ESG Reporting Under CSRD in 2026: The Data-Driven Compliance Checklist

What CSRD Actually Requires — Beyond the Buzzwords

CSRD replaces the NFRD with a fundamentally different approach. The old directive asked companies to disclose sustainability information "to the extent necessary." CSRD mandates specific, standardized, audited disclosures using the European Sustainability Reporting Standards (ESRS).

The shift is structural, not cosmetic. Here is what changed:

That last row is where most companies underestimate the workload. CSRD does not just ask what your company emits or consumes. It asks about your suppliers, your customers, the end-of-life of your products, and the social conditions across your value chain.

The 12 ESRS Standards: What You Must Report

The ESRS framework is divided into cross-cutting standards and topical standards. Every company subject to CSRD must address all of them — though the depth depends on your double materiality assessment.

Cross-Cutting Standards

• ESRS 1 — General Requirements: the framework rules, boundaries, and reporting principles
• ESRS 2 — General Disclosures: governance, strategy, material impacts, metrics and targets. This one is mandatory for everyone with no materiality filter

Environmental Standards

• ESRS E1 — Climate Change: GHG emissions (Scope 1, 2, and 3), transition plans, carbon pricing exposure
• ESRS E2 — Pollution: air, water, soil pollutants, substances of concern
• ESRS E3 — Water and Marine Resources: consumption, discharge, water stress areas
• ESRS E4 — Biodiversity and Ecosystems: impact on species, land use, ecosystem degradation
• ESRS E5 — Resource Use and Circular Economy: waste generation, recycling rates, product design for circularity

Social Standards

• ESRS S1 — Own Workforce: working conditions, diversity, pay gaps, health and safety data
• ESRS S2 — Workers in the Value Chain: conditions of suppliers' workers, due diligence
• ESRS S3 — Affected Communities: impacts on local communities, indigenous rights
• ESRS S4 — Consumers and End-Users: product safety, data privacy, accessibility

Governance Standard

• ESRS G1 — Business Conduct: anti-corruption, lobbying, political engagement, payment practices

In total, the 12 standards contain 82 mandatory disclosure requirements and over 1,100 individual data points. This is not a narrative exercise. It requires structured, quantified, verifiable data.

Double Materiality: The Concept That Trips Everyone Up

Double materiality is CSRD's signature requirement and its most misunderstood concept. It asks two questions simultaneously:

1. Impact materiality: How does your company affect the environment and society? (inside-out perspective)
2. Financial materiality: How do sustainability issues affect your company's financial performance? (outside-in perspective)

A topic is material if it is significant from either perspective. You cannot skip climate change reporting because it does not affect your bottom line if your operations contribute to emissions. Conversely, you cannot skip water scarcity reporting because you do not pollute water — if water scarcity threatens your supply chain, it is financially material.

The double materiality assessment must be documented, stakeholder-informed, and reviewed annually. Most companies that fail their first CSRD audit fail on this step — either because they skipped topics without justification or because the assessment was performed by marketing rather than by a cross-functional team with actual subject-matter expertise.

Scope 3 Emissions: The Data Black Hole

ESRS E1 requires disclosure of Scope 1 (direct), Scope 2 (purchased energy), and Scope 3 (value chain) greenhouse gas emissions. For most companies, Scope 3 represents 70-90% of total emissions and is by far the hardest to measure.

The practical challenge: you need data from hundreds or thousands of suppliers, many of whom do not track their own emissions. The CSRD acknowledges this by allowing estimates and proxies for the first reporting periods, but the expectation is that data quality improves year over year.

Start with the categories that represent the largest share of your footprint. For most manufacturers, that is purchased goods. For service companies, it is typically business travel and purchased services.

The Audit Requirement: Limited Assurance Is Not Optional

CSRD mandates third-party assurance of sustainability reports. Initially, the standard is "limited assurance" — roughly equivalent to a review engagement in financial auditing. The European Commission plans to move to "reasonable assurance" (full audit equivalent) by 2028.

What this means in practice: an independent auditor will test your data collection processes, verify a sample of your reported numbers, and assess whether your double materiality assessment is reasonable. If your ESG data lives in spreadsheets maintained by one person in the sustainability team, you will not pass.

Companies that passed their 2025 audits share common traits: centralized ESG data platforms, documented data collection methodologies, clear ownership of each data point, and internal validation before external audit. Companies that failed share one trait: they treated ESG reporting as a communication project rather than a data governance project.

Penalties for Non-Compliance

CSRD enforcement is delegated to EU member states, so penalties vary. However, the directive requires member states to implement "effective, proportionate and dissuasive" sanctions. Current penalty frameworks include:

• France: up to €75,000 for failure to publish sustainability information, with personal liability for directors
• Germany: fines up to €10 million or 5% of annual turnover for listed companies under the new implementation act
• Netherlands: financial regulators (AFM) can impose administrative fines and public reprimands
• Italy: Consob can impose fines between €50,000 and €500,000 for non-compliant listed companies

Beyond regulatory fines, there is a growing wave of greenwashing litigation from NGOs, investors, and consumer groups using CSRD-mandated disclosures (or their absence) as evidence. Our analysis of greenwashing fines in 2025-2026 shows that enforcement bodies increasingly cross-reference company marketing claims against their CSRD reports.

Your 10-Step CSRD Compliance Checklist

1. Confirm your reporting timeline — Large listed companies: reporting for FY2024 (published 2025). Large non-listed 250+ employees: FY2025 (published 2026). Listed SMEs: FY2027 (published 2028).
2. Conduct a double materiality assessment — Cross-functional team, stakeholder engagement, documented methodology. Budget 3-6 months.
3. Map your value chain — Identify Tier 1 and critical Tier 2 suppliers. Start supplier ESG data collection early.
4. Select your ESG data platform — Spreadsheets will not survive audit. Evaluate specialized platforms (Workiva, Sphera, Sweep, Persefoni) or ERP-integrated modules.
5. Assign data ownership — Every ESRS data point needs a named owner, a collection methodology, and a validation process.
6. Calculate your carbon footprint — Scope 1 and 2 first (use GHG Protocol), then Scope 3 by category. Document all assumptions and emission factors.
7. Draft your transition plan — ESRS E1 requires a climate transition plan if climate change is material. Science-based targets are not mandatory but strongly recommended.
8. Prepare your XHTML report — CSRD reports must be in XHTML format with iXBRL digital tags. Your reporting platform should handle this.
9. Engage your auditor early — Do not wait until the report is final. Involve your assurance provider in the methodology review phase.
10. Scan your marketing claims — Cross-reference every environmental claim on your website and marketing materials against your CSRD disclosures. Inconsistencies between marketing and mandatory reporting are the fastest path to a greenwashing accusation. Our free greenwashing checker can flag risky claims in under 60 seconds.

The Connection Between CSRD and Greenwashing Risk

CSRD creates a new category of greenwashing risk that did not exist under NFRD. When your sustainability report is standardized, audited, and publicly available, every marketing claim becomes testable against disclosed data.

If your website says "we reduced emissions by 30%" but your CSRD report shows Scope 3 emissions increased, regulators and litigators have the evidence they need. If your product packaging claims "sustainable sourcing" but your ESRS S2 disclosure reveals supply chain due diligence gaps, the contradiction is on the public record.

The companies that will navigate this successfully are those that align their marketing claims with their reported data — not the other way around. The EU Green Claims Directive, expected to be enforced from 2026-2027, will make this alignment a legal requirement. Our ECGT guide covers the intersection of these two frameworks in detail.