CSRD: who is concerned in 2026?

Since the Omnibus "Content" Directive (EU) 2026/470, the CSRD only targets companies with more than 1,000 employees and more than €450M in net turnover (cumulative criteria). Wave 1 (large public-interest entities with over 500 employees) remains in scope; waves 2 and 3 are postponed by two years and listed SMEs are excluded.

Updated April 2026 - The CSRD (Corporate Sustainability Reporting Directive) imposes verified and standardised sustainability reporting on more than 50,000 companies across Europe, up from 11,700 under the former NFRD (the Commission's original estimate). This figure is now outdated: the Omnibus "Content" Directive (EU) 2026/470 has cut the scope by about 80%, to some 5,000 entities. Transposed into French law by the ordinance of 6 December 2023 and decree No. 2023-1394 of 30 December 2023, the CSRD has had its calendar and thresholds deeply reshaped. Two "Omnibus" directives changed the landscape: the "stop-the-clock" Directive (EU) 2025/794 (in force on 17 April 2025), which postpones waves 2 and 3 by two years, and the Omnibus "Content" Directive (EU) 2026/470 (published in the OJEU on 26 February 2026, in force on 18 March 2026), which sharply raises the thresholds. The second wave therefore does not enter into application in 2026. Determining whether your company falls within the scope of the CSRD in 2026 requires a precise analysis of thresholds, legal status and the applicable calendar.

To complete, also see ESG reporting, Financial reporting and Accounting firm: how to choose in 2026.

The CSRD is European Directive 2022/2464, which completely overhauls corporate non-financial reporting. It does not merely expand the scope of affected entities: it mandates detailed standards (the ESRS - European Sustainability Reporting Standards), mandatory assurance by a statutory auditor or independent third-party body (OTI), and publication in a dedicated section of the management report in xHTML electronic format.

The objective is clear: to provide investors, creditors and the public with reliable, comparable and auditable ESG information. The CSRD amends four existing European texts: the Accounting Directive, the Transparency Directive, the Audit Directive and the Audit Regulation.

The scope of the CSRD expands progressively. The official calendar, as defined by the directive and transposed into French law, is structured in three main waves:

Wave 1 - Financial years beginning on or after 1 January 2024 (reporting published in 2025)#

Affected are large public-interest entities already subject to the NFRD: companies listed on regulated markets, banks, insurance companies, meeting at least two of the following criteria:

• more than 500 employees;
• more than €50 million in net turnover (€60 million for groups);
• more than €25 million in total assets (€30 million for groups).

These companies have already published their first CSRD sustainability report in 2025.

Wave 2 - Financial years beginning on or after 1 January 2027 (reporting published in 2028)#

This wave has been deeply reshaped. The "stop-the-clock" Directive (EU) 2025/794 first postponed its entry into application by two years. The Omnibus "Content" Directive (EU) 2026/470 then replaced the former 250-employee threshold: the CSRD now only targets companies and groups that simultaneously exceed two cumulative criteria:

• more than 1,000 employees;
• more than €450 million in net turnover.

The total-assets criterion (€25M / €30M) is removed from the CSRD scope.

Third-country groups fall under a dedicated regime (see wave 4 below). A non-EU company listed on an EU regulated market is assessed under the size criteria in force.

In practice, a company with 300, 500 or 800 employees that believed it fell under this wave drops out if it does not reach €450 million in net turnover. For listed companies still in scope, the sustainability report is published within four months of the financial year end.

Wave 3 - Listed SMEs (financial year beginning 1 January 2026, reporting in 2027)#

Listed SMEs on EU regulated markets (excluding micro-undertakings) theoretically enter the scope on 1 January 2026. A micro-undertaking is defined as a company not exceeding two of the following criteria: 10 employees, €450,000 in total assets, €900,000 in turnover.

This entry into scope is now moot. The "stop-the-clock" Directive (EU) 2025/794 first postponed listed SMEs to financial year 2028 (reporting 2029), then the Omnibus "Content" Directive (EU) 2026/470 excluded them from the mandatory scope of the CSRD. They may report on a voluntary basis, under the lighter VSME standard (Voluntary Sustainability reporting standard for SMEs).

Wave 4 - Large non-EU companies (financial year 2028, reporting 2029)#

Third-country groups remain covered from financial year 2028 (reporting 2029), but their thresholds have been raised by the Omnibus "Content" Directive (EU) 2026/470: more than €450 million in net turnover generated within the EU, with an EU subsidiary or branch generating more than €200 million in net turnover in the EU. These groups will have to publish a consolidated report.

Only wave 1 was not postponed by the "stop-the-clock" Directive (EU) 2025/794; France transposed it through DDADUE Law No. 2025-391 of 30 April 2025.

The application of CSRD thresholds follows the rules of Article 3 of the European Accounting Directive (2013/34/EU). Several points deserve particular attention:

The post-Omnibus scope threshold. Since the Omnibus "Content" Directive (EU) 2026/470, entry into the mandatory CSRD scope no longer relies on the "two out of three" rule of the "large undertaking" category, but on two cumulative criteria: more than 1,000 employees and more than €450M in net turnover. The two-consecutive-financial-years condition is still assessed at the closing date.

Consolidated-level reasoning. For groups, thresholds apply at the consolidated level. A subsidiary may benefit from a reporting exemption if its parent company prepares a consolidated sustainability statement in compliance with the CSRD. This exemption does not apply to large listed companies.

Non-EU companies. A company headquartered outside the EU but listed on an EU regulated market is assessed under the size criteria in force. For third-country groups, a dedicated regime applies from financial year 2028: more than €450M in net turnover in the EU, with an EU subsidiary or branch exceeding €200M in net turnover (the former €40 million branch trigger is no longer the reference).

Quick decision: am I in scope?#

This table gives an initial indication. Belonging to a group, a listing or an acquisition may change the answer; the diagnosis must be dated and documented.

There are in fact two Omnibus directives. The "stop-the-clock" Directive (EU) 2025/794 (published in the OJEU on 16 April 2025, in force on 17 April 2025) postpones waves 2 and 3 by two years. The Omnibus "Content" Directive (EU) 2026/470 (voted by Parliament on 16 December 2025, adopted by the Council on 24 February 2026, published in the OJEU on 26 February 2026, in force on 18 March 2026) refocuses the scope. The main adjustments are:

• a definitive increase in the scope thresholds (more than 1,000 employees and more than €450M in net turnover, cumulative criteria), cutting the scope by about 80%, to some 5,000 entities;
• a simplification of ESRS standards for the first years of application, with extended transitional measures;
• a reduction in reporting requirements for certain catégories of companies, particularly on value chain data;
• the exclusion of listed SMEs from the mandatory scope (two-year deferral then removal), with the option of voluntary reporting under the VSME standard.

However, as of 1 April 2026, the exact transposition of these simplification measures into French law is still underway. The Ministry of the Economy recommends that companies not suspend their CSRD preparations while awaiting definitive implementing texts. It is better to over-prepare than to discover at the last minute that the company was indeed within scope.

Hayot Expertise insight: on the CSRD, the greatest risk is not over-preparing. It is starting from an incorrect scope diagnosis. A company that wrongly believes itself exempt exposes itself to administrative penalties and a loss of credibility with its financiers.

If your company falls within the scope of the CSRD, here are the main obligations that apply:

• Double materiality assessment: identify ESG issues that have an impact on the company (financial materiality) AND those on which the company has an impact (impact materiality). This principle of double materiality is the cornerstone of the CSRD.
• Reporting under ESRS standards: publish detailed information on governance, strategy, management of sustainability risks and opportunities, as well as indicators and targets.

The ESRS form a set of 12 standards, of which only 2 are cross-cutting (ESRS 1 and ESRS 2). The other 10 are thematic: 5 environmental (E1 climate, E2 pollution, E3 water and marine resources, E4 biodiversity, E5 circular economy), 4 social (S1 own workforce, S2 value chain, S3 affected communities, S4 consumers) and 1 governance (G1).

• Independent third-party assurance: the sustainability report must be certified by a statutory auditor or an OTI accredited by COFRAC, with a "limited assurance" level initially. The envisaged move to "reasonable assurance" has been abandoned by the Omnibus "Content" Directive (EU) 2026/470: only limited assurance is retained, with a methodological certification standard expected no later than 1 July 2027.

• Publication in xHTML format: the report must be integrated into the management report and tagged according to the European digital taxonomy.

In France, failure to comply with CSRD obligations is sanctioned by the Autorite des Marches Financiers (AMF) for listed companies. Penalties may include:

• injunctions to publish missing information;
• an administrative fine of up to €150,000 for legal entities (art. L.951-1-3 of the Commercial Code); in the absence of certification, criminal penalties (€30,000 and 2 years' imprisonment, rising to €75,000 and 5 years in the event of obstruction); and H2A disciplinary sanctions of up to €1M against statutory auditors or OTIs. The "€10M or 5% of turnover" cap belongs to the duty of vigilance (CS3D directive), not to the CSRD;
• a note in the management report indicating the absence of a sustainability statement;
• for listed companies, a direct impact on ESG ratings and access to financing.

CSRD preparation cannot be improvised. Companies affected by the second wave (2025 financial year, 2026 reporting) have a reduced timeframe. The key steps are:

1. Scope diagnosis: verify thresholds at individual and consolidated level, identify any exemptions.
2. Double materiality analysis: map material ESG issues by involving internal and external stakeholders.
3. Gap analysis: compare already-published information (DPEF, CSR report, universal registration document) with ESRS requirements.
4. Set up data collection processes: adapt data collection tools, integrate the value chain, define responsible parties per indicator.
5. Engage with the assurer: initiate early dialogue with the statutory auditor or OTI to align expectations on the limited assurance level.

Representative example. A French industrial mid-cap with 600 employees and €180M in turnover had launched a full CSRD project in late 2024 (double materiality, data collection, choice of an OTI), convinced it fell under wave 2. Since the Omnibus "Content" Directive (EU) 2026/470, it falls outside the mandatory scope: neither the 1,000-employee threshold nor the €450M threshold is met. Our reading: rather than dropping the project, it redirects the work already under way towards lighter voluntary reporting (VSME), useful to answer requests from its clients and banks, without bearing the full burden of a CSRD it is no longer subject to.

The underestimated risk is no longer over-preparing, but deciding too quickly: belonging to a group of more than 1,000 employees, an acquisition or a listing can bring the company back into scope. The scope diagnosis must be dated, documented and reviewed at each closing.

• the estimate of 50,000 companies (up from 11,700 under the NFRD) is outdated: the Omnibus "Content" Directive (EU) 2026/470 refocuses the scope on around 5,000 entities;
• the mandatory scope now targets companies exceeding simultaneously more than 1,000 employees and more than €450M in net turnover; wave 2 is postponed to financial years beginning on or after 1 January 2027 (reporting 2028);
• listed SMEs are excluded from the mandatory scope (deferral then removal) and may report on a voluntary basis under the VSME standard;
• the Omnibus directive simplifiés certain obligations but does not eliminate the need for a scope diagnosis;
• the sustainability report must be verified by a third party (statutory auditor or COFRAC-accredited OTI);
• penalties for non-compliance are significant, particularly for listed companies.

We can help you qualify the scope, thresholds and compliance roadmap.

Discover our CSR, reporting and CSRD support

In April 2026, the right approach to answering the question CSRD: who is concerned? is to verify the actual scope of the company (thresholds, listed status, consolidated level), the applicable calendar (wave 1 maintained, waves 2 and 3 postponed by two years under the stop-the-clock, listed SMEs now outside the mandatory scope) and the effects of the Omnibus simplification texts before launching a compliance project. The CSRD is not a communication exercise: it is a verified regulatory obligation, and non-compliance exposes companies to substantial penalties.

(Official sources: économie.gouv.fr - Everything you need to know about the CSRD, AMF on CSRD sustainability reporting, EU Directive 2022/2464, Ordinance No. 2023-1142 of 6 December 2023, Decree No. 2023-1394 of 30 December 2023, "stop-the-clock" Directive (EU) 2025/794, Omnibus "Content" Directive (EU) 2026/470, DDADUE Law No. 2025-391 of 30 April 2025, EU Regulation No. 537/2014, portail-rse.beta.gouv.fr)