CSRD Compliance for Non-EU Companies: What You Must Do in 2026 and Beyond

Introduction: Why Non-EU Companies Are Not Outside the CSRD Perimeter

The Corporate Sustainability Reporting Directive — Directive 2022/2464/EU (CSRD), amending Directive 2013/34/EU on annual financial statements — has been described by commentators as the most ambitious mandatory sustainability disclosure framework in history. Its scope, however, extends well beyond the European Union's territorial borders, and the C-suite executives of non-EU groups who have deferred engagement on the grounds that "this is a European rule" are operationally behind.

Under Article 40a of the amended Directive 2013/34/EU, third-country undertakings — companies incorporated outside the EU — that generate net turnover in the European Union exceeding €150 million and that have at least one qualifying EU subsidiary or EU branch are within CSRD's scope. The disclosure obligation is triggered at the consolidated group level, which means that a US, Chinese, Japanese, or Saudi parent company with meaningful EU commercial operations must produce a sustainability report conforming to European standards, subject to limited equivalence relief.

This article addresses the compliance obligations of non-EU groups systematically: who is caught, what must be disclosed, how the double materiality assessment works, what the assurance regime requires, and how the revised timeline following the EU Commission's February 2025 Omnibus Simplification Package affects planning horizons. The analysis is framed for CFOs, Chief Sustainability Officers, and Chief Legal Officers managing the interface between commercial imperatives and regulatory requirements across jurisdictions.

CSRD Scope: Which Non-EU Companies Are Actually Caught

The Article 40a Trigger Test

The CSRD's reach into non-EU corporate groups operates through Article 40a of amended Directive 2013/34/EU, introduced by Article 1(5) of Directive 2022/2464/EU. The provision applies to undertakings from third countries — defined as any country not an EU member state — that satisfy two cumulative conditions:

Condition 1 — EU net turnover threshold: The third-country parent's net turnover generated in the European Union exceeds €150 million in each of the last two consecutive financial years. For groups with diversified revenue streams, "net turnover in the EU" means revenue attributable to customers established in EU member states, assessed in accordance with the accounting rules applicable to the group.

Condition 2 — Qualifying EU presence: The group has either:

• At least one large EU subsidiary undertaking (i.e., meeting at least two of: balance sheet total exceeding €20 million; net turnover exceeding €40 million; more than 250 employees on average); or
• At least one EU branch generating net turnover exceeding €40 million.

Both conditions must be met simultaneously. A non-EU group with €200 million EU turnover but only small EU subsidiaries (all below the large-company thresholds) would not be caught by Article 40a — though it may still be indirectly affected through supply chain disclosure requirements imposed on its EU customers.

Subsidiary-Level Reporting Versus Group-Level Reporting

The CSRD creates two distinct reporting obligations that frequently coexist in a non-EU group:

EU subsidiary reporting: Large EU subsidiaries of non-EU groups are subject to CSRD in their own right as large undertakings under Article 19a of the amended directive. These subsidiaries must report on sustainability matters using the full European Sustainability Reporting Standards (ESRS) unless exempted. An EU subsidiary may be exempted from individual reporting if it is included in a consolidated sustainability report prepared at the parent level — but only if that report meets ESRS requirements or is deemed equivalent.

Consolidated group reporting under Article 40a: The non-EU parent must publish a consolidated sustainability report for the entire group. This report covers the parent and all subsidiaries globally, not merely EU operations. The rationale — which has been politically contentious — is that investors and stakeholders in the EU require information about the full value chain's sustainability impacts, not merely the EU portion.

The Omnibus Simplification Package: Where Things Stand

The EU Commission published its Omnibus Simplification Package on 26 February 2025, proposing material amendments to CSRD. Two measures directly affect timing and scope:

The "Stop-the-Clock" Directive (Directive (EU) 2025/794, adopted April 2025) postponed Phase 2 by two years (to financial years starting 1 January 2027, reporting in 2028) and Phase 3 by two years (to financial years starting 1 January 2028, reporting in 2029). This directive entered into force and was transposed by member states.

The Omnibus I Proposal (COM(2025) 87 final) proposed more fundamental changes: raising the employee threshold for CSRD applicability to 1,000 employees, introducing more targeted materiality-based ESRS, and revising the third-country provision. As of the date of this article, the Omnibus I Proposal remained under co-decision between the European Parliament and the Council. Its final form is not yet legislated.

Practical implication for non-EU groups: The Article 40a obligation for third-country companies applies to financial years starting on or after 1 January 2028 (reporting in 2029) under the current delayed timeline. Planning horizons must account for the possibility that the Omnibus I Proposal, if adopted in materially revised form, could further reduce scope or modify ESRS requirements applicable to third-country groups.

Comparison: EU vs. Non-EU Company CSRD Timeline

*Subject to Stop-the-Clock Directive (EU) 2025/794 and final Omnibus I outcome.

The ESRS Framework: Architecture of Required Disclosures

What Are the ESRS?

The European Sustainability Reporting Standards are the technical content standards that specify what CSRD-subject companies must actually disclose. They were adopted as Commission Delegated Regulation (EU) 2023/2772, published in the Official Journal on 22 December 2023. For the purposes of Article 40a group reporting, the Commission is required to adopt specific ESRS for third-country companies by 30 June 2026 — this set of standards is referred to as the "sector-agnostic third-country ESRS" or the "ESRS for non-EU groups."

The full ESRS architecture comprises:

Cross-cutting standards (mandatory for all in-scope companies):

• ESRS 1 (General Requirements): Principles governing sustainability reporting, including the double materiality approach, value chain coverage, reporting boundary, and interoperability with other frameworks (GRI, TCFD, SASB, UN SDGs)
• ESRS 2 (General Disclosures): Governance, strategy, and materiality process disclosures that are unconditionally mandatory regardless of materiality assessment outcomes

Environmental standards (E1–E5):

• E1: Climate change (GHG emissions Scope 1/2/3, transition planning, physical/transition risk)
• E2: Pollution (air, water, soil, substances of concern)
• E3: Water and marine resources
• E4: Biodiversity and ecosystems
• E5: Resource use and circular economy

Social standards (S1–S4):

• S1: Own workforce (working conditions, wages, collective bargaining, health and safety)
• S2: Workers in the value chain
• S3: Affected communities
• S4: Consumers and end-users

Governance standard (G1):

• G1: Business conduct (anti-corruption, lobbying, payment practices, supply chain management)

Conditional vs. Unconditional Disclosure Requirements

ESRS 1 introduces a critical distinction that CFOs and CSOs must internalize: the difference between unconditional (mandatory) and conditional (subject to materiality) disclosure requirements.

ESRS 2 disclosures are unconditionally mandatory. Every in-scope company must disclose governance, strategy, materiality methodology, and targets information under ESRS 2 regardless of what its materiality assessment concludes. There are no opt-outs.

Topical ESRS disclosures (E1–E5, S1–S4, G1) are conditional on the materiality assessment. If a company concludes through a properly conducted double materiality assessment that a given topic is not material to it — for example, that water resources (E3) are not material for a software business — it may omit E3 disclosures, provided it explains its materiality reasoning. This "comply or explain" architecture provides flexibility but requires a defensible, documented materiality process.

Phase-in provisions. For companies in their first year of reporting, ESRS 1 permits omission of certain data points — notably Scope 3 GHG emissions (ESRS E1-6) and own workforce data points requiring primary data collection (ESRS S1). These phase-ins were designed to allow companies to build data infrastructure progressively.

The Role of Sector-Specific ESRS

Beyond the sector-agnostic ESRS adopted in Delegated Regulation 2023/2772, the Commission was mandated to develop sector-specific ESRS for approximately 40 sectors. These were expected to include sectors such as oil and gas, mining, financial services, food and agriculture, and automotive manufacturing. As of early 2026, the first tranche of sector-specific standards remained in development following consultation feedback and the Omnibus simplification process. Non-EU groups in highly material sectors should monitor the EFRAG (European Financial Reporting Advisory Group) technical working group outputs, which provide advance visibility into disclosure requirements.

Double Materiality: The Analytical Core of CSRD

What Double Materiality Means in Legal Practice

The concept of double materiality — embedded in ESRS 1 and derived from the European Commission's 2019 guidelines on non-financial reporting — is the single most analytically demanding component of CSRD compliance for non-EU groups accustomed to single-perspective materiality frameworks such as GRI (impact-only) or TCFD (financial-only).

ESRS 1, paragraph 29, defines double materiality as comprising two nested perspectives that must be assessed simultaneously:

Impact materiality (inside-out perspective): A sustainability topic is impact-material if it relates to the company's actual or potential, positive or negative, short-, medium-, or long-term impacts on people or the environment. This perspective asks: what does the company do to the world? ESRS 1 paragraph 43 requires that the company assess impacts across its own operations and its value chain, including upstream suppliers and downstream customers.

Financial materiality (outside-in perspective): A topic is financially material if information about it could reasonably be expected to influence the decisions of the company's primary users (investors, creditors, insurers). This perspective asks: what does the external environment do to the company's financial performance, position, and cash flows? Physical climate risks, stranded asset exposure, regulatory carbon costs, and reputational risk from supply chain labor conditions are examples.

A topic is material under CSRD if it satisfies either the impact materiality test or the financial materiality test. The two lenses are additive, not conjunctive.

Conducting the Double Materiality Assessment: Minimum Methodological Requirements

ESRS 1 does not prescribe a single methodology for the double materiality assessment, but it specifies requirements that any defensible methodology must satisfy:

Identify the universe of topics. The starting point is the full list of sustainability matters specified in Appendix A of ESRS 1 (which mirrors the topical ESRS headings). Companies may not narrow the initial universe based on assumptions about materiality before the assessment is conducted.

Involve stakeholders. ESRS 1 paragraph 22 requires that the assessment process take into account the views and interests of stakeholders, defined to include employees, affected communities, investors, customers, and civil society organizations. This is not a box-ticking requirement — EFRAG's implementation guidance emphasizes that stakeholder engagement must be substantive and documented.

Apply severity and likelihood criteria for impact materiality. ESRS 1 paragraphs 46–50 specify that the severity of actual impacts is determined by scale, scope, and irremediability. For potential impacts, severity is weighted by the probability of occurrence. Human rights impacts may qualify as material by severity alone, without requiring quantification.

Apply financial effect and likelihood criteria for financial materiality. Financial materiality is assessed by reference to the magnitude of financial effects and the probability that those effects will materialize. ESRS 1 paragraph 53 notes that a reasonable threshold may be set by reference to the quantitative materiality concept used in financial reporting (typically 1–5% of a relevant financial metric), but qualitative factors can trigger materiality below quantitative thresholds.

Document the process and outcomes. ESRS 2, Disclosure Requirement IRO-1 (Identification, Assessment, and Management of Impacts, Risks, and Opportunities) requires a description of the materiality assessment process, including the criteria used, the sources of evidence, and the conclusions drawn. This documentation will be subject to assurance scrutiny.

Double Materiality for Non-EU Groups: Specific Challenges

Non-EU groups face three distinctive challenges in conducting double materiality assessments:

Value chain scope in global operations. The requirement to assess impacts across the value chain — including upstream supply chains that may span dozens of countries — generates significant data collection burdens. A US food company sourcing agricultural commodities globally must assess deforestation (ESRS E4), water impacts (ESRS E3), and supply chain labor conditions (ESRS S2) across a value chain that CSRD does not territorially limit to EU operations.

Interoperability with existing frameworks. Many non-EU groups already report under TCFD, GRI, CDP, or SEC climate disclosure rules. The double materiality assessment under ESRS 1 is not identical to any of these. GRI's impact materiality is conceptually closest to ESRS impact materiality, but the ESRS methodology is more prescriptive on stakeholder engagement and severity criteria. TCFD's financial risk methodology is closest to ESRS financial materiality, but the ESRS requirements are broader (covering all ESG topics, not only climate). Legal teams should map existing materiality processes against ESRS requirements before concluding that existing assessments are sufficient.

The "reasonable assurance" horizon. CSRD's assurance requirements (discussed below) will ultimately require limited and eventually reasonable assurance on the double materiality process and its outcomes. Building an assurance-ready materiality methodology now — with auditable documentation, traceable stakeholder input, and defensible scoring criteria — is substantially less expensive than retrofitting assurance readiness later.

What Non-EU Companies Must Disclose: Headline Requirements by Topic

Climate Change (ESRS E1)

For most non-EU groups, climate change will be a material topic under both impact materiality (Scope 1–3 GHG emissions) and financial materiality (physical risks, transition risks, carbon costs). Key ESRS E1 disclosure requirements include:

• Transition plan for climate change mitigation (ESRS E1-1): Disclosure of the company's plan to transition to a 1.5°C-aligned economy, including decarbonization targets, capital allocation, and governance accountability. This must be consistent with any transition plan published under other frameworks (e.g., the International Sustainability Standards Board's IFRS S2).
• GHG Scope 1, 2, and 3 emissions (ESRS E1-6): Mandatory disclosure of absolute GHG emissions (metric tonnes CO₂ equivalent) across all three scopes. Scope 3 may be deferred in the first year of reporting under phase-in provisions. The GHG Protocol methodology is the reference standard.
• Physical and transition climate risks (ESRS E1-9): Quantitative disclosure of the financial effects of climate-related risks and opportunities over short, medium, and long time horizons. This requirement aligns with TCFD's scenario analysis approach, and companies with existing TCFD reporting can build on that work.

Own Workforce (ESRS S1)

For non-EU groups with EU subsidiaries employing EU workers, ESRS S1 creates significant disclosure obligations regarding:

• Employment characteristics (headcount, contracts, working hours, remuneration)
• Working conditions (health and safety, work-life balance)
• Equal treatment (gender pay gap, pay transparency compliance with Directive 2023/970/EU)
• Collective bargaining coverage and social dialogue
• Cases of severe human rights violations

ESRS S1 data points require granular HR data that many multinationals do not currently collect on a comparable cross-jurisdiction basis. The gender pay gap disclosure requirement interacts directly with the EU Pay Transparency Directive (Directive 2023/970/EU), which requires employers with 100 or more employees in the EU to report gender pay gap data from 2027.

Business Conduct (ESRS G1)

ESRS G1 requires disclosures on:

• Anti-corruption and anti-bribery policies and training (interacting with EU Directive 2017/1371 on the fight against fraud, and member state transpositions of UN Convention Against Corruption obligations)
• Political engagement and lobbying activities
• Payment practices with respect to suppliers (average payment period; share of invoices paid after contractual terms)
• Animal welfare (if material)

For US-listed companies already disclosing under Sarbanes-Oxley Section 404 and the Foreign Corrupt Practices Act (FCPA), much of the G1 governance infrastructure will already exist. The ESRS G1 requirements on payment practices and lobbying may, however, require new data collection.

Assurance Requirements: The External Auditor's Role

The Phased Assurance Regime

CSRD introduced a phased assurance regime that is unprecedented in global sustainability disclosure:

Phase 1 — Limited assurance: For the initial years of reporting (Phase 1 companies from FY 2024; Phase 4 non-EU companies from the start of their obligation), the assurance requirement is limited assurance. Under IAASB's ISAE 3000 (Revised) or the equivalent EU sustainability assurance standard (ISSA 5000, published December 2023), limited assurance requires the auditor to conclude that nothing has come to its attention to indicate that the sustainability statement contains material misstatements. This is a review-level engagement, not a full audit.

Phase 2 — Reasonable assurance: CSRD Article 26a provides that the Commission shall assess, by 2026, whether limited assurance provides sufficient reliability and whether a transition to reasonable assurance (positive assurance, equivalent to a financial statement audit) is feasible. If the Commission determines that reasonable assurance is technically achievable at proportionate cost, it may mandate the transition by delegated act. For non-EU groups entering reporting in 2029, it is quite possible that the applicable standard will be reasonable assurance from the outset.

ISSA 5000: The New Global Assurance Standard

The International Auditing and Assurance Standards Board (IAASB) published ISSA 5000 (International Standard on Sustainability Assurance 5000) in November 2024. This is the first comprehensive standard designed specifically for sustainability assurance engagements and provides the framework for both limited and reasonable assurance of ESRS-compliant reports.

Key features of ISSA 5000 that non-EU groups must understand:

Engagement scope: ISSA 5000 applies to sustainability information prepared under ESRS but also under other frameworks (IFRS S1/S2, GRI). It requires the practitioner to assess the company's materiality process, the completeness and accuracy of disclosures, and the reliability of underlying data.

Value chain data: ISSA 5000 recognizes that sustainability information frequently involves supply chain data not under the reporting entity's direct control. It sets requirements for how practitioners should treat such data, including the use of third-party assurance reports on suppliers.

Practitioner qualifications: CSRD Article 34(3) allows sustainability assurance to be performed by either registered statutory auditors (under Directive 2006/43/EC) or independent assurance service providers, subject to member state authorization. Several member states (Germany, France, the Netherlands) have adopted or are adopting competency frameworks for sustainability assurance practitioners that go beyond those required for financial auditing.

Practical Implications for Non-EU Groups

The assurance requirement has three concrete operational implications that general counsel and CFOs should address:

Data governance infrastructure. Assurance-ready sustainability reporting requires documented data governance processes equivalent to those used for financial reporting: clear data ownership, audit trails, internal controls over non-financial data collection, and reconciliation procedures. Non-EU groups that cannot demonstrate the provenance and reliability of sustainability KPIs will face material misstatement findings.

Auditor selection. The group sustainability report under Article 40a must be assured by a practitioner recognized in the EU member state where the assurance report is issued. Non-EU groups that currently use sustainability assurance from non-EU-recognized providers (e.g., a US-only sustainability assurance firm) will need to engage an EU-authorized practitioner for CSRD purposes. The Big Four and second-tier firms have invested heavily in CSRD assurance capability and are the primary providers.

Group audit coordination. For groups already subject to statutory audit under EU rules (because their EU subsidiaries produce statutory accounts), coordinating the sustainability assurance engagement with the existing statutory audit structure — potentially using the same audit network — is operationally efficient and reduces the risk of inconsistencies between the financial audit findings and the sustainability assurance findings.

Timeline, Current Regulatory Status, and Planning Implications

CSRD Implementation Status as of Q2 2026

Following the adoption of the Stop-the-Clock Directive (EU) 2025/794 in April 2025 and the ongoing co-decision process on Omnibus I (COM(2025) 87 final), the CSRD compliance timeline for non-EU groups is:

Current confirmed obligation (Article 40a): Financial years starting on or after 1 January 2028, with the first report due in 2029.

Omnibus I uncertainty: The Omnibus I Proposal, if enacted, would raise the CSRD employee threshold from 250 to 1,000 employees and introduce a more targeted ESRS. Whether and how these changes will apply to the Article 40a third-country provision remains subject to co-decision. Non-EU groups should monitor the EP JURI/ECON committee positions and Council mandates.

Third-country ESRS standards: The Commission is required by 30 June 2026 to adopt sector-agnostic ESRS for third-country groups under Article 40a. EFRAG published exposure drafts in late 2025. These ESRS are expected to be less granular than the full ESRS applicable to EU companies, with broader use of equivalent framework relief.

Equivalence determinations: Article 40a(4) permits the Commission to determine that a third country's sustainability reporting requirements are equivalent to ESRS, allowing companies from that country to report under national standards instead. As of mid-2026, no formal equivalence determination has been made. The Commission has published a framework for equivalence assessments. Non-EU groups from jurisdictions with maturing sustainability disclosure regimes (US SEC climate rules, ISSB-adopting jurisdictions, Japan's SSBJ standards) should monitor equivalence determinations, which could materially reduce ESRS compliance burden.

Strategic Planning Horizons for Non-EU Groups

Practical Takeaways for Corporate Counsel

1. Confirm your Article 40a trigger status now, not in 2028. The two-condition test (€150M EU net turnover AND qualifying EU subsidiary/branch) requires careful analysis of revenue attribution methodology and subsidiary size thresholds. Revenue classification between EU and non-EU customers must be defensible under the applicable accounting standards. A group that discovers in 2028 that it has been in scope since the directive's original drafting will face compressed timelines, reputational risk, and potential enforcement exposure. Member state competent authorities (typically financial regulators or company law registries) are developing inspection frameworks, and the European Securities and Markets Authority (ESMA) has been mandated to coordinate supervisory convergence on CSRD enforcement.

2. Do not treat the double materiality assessment as a disclosure exercise — treat it as a governance decision. The double materiality assessment determines what the company will disclose and what it will not. An inadequate or poorly documented materiality assessment is both an audit finding and a litigation risk — third parties (NGOs, investors, employee representatives) with legal standing in EU member states may challenge the adequacy of a materiality conclusion. Build the assessment process with legal defensibility in mind: use independent facilitation, document stakeholder input, record scoring decisions with reasoning, and have legal counsel review the methodology before the assessment is finalized.

3. Interoperability with ISSB (IFRS S1/S2) is real but limited. Many non-EU groups are simultaneously implementing IFRS S1 and S2 sustainability disclosure requirements in jurisdictions that have adopted ISSB standards (Australia from FY2025; UK ISSB-based standards from 2026; Japan SSBJ standards; Singapore, Canada, and others). ESRS 1 was designed with "building block" interoperability with ISSB standards, and companies producing ISSB-compliant reports will satisfy a material portion of ESRS disclosure requirements. However, the double materiality expansion under ESRS (which adds impact materiality not required by ISSB) and additional topical requirements (notably ESRS S1–S4 on workforce and human rights, and ESRS E4 on biodiversity) mean that ISSB compliance alone is insufficient for ESRS purposes. Commission Delegated Regulation (EU) 2023/2772 Annex II contains the detailed cross-reference table mapping ESRS data points to ISSB, GRI, and TCFD.

4. Supply chain disclosure will be the most operationally demanding requirement. ESRS E1 Scope 3 GHG emissions, ESRS S2 (workers in the value chain), and ESRS E4 (biodiversity impacts in value chains) all require data about suppliers and customers that non-EU groups do not currently collect systematically. Begin mapping tier-1 suppliers against ESRS topical areas in 2026. The EU's Corporate Sustainability Due Diligence Directive (CS3D, Directive 2024/1760/EU) creates parallel value chain due diligence obligations for large EU companies and their non-EU parents, and the two instruments should be addressed in a coordinated compliance program rather than in silos. Companies that build ESRS-aligned supplier data collection frameworks in 2026–2027 will simultaneously advance CS3D compliance.

5. The Article 40a group report requires publication in the EU. Under Article 40a(3), the consolidated sustainability report must be made publicly available. The Commission-adopted implementing act on access (yet to be finalized as of mid-2026) is expected to require publication through the European Single Access Point (ESAP), the centralized data repository under Regulation (EU) 2023/2859. Non-EU groups should identify the EU member state in which their qualifying subsidiary is established — typically the member state of the largest or principal EU subsidiary — as that member state's law will govern the local transposition of Article 40a filing and publication requirements. Engaging local corporate counsel in that jurisdiction is essential for understanding the precise national transposition, enforcement competence, and filing mechanics.

Conclusion

The Corporate Sustainability Reporting Directive is, for many non-EU multinationals, the first time that a sustainability regulatory obligation has arrived with the architectural precision and enforcement infrastructure of financial reporting law. It brings mandatory standards, external assurance, and competent authority supervision to a domain previously governed by voluntary frameworks and reputational incentives.

Non-EU groups that are within scope under Article 40a — and the €150 million EU turnover threshold captures a very large proportion of multinationals with meaningful EU commercial operations — have a planning window of roughly two years before the first reporting obligation falls due. That window is not a luxury. The double materiality assessment, data infrastructure buildout, value chain engagement, assurance provider selection, and internal governance reforms required to produce a compliant and assurance-ready ESRS report are each multi-month undertakings that cannot be compressed into the months immediately preceding the reporting deadline.

The regulatory environment remains in motion: the Omnibus I Proposal, third-country ESRS standards, and equivalence determinations will all materially affect the precise requirements applicable in 2028. General counsel's role is not to wait for regulatory certainty before acting — it is to build a compliance architecture flexible enough to absorb those changes while ensuring that the organization is not exposed to the execution risk of a last-minute sprint. The legal, governance, and data infrastructure required for CSRD compliance is, in material respects, the same infrastructure required for a credible sustainable business strategy.

Legal Disclaimer: This article is provided for general informational purposes only and does not constitute legal advice. The laws, directives, and regulations described are complex, subject to ongoing legislative development, and vary in their national transposition across EU member states. Nothing in this article should be relied upon as a substitute for qualified legal or compliance advice from counsel admitted in the relevant jurisdiction. Morvantine and its contributors assume no liability for actions taken or omitted on the basis of the information contained herein. Readers should obtain independent legal and regulatory advice tailored to their specific circumstances before making compliance decisions.