CSRD guide: who falls under the law today, and what you need to know

Last updated: 27 October 2026.

Of the roughly 50,000 companies that were preparing for mandatory CSRD reporting, only about 10,000 actually fall under the law after Omnibus.

What the CSRD is, in short

The Corporate Sustainability Reporting Directive replaces the older NFRD, which covered roughly 11,000 European companies, mostly listed ones. The CSRD widened that circle considerably and sets out what you have to report, through the European Sustainability Reporting Standards (ESRS).

The starting point is double materiality. You assess two directions at once:

Impact materiality: what impact does your company have on people and the environment?

Financial materiality: which sustainability issues have a financial impact on your company?

Only what's material on at least one of those two axes needs reporting, with qualitative and quantitative data points. That includes your value chain: suppliers and customers count too.

Do you fall under the CSRD? Today's threshold

This is by far the part that's changed most, and where most of the confusion sits.

The old threshold (the "large undertaking" definition from the Accounting Directive): exceed at least 2 of the following 3 criteria, on two consecutive balance sheet dates: a balance sheet total of €25 million, a net turnover of €50 million, or an average of 250 employees (FTE).

The threshold since 18 March 2026, via Article 19a of the Accounting Directive as amended by Directive (EU) 2026/470: that 2-out-of-3 test is gone. A company or group only falls under the CSRD if it exceeds both of the following at once:

an average of more than 1,000 employees (FTE);

a net turnover of more than €450 million.

The balance sheet total no longer counts as a standalone criterion. For non-EU groups: a net turnover of more than €450 million generated in the EU, for each of the last two consecutive financial years, plus an EU subsidiary or branch with a net turnover of more than €200 million in the preceding financial year.

Group exemption: if the parent company publishes consolidated sustainability information for the whole group, a subsidiary doesn't need to publish its own report.

The waves, with current (delayed) timing

Wave 1 got no delay. Waves 2 and 3 each moved two years later via the stop-the-clock directive (see timeline). Note: part of wave 1 that now falls below the new, higher threshold may get exempted in Belgium as early as financial year 2026. That's still sitting in a Belgian preliminary draft bill, not final (see timeline).

Which standards apply

The ESRS consist of 12 standards:

2 cross-cutting standards, mandatory for everyone: ESRS 1 (general requirements and methodology) and ESRS 2 (general mandatory disclosures, regardless of materiality).

10 topical standards: E1 through E5 (environment), S1 through S4 (social), and G1 (governance). Which of these apply depends on your double materiality assessment.

Sector-specific standards, originally planned per sector (oil and gas, textiles, agriculture, banking, and so on), are off the table under Omnibus I. The Commission no longer has the power to make them mandatory. EFRAG may still work on voluntary sector guidance, but its form and timing aren't set. The separate, mandatory standard for listed SMEs (LSME) has also been scrapped.

On 3 July 2026, the Commission also adopted a simplified version of the 12 existing ESRS, based on EFRAG's December 2025 advice: roughly 60% fewer mandatory data points, and all optional data points dropped entirely. That text still needs to clear the European Parliament and Council, and still needs to be published in the Official Journal. It applies from financial year 2027, with voluntary early application from financial year 2026 possible.

Assurance and publication in Belgium

Assurance: limited assurance only, carried out by your statutory auditor or another company auditor (bedrijfsrevisor), appointed by the general meeting for a renewable 3-year mandate. The planned escalation to "reasonable assurance" was permanently dropped under Omnibus I. An EU assurance standard for limited assurance is due no later than 1 July 2027.

Publication: in the annual report, via the National Bank's Balance Sheet Office (Balanscentrale), and on your own website. A European single access point (ESAP) is meant to make this searchable EU-wide over time.

Language: the official language of your registered office. Other EU languages are allowed as a supplement.

Safe harbour: the management body may, as with annual accounts, exceptionally omit information about impending developments or ongoing negotiations if disclosure would seriously harm the company's commercial position, provided this doesn't prevent a true and fair view of the situation. Belgium kept this option in its transposition.

Sanctions: no separate CSRD penalty regime. Breaches follow the existing enforcement and sanctions framework for annual accounts and statutory audit.

Out of scope? The value-chain cap and VSME

Fall outside the CSRD, but supply a company that's in scope? You'll get asked regardless of your own obligations. Two things matter here.

The value-chain cap has been settled since 18 March 2026, built into the Omnibus I directive itself: a CSRD-obligated group can't ask a supplier or customer with 1,000 employees or fewer for more information than the voluntary VSME standard covers.

VSME (Voluntary Standard for non-listed SMEs) got its technical advice from EFRAG at the end of December 2024, and was recommended by the European Commission as the reference point on 30 July 2025, non-binding for now. The delegated act that formally establishes the VSME as the standard for the value-chain cap isn't final yet: the Commission was aiming for adoption by 19 July 2026, but that act still needs to clear the European Parliament and Council. There's no assurance requirement on a VSME report.

In practice: a VSME report is only worth doing once you're actually getting questionnaires from customers, banks or tenders. It's not a precautionary CSRD-lite.

The full timeline

Late 2022 – July 2024: the CSRD enters into force, member states transpose it.

2 December 2024: Belgium's transposition act, including the safe-harbour clause. Wave 1 starts reporting on financial year 2024.

26 February 2025: the European Commission proposes the Omnibus I package.

3-16 April 2025: the "stop-the-clock" directive moves through Parliament, Council and publication. Wave 2 moves to financial year 2027, wave 3 to financial year 2028.

4-23 December 2025: Belgium transposes the stop-the-clock directive (act of 12 December 2025, Belgian Official Gazette 23 December 2025). That same month, EFRAG finalises its advice on simplified ESRS.

24 February – 18 March 2026: the substantive Omnibus I changes get final approval, are published (Directive (EU) 2026/470) and enter into force. New threshold (1,000 employees + €450 million turnover), the dropped escalation to reasonable assurance, the value-chain cap.

27 March 2026: Belgium's Council of Ministers approves a preliminary draft bill that may exempt wave-1 companies below the new threshold from reporting as early as financial year 2026. Not yet voted in parliament.

3 July 2026: the Commission adopts the simplified ESRS. Publication in the Official Journal is still to follow.

What's still to come

The final vote on Belgium's full transposition law in parliament, by 19 March 2027 at the latest.

Publication of the simplified ESRS in the Official Journal.

Final approval of the delegated act establishing the VSME as the standard for the value-chain cap.

The EU assurance standard for limited assurance, expected by 1 July 2027.

None of these remaining pieces still change the overall direction. We'll update this guide as soon as something concrete changes.

What this means for you in practice

Check first whether you still fall in scope. The threshold now sits at 1,000 employees and €450 million turnover, cumulative. Plenty of companies that were preparing two years ago now simply fall outside it.

Out of scope, but supplying companies that are? A VSME report is the pragmatic step, once you're actually asked for one. Not a full CSRD process you don't actually need.

Still under wave 1, 2 or 3? Use the extra time to build it properly with what you already have, rather than waiting for every detail of the simplified ESRS to be finalised. The headline, far fewer data points, limited assurance only, is settled enough to start on now.

Wondering whether you still fall under the CSRD after all these changes, and what that means in practice?

Book a 30-minute call with our sustainability experts to assess your situation. We're here to help.