The Corporate Sustainability Reporting Directive (CSRD) entered into force on January 5, 2023. The CSRD significantly broadens the existing EU regime for non-financial disclosure requirements currently governed by the Non-Financial Reporting Directive (NFRD) and aligns ESG reporting with traditional financial reporting in the EU. EU-listed entities and large public and private companies with activities in the EU (including U.S. entities) will have to report on how their business model affects their sustainability, and on how external sustainability factors (such as climate change or human rights issues) influence their activities. All reporting must be independently audited and based on EU standards. The aim of the CSRD is to combat greenwashing, better inform investors and other stakeholders on sustainability issues, and facilitate the transition of the EU to a net-zero economy. While the obligations, as described in greater detail below, are onerous, U.S. companies will benefit from a long lead time before they are required to comply (2025 at the earliest), as EU member states still need to transpose the CSRD into their national laws.

Regulatory Background

The EU’s Green Deal and Sustainable Finance Agenda set out the bloc’s ESG policy aims. The main focus areas of recent and upcoming legislation to effectuate those ambitious aims are: (1) corporate due diligence, particularly with regard to supply chains, and (2) sustainable finance initiatives, including increased reporting.  

The CSRD is just one component within this framework and updates the NFRD to include ESG information as part of the non-financial disclosure requirements. It complements existing EU initiatives such as the Sustainable Finance Disclosure Regulation (which requires disclosures on sustainable investment products), the EU Taxonomy Regulation (a classification system of environmentally sustainable economic activities), and the proposed Corporate Sustainability Due Diligence Directive, all of which will fundamentally overhaul how companies active in the EU are required to gather and report information on ESG issues impacting their core business and global value chain. A broader set of ESG topics are included in the CSRD than under U.S. or UK regulation, including the SEC’s ESG-related rulemaking agenda items related to climate change disclosure (see related Wilson Sonsini client alert here), cybersecurity (see related Wilson Sonsini client alert here), and human capital and corporate board diversity, and the UK’s reporting requirements covering modern slavery and gender pay gap disclosures.

Under EU law, directives are binding as to the result to be achieved, but leave discretion to EU member states as to how to achieve it. So, while the CSRD sets out a framework for sustainable reporting, some specifics will not be fully determined until it is incorporated into national legislation. EU member states will have until July 2024 to implement the CSRD into national law.

Who Must Report Under the CSRD and When?

The CSRD significantly expands the scope of the NFRD reporting requirements, covering all large companies, whether listed or not, and requiring compliance by certain U.S. companies that have activities in Europe. While there may be minor differences in how the CSRD is implemented across member states, the scope and timing of application are not subject to change and are set out in the table below.

New Reporting Requirements

Companies will need to wait until the CSRD is implemented into national law (by July 2024) for clarity on the full suite of their obligations and the potential sanctions for non-compliance. However, the CSRD requires member states to incorporate common sustainability reporting standards to ensure that information is comparable and that all relevant information is disclosed.

The European Financial Reporting Advisory Group (EFRAG) is the body tasked under the CSRD with developing these common standards, known as European Sustainability Reporting Standards (ESRS), to ensure harmonized reporting across the EU. EFRAG provided the European Commission (EC) with its first draft of cross-sectoral standards for consultation in November 2022. These are separated out between general cross-cutting standards, which set out the general requirements across all the ESG topics covered by the CSRD, and 10 topical standards, which focus on specific ESG matters.⁶ The EC must adopt the standards by June 2023, following consultation with the relevant EU supervisory bodies (including the European Securities and Markets Authority, ESMA, which is responsible for issuers whose securities are listed on European regulated markets). EFRAG will also prepare sector-specific standards, which will be adopted by June 2024.⁷ Companies must report in accordance with those standards, which will specify the process and disclosures required.

Disclosure requirements, both forward-looking and retrospective, will include:

• An overview of the company’s business model, strategy, and policies related to ESG matters;
• Analysis of ESG opportunities and risks; 
• ESG targets and KPIs, and annual progress updates;
• The role of the board and management with regard to sustainability matters, including relevant skills and incentives; 
• Whether and how the business model and strategy take into account stakeholder interests; and
• ESG due diligence on a company’s operations and value chain, and, importantly, on supply chain relationships and business partnerships, including the principal actual and potential adverse impacts related to the activities.

While some disclosures will always be mandatory (such as General Disclosures, per the draft ESRS), others will be subject to a materiality assessment. The CSRD notably introduces a double materiality concept, focusing not just on how sustainability factors affect the company (financial materiality), but also on the company’s impact on society and the environment (impact materiality). This deviates from the U.S. SEC investor-focused concept. The proposed materiality assessment is set out in detail in the draft Reporting Standards.

Where to Report

The required disclosures must be published in a dedicated section of company management reports. For U.S.-based companies, this will be in an Annual Report or Form 10-K. Companies must make the reports available on their website in a digital, machine-readable format. The sustainability information will need to be digitally “tagged” to allow for the information to be compiled in a single access point database managed by the EC.

The CSRD also requires that companies obtain third-party assurance on their ESG disclosures, beginning with “limited” assurance and transitioning to “reasonable” assurance by 2028. An independent auditor or certifier must ensure that the sustainability disclosures comply with the EU certification standards, once adopted. The reporting of non-European companies must be certified as well. 

Key Takeaways 

While still subject to implementation, the CSRD will have a significant impact on companies with EU operations. Mandatory ESG reporting under the CSRD will require companies to implement new policies, processes, and controls. Companies operating in the EU should: (1) assess whether they fall within the scope of the CSRD; (2) determine which EU member state requirements they will need to comply with; (3) assess whether the information likely to be required is tracked and readily available internally; (4) determine phase-in timing; and (5) establish a roadmap for implementation based on EU member state requirements. Internal controls and processes will need to be streamlined to ensure timely compliance, particularly in private companies that may not have as much experience in public reporting.  

Companies should also be aware that the CSRD is just one piece of the EU’s ESG puzzle; European counsel should be proactively consulted to ensure the web of existing and pending EU ESG legislation is adequately addressed by company processes. Companies would benefit from building out cross-functional ESG executive teams and dedicated ESG expertise on their boards to ensure a holistic, robust, and cost-effective compliance process. 

[1] Large EU “public interest entities” with more than 500 employees (annual average), covering EU regulated market- listed securities, credit institutions and insurance companies, and companies specifically designated by an EU member state as a “public interest” entity.

[2] EU subsidiaries of a non-EU parent will be exempt from the requirement to prepare sustainability reports if the non-EU parent company prepares consolidated management reports that could be considered equivalent in scope. If the non-EU parent does not produce an equivalent, in-scope EU subsidiaries will need to prepare their own reports. It is not clear how the equivalence test will be applied in practice, but it is difficult to see the current U.S. and UK reporting requirements being deemed equivalent in light of the divergence with the more extensive requirements under the CSRD.     

[3] “Net turnover” means the amount of revenue derived from the sale of products and the provision of services after deducting sales rebates and value added tax and other taxes directly linked to revenue. For undertakings established in an EU member state whose ultimate parent is governed by the law of a non-EU country, it means the revenue as defined by or within the meaning of the financial reporting framework on the basis of which their financial statements are prepared.

[4] Employee count, balance sheet thresholds, and turnover should be calculated as of a company’s most recently completed fiscal year.

[5] This applies regardless of whether the issuer is established in the EU. SMEs will have reduced reporting requirements and may opt out until 2028. “Micro undertakings” are excluded (undertakings that have at least two of the following: balance sheet of <€350,000; (ii) net turnover of <€700,000; and (iii) <10 employees).

[6] In addition to the two cross-cutting standards (general requirements and general disclosures), there are five under the Environment pillar (climate change, pollution, water and marine resources, biodiversity and ecosystems, and resource use and circular economy), four under the Social pillar (own workforce, workers in the value chain, affected communities, and consumers and end-users), and one under the Governance pillar (business conduct).

[7] These will cover: agriculture, coal mining, mining, oil and gas, energy production, road transport, motor vehicle production, food/beverages, and textiles.