply to third-country companies with a significant presence in the EU. It does so through several unique applicability pathways.

‍

EU-Listed Third-Country Undertakings that Meet the CSRD Criteria

‍

Third-country undertakings which have securities approved for trading on an EU-regulated market must comply with the CSRD if they meet the core applicability criteria for the compliance groups set forth in the table above. 

‍

This means for example that if the third-country undertaking based in Japan exceeds two of the three criteria for large EU undertakings (Balance sheet total over EUR 25,000,000; Net turnover over EUR 50,000,000; Average number of employees during the financial year: 250) and has securities listed on an EU regulated market, then the Japanese entity would be subject to the CSRD on the same timeline as other large undertakings.

‍

Non-EU Listed Third-Countries Doing Significant Business in the EU

‍

Third-country undertakings must also comply with the CSRD even if they are not listed on an EU regulated market when they have significant business activities in the EU. Specifically, the third-country undertaking must (1) have a net turnover above EUR 150,000,00 in the EU over each of the last two years and (2) either:

‍

1. Have an EU subsidiary that is itself already subject to CSRD reporting, or

2. Have an EU branch which itself generates more than EUR 40,000,000 in revenue.

‍

The premise of this requirement is that reporting must occur at the group level of the third-country parent undertaking – effectively a requirement to issue a global sustainability report. This may expose thousands of non-EU companies to CSRD requirements by 2029.