Sustainability reporting and Due Diligence in the EU after Directive (EU) 2026/470

Directive (EU) 2026/470, adopted on 24 February 2026 and published in the Official Journal on 26 February 2026, amends EU corporate sustainability reporting and corporate sustainability due diligence rules by narrowing scope, introducing value chain protections, removing the transition to reasonable assurance, and reshaping the Corporate Sustainability Due Diligence Directive (CSDDD).

The reform restructures the EU sustainability framework while preserving its core architecture.

Key regulatory changes

CSRD scope: new mandatory thresholds

Mandatory sustainability reporting now applies only to undertakings that exceed both:

• €450,000,000 net turnover, and
• More than 1,000 employees on average during the financial year.

Both criteria must be met cumulatively.

The revised scope applies to individual undertakings, groups, insurance undertakings, and credit institutions.

The reporting perimeter is therefore concentrated on the largest economic actors.

Listed SMEs removed from mandatory reporting

Small and medium-sized undertakings whose securities are admitted to trading on a regulated market are excluded from mandatory sustainability reporting.

The empowerment to adopt SME-specific sustainability reporting standards is removed.

Voluntary sustainability reporting remains available through standards for voluntary use.

Value chain cap: statutory protection for suppliers

Directive (EU) 2026/470 introduces formal protections for undertakings in the value chain with up to 1,000 employees (“protected undertakings”).

Reporting undertakings:

• May rely on supplier self-declaration of size.
• Are not required to verify it unless manifestly incorrect.
• Must not require information exceeding voluntary standards.
• Must inform protected undertakings if requested information exceeds those standards.
• Are deemed compliant if they respect these limits.

Any contractual clause requiring information beyond these limits for CSRD reporting purposes is not binding.

This provision limits ESG data extraction within supply chains and creates a statutory refusal right for smaller undertakings.

ESRS revision mandate

Within six months of entry into force, the Commission must revise the first set of European Sustainability Reporting Standards to:

• Remove less relevant datapoints,
• Prioritise quantitative disclosures where possible,
• Clarify the application of the materiality principle,
• Distinguish mandatory from voluntary datapoints,
• Improve interoperability with international standards.

Mandatory sector-specific standards are removed. The Commission may issue sector-specific guidance instead.

Assurance framework

The Commission must adopt limited assurance standards by 1 July 2027. The obligation to transition to reasonable assurance standards is removed.

Limited assurance therefore becomes the structural ceiling unless future legislation changes the framework.

For third-country auditors issuing sustainability assurance reports, a transitional registration regime applies for financial years between 1 January 2025 and 31 December 2030.

Omission of sensitive information

Undertakings may omit sustainability information, subject to assurance, where disclosure would:

• Seriously prejudice commercial position,
• Reveal trade secrets,
• Disclose classified information,
• Breach confidentiality obligations under Union or national law,
• Endanger privacy or security, including defence-related sensitivities.

This formalises proportionality and security safeguards within sustainability reporting.

Digital reporting clarification

Until digital marking-up rules for sustainability reporting are adopted under the EU electronic reporting framework, undertakings are not required to digitally tag sustainability reporting.

This reduces immediate digital implementation burdens.

Third-country reporting thresholds increased

The directive raises:

• The third-country parent turnover threshold in the Union to €450,000,000, and
• The subsidiary or branch turnover threshold to €200,000,000.

This narrows the extraterritorial reach of the reporting regime.

CSDDD after Directive (EU) 2026/470

Directive (EU) 2026/470 substantially amends Directive (EU) 2024/1760.

CSDDD now applies only to companies exceeding:

• 5,000 employees, and
• €1.5 billion turnover.

The directive:

• Expands full harmonisation of core due diligence process elements,
• Repeals the climate transition plan provisions,
• Removes the specific EU-wide civil liability regime while requiring effective access to justice under national law,
• Sets a uniform maximum pecuniary penalty cap of 3% of net worldwide turnover,
• Postpones application for all companies to 26 July 2029.

What this means for companies

If you exceed €450 million turnover and 1,000 employees, sustainability reporting remains mandatory. You should reassess:

• Reporting perimeter at individual and consolidated level,
• Supplier data collection practices to comply with the value chain cap,
• Internal controls supporting materiality assessments,
• Timelines for ESRS revision and assurance standards adoption.

If you fall below thresholds but operate within supply chains, you may:

• Adopt voluntary standards to standardise ESG data responses,
• Assert statutory refusal rights where data requests exceed voluntary standards for CSRD purposes,
• Reduce administrative burden through structured ESG information management.

The sustainability reporting environment for 2027–2029 is now legally defined, proportionate in scope, and structurally more targeted toward the largest undertakings.

Frequently Asked Questions