The Corporate Sustainability Reporting Directive (CSRD) is an EU directive that significantly expands and clarifies the existing sustainability reporting requirements for companies. It replaces the previous Non-Financial Reporting Directive (NFRD) and sets stricter reporting requirements in the areas of environment, social affairs, and corporate governance (ESG ). The aim of the directive is to increase the transparency and comparability of sustainability information, combat greenwashing, and ensure uniform reporting within the EU.
In order to become fully effective, such directives must be "transposed" by the individual member states, i.e., incorporated into national law. As Germany has missed the deadline for this, the EU texts apply directly until further notice. Experts expect the directive to be implemented from fall 2025, but this is not entirely certain given the current government formation.
But what do the CSRD guidelines mean for your business? What do they contain? Are they a serious liability risk or just another paper tiger from Brussels? In the following article, I would like to give you an overview.
I. What do the CSRD guidelines contain?
The CSRD guidelines set out thematic and content requirements for sustainability reports, which form part of companies' management reports. They build on existing reporting requirements from various sectors and standardize them. To a certain extent, this will make things clearer and, above all, more consistent across the EU.
Thematically, affected companies will in future have to prepare their reports under the CSRD in accordance with the new European Sustainability Reporting Standards (ESRS), see Art. 29b Directive 2013/34/EU. This standard essentially divides the report into three core areas on which companies must disclose information:
- Environmental: Includes information on CO₂ emissions, climate risks, energy consumption, resource use, circular economy, biodiversity, and environmental protection measures.
- Social: Includes information on working conditions, employee rights, diversity, human rights in the supply chain, data protection, and customer safety.
- Governance: Includes information on risk management, anti-corruption measures, board structures, and the integration of sustainability into corporate strategy.
In addition to these thematic requirements, the CSRD guidelines also specify concrete content requirements, such as how the report must be structured and from which perspectives companies must address the topics. Essentially, the CSRD stipulates the following:
- Double materiality: The report must assess all thematic aspects from two perspectives:
Inside-out: How does my company and its sustainability risks affect the environment and society?
Outside-in: How do sustainability risks, the environment, and society influence processes in my company?
- Future orientation: In future, sustainability reports must do more than just disclose the current status and data from the past. In particular, the reports must also contain information on future developments and corresponding forecasts.
- Audit requirement: Reports must be audited by a qualified external body to ensure their accuracy. The CSRDs provide for the report to be audited by an auditor. However, as part of the implementation, the Bundestag could also authorize auditors and equivalent auditors to do this.
- ESG strategy: Companies must disclose the measures they are taking to achieve their sustainability goals, how these measures influence their business strategy, and how they are integrated into their operations.
At a later stage, these reports are to be formally standardized. A special format is being considered that is readable by both humans and machines. Such a format is already familiar from the financial sector in the form of the ESEF format for financial reports. However, no concrete information is available on this yet.
II. Am I affected by the new CSRD guidelines?
The reporting requirements will come into force according to a separate timetable, which can be found in Art. 5 of Directive (EU) 2022/2464. This primarily links the reporting requirements to the size of the company, which in turn is determined primarily by Art. 3 IV, VII of Directive 2013/34/EU.
But what does this mean in plain English?
On January 1, 2024, the CSRD came into force for all reports of so-called "large, capital-market-oriented companies of public interest." These companies were already covered by the NFRD regulations in the past, so that the reporting requirements under the CSRD merely represent new content. The first reports under the CSRD are therefore due in the 2025 calendar year.
However, since January 1, 2025, the CSRD also applies to all reports of "large companies and parent companies within the meaning of Art. 3 IV, VII of Directive 2013/34/EU" and thus to a significantly larger group of users. You are considered such a company if you meet two of the following three criteria in the financial year:
- You employ an average of more than 250 people,
- Your net annual turnover exceeds €50 million, or
- Your total assets exceed €25 million per year.
If you manage such a company, you must submit your first CSRD-compliant reports from January 1, 2026.
From January 1, 2026, the CSRD guidelines will then also apply to all reports by listed small and medium-sized enterprises (SMEs) within the meaning of Art. 3 II, III of Directive 2013/34/EU. Your company is considered "medium-sized" if you do not exceed two of the following three criteria in the financial year:
- You employ fewer than 250 people on average,
- Your net annual turnover is less than €25 million, or
- Your balance sheet total is less than €50 million per year.
Your company is considered "small" if you do not exceed two of the following three criteria in the fiscal year:
- You employ fewer than 50 people on average,
- Your net turnover is less than €10 million per year, or
- Your balance sheet total is less than €5 million per year.
In this case, you would have to report in accordance with CSRD from January 1, 2027.
Similarly, from that date, "small and non-complex institutions" as defined in Regulation (EU) No. 575/2013 and captive insurance companies as defined in Directive 2009/138/EC may also be covered. However, special provisions may be made in the national implementation of the Directive.
Finally, from January 1, 2029, the CSRD will also become mandatory for non-EU companies with annual revenues of at least €150 million.
And what if I don't comply with the CSRD regulations?
At present, this would not be particularly dramatic in Germany due to the lack of national implementation.
Since we missed the implementation deadline, the CSRD applies directly until further notice. However, these do not contain their own catalog of sanctions. This leads to the paradoxical situation that, although there is an obligation to comply with the CSRD, companies cannot yet be directly sanctioned for violations due to the lack of their own catalog of sanctions. What would currently be possible, however, would be measures under other laws and reputational damage. The situation is also different for activities abroad, where the guidelines have probably already been fully implemented.
However, national implementation of the directive is expected before the CSRD becomes applicable to reports for "large companies and parent companies" on January 1, 2026. In this case, Germany would also have to adopt an effective, proportionate, and dissuasive catalog of sanctions.
According to the current draft implementation provisions, the CSRD report is to be implemented as an extension of the existing management report under the German Commercial Code (HGB). The planned review is to be carried out by a suitably qualified auditor, who may also be the auditor of the financial statements.
Under the current rules, a breach of the CSRD obligations would be treated as a violation of the existing obligations in connection with the management report, for which the management or the owners would be held responsible. In accordance with the current legal situation, the following sanctions would therefore be expected:
- Fines: As has been the case to date for violations relating to the management report, the competent supervisory authority may impose heavy fines, whereby the management board and managing directors may also be held liable.
- Stock exchange supervisory measures: Listed companies also risk sanctions from the financial supervisory authority.
As things stand at present, responsibility for supervising compliance with the CSRD would fall to the body responsible for the respective management reports. Depending on the type of company and the nature of the violation, the responsible authority would therefore be the BAFin, the Federal Office of Justice, or the respective state authorities. In addition to regulatory sanctions, there is also a risk that violations could lead to a loss of reputation and trust among customers and business partners. It is also to be expected that NGOs or shareholders will hold companies liable under civil law for violations due to missing or misleading reporting.
III. Conclusion
The CSRDs place considerable demands on companies and further expand the reporting requirements already in place in management reports. Therefore, companies affected from 2026 onwards should prepare for the new reporting requirements at an early stage.
As there are currently no signs that Germany will go it alone in implementing the directives, the wording of the EU regulations can be used as a guide for the new obligations. For companies already affected, the fact that no sanctions are currently envisaged for non-compliance can therefore be seen as an opportunity. The period until the CSRD is implemented at national level at the end of the year can thus be regarded as a "trial period."
In summary, these directives are less of a paper tiger and more of a tiger cub that will grow its teeth over the course of the year.
Are you still unsure whether the CSRD is relevant for your business, or are you already affected by the CSRD and would like to have your internal processes independently reviewed in order to prepare yourself and your company for the new legal situation at an early stage?
We are your point of contact! We would be happy to advise you and your company on all questions relating to the CSRD and find tailor-made solutions for your individual case.
The statements represent initial information that was current for the law applicable in Germany at the time of initial publication. The legal situation may have changed since then. Furthermore, the information provided cannot replace individual advice on a specific matter. Please contact us for this purpose.