Which Companies Report on CSRD?

For Chief Sustainability Officers, ESG Controllers, and Corporate Reporting Teams, understanding exactly which companies report on CSRD (the Corporate Sustainability Reporting Directive) is the critical first step in regulatory compliance.

Unlike the older Non-Financial Reporting Directive (NFRD), which only applied to roughly 11,000 entities, the CSRD casts a significantly wider net. It is estimated that over 50,000 companies globally will be required to disclose their sustainability performance under the rigorous European Sustainability Reporting Standards (ESRS). Importantly, you do not need to be headquartered in Europe to be in scope.

The directive fundamentally shifts sustainability reporting from a voluntary marketing exercise into a mandatory, highly structured, and audited financial-grade process.

The 4 Waves of CSRD Compliance

The European Union designed the CSRD rollout in phased cohorts to allow the market time to adjust. Determining which companies report on CSRD—and when—depends primarily on company size, revenue, and previous reporting obligations.

Here is the compliance timeline your reporting team needs to follow as we navigate the 2026 reporting cycles:

Wave 1: NFRD Legacy Companies (Reporting in 2025)

This wave covers companies that were already subject to the previous NFRD guidelines. They tracked data for the Financial Year (FY) 2024 and issued their first CSRD-aligned reports in 2025.

• Criteria: Large public-interest entities (listed companies, banks, insurance companies) with more than 500 employees.

Wave 2: Large EU Companies (Reporting in 2026)

This is the most significant expansion of the directive and is the current focus for many compliance teams. Companies in this cohort tracked their ESG data for FY 2025 and are publishing their reports in 2026.

• Criteria: Any EU company (listed or unlisted) that meets at least two of the following three financial thresholds for two consecutive balance sheet dates (reflecting the recent EU Omnibus adjustments):
  • More than 250 employees
  • More than €50 million in net turnover (revenue)
  • More than €25 million in total assets

Wave 3: Listed SMEs (Reporting in 2027)

Small and Medium-sized Enterprises (SMEs) whose securities are admitted to trading on an EU-regulated market must begin data collection for FY 2026, with reports due in 2027.

• Criteria: Listed SMEs (excluding micro-enterprises). Note: These entities have the option to opt-out of reporting until FY 2028 if they provide an explanation in their management report.

Wave 4: Non-EU Companies (Reporting in 2029)

The CSRD has a massive extraterritorial impact. Non-EU parent companies must collect global consolidated ESG data for FY 2028 and report in 2029.

• Criteria: Non-EU companies generating a net turnover of more than €150 million within the EU for two consecutive years, AND having at least one large or listed EU subsidiary, or an EU branch generating more than €40 million in revenue.

How to Determine If Your Enterprise is in Scope

If you are unsure whether your organization falls under these mandates, your corporate reporting and legal teams must conduct an immediate entity-level scoping assessment.

Large multinational enterprises often face complex legal structures. You must map out all EU subsidiaries to determine if they meet the "Large EU Company" thresholds individually. In many cases, it is more efficient for the global parent company to publish a consolidated CSRD report that exempts those EU subsidiaries from individual filings—a strategy that requires immense data centralization.

Once scoping is complete, the next immediate step is conducting a Double Materiality Assessment (DMA) to define exactly which sustainability topics your scoped entities must disclose under the ESRS.

Preparing for the Audit: Why Spreadsheets Won't Work

Understanding which companies report on CSRD is only half the battle; understanding how to collect the data is where the true challenge lies.

The most disruptive element of the CSRD is the requirement for mandatory third-party assurance (limited assurance). Auditors will not simply accept top-line emission numbers or vague diversity metrics. They will demand to see the deep data lineage for every single data point disclosed under the ESRS.

Relying on manual spreadsheets, disconnected emails, and siloed departmental tools is a severe compliance risk. To pass a CSRD audit, corporate reporting teams require a centralized, digital infrastructure capable of handling massive volumes of structured and unstructured non-financial data.

Enterprise ESG data management is complex, but your software doesn't have to be. The Novisto CSRD Difference is that our platform is built explicitly for enterprise compliance complexity and double materiality.

Here is how Novisto empowers your organization to meet CSRD mandates with confidence:

• FLEXIBLE DATA CAPTURE: Automate and unify the collection of unstructured, messy, disparate ESG data required for ESRS disclosure from across your entire organization and value chain.
• CFO-GRADE, AUDIT-READY: Guarantee absolute compliance. Every data point, qualitative disclosure, and policy can be traced directly back to its source, calculation methodology, owner, approval workflow, and full change history.
• TRUSTED ESG DATA FOUNDATION: Seamlessly bridge the gap between financial and non-financial reporting. Translate double materiality assessment results directly into structured ESRS metrics, frameworks, controls, and narrative disclosures.
• POWERFUL MODELLING: Map and structure your entire ESG data footprint to match the complex, multi-layered requirements of CSRD, easily adapting the framework as regulatory standards and your business evolve.

Ready to build your audit-ready ESG data foundation? Book a Demo today to see how Novisto simplifies your CSRD compliance journey.