Which companies are subject to the CSRD?
In addition to the “first wave” companies (large public-interest entities), which were already subject to annual sustainability reporting obligations, the following have now become “reporting companies”:
- EU companies that, on their balance sheet dates, exceed a net turnover of EUR 450 million and have more than 1,000 employees during the financial year (including parent undertakings on a consolidated basis);
- Non-EU companies that generated more than EUR 450 million in net turnover in the EU in each of the two preceding consecutive financial years, or that have an EU subsidiary with a net turnover exceeding EUR 200 million in the preceding financial year.
In the case of parent undertakings that are financial holding companies whose subsidiaries have independent business models and operations, there is the option not to include sustainability information.
What is the content of the information to be reported?
Includes all information already specified in respect of environmental, social and governance (ESG) domains, as set out in the sustainability reporting standards (ESRS), which will, however, be revised with a view to simplification, reduction of information, and prioritisation of quantitative information.
The Directive further establishes reporting companies’ right to omit certain information, in limited cases, as follows: (i) where disclosure would be “seriously prejudicial to the commercial position” of the company; (ii) information relating to intellectual capital, intellectual property, know-how, and technological or innovation outputs that would qualify as trade secrets; (iii) classified information; or (iv) other information protected from unauthorised access or disclosure, or necessary to safeguard a person’s privacy or security.
In all cases, however, the reporting company must indicate what information (if any) has been omitted and why, and must reassess this decision annually.
What are the obligations of value chain companies?
Their obligations are those contractually determined, albeit with limitations.
The Directive provides that reporting companies may not require, beyond a certain limit, companies in their value chain to provide information where those companies are not themselves subject to reporting obligations. Such companies are considered “protected undertakings”, meaning they have the right to refuse to provide information beyond that specified in the voluntary standards to be established by the European Commission. The inclusion of contractual clauses requiring the provision of such information is also expressly prohibited. If reporting companies request such information from companies in their value chain, they must clarify that the information exceeds the voluntary standards and that the "protected undertaking" is under no obligation to respond.
These rules clearly aim to avoid placing an excessive burden on companies whose size could render such obligations disproportionate. However, the reference to voluntary standards may, in practice, result in a quasi-mandatory regime for minimum information collection by companies. These voluntary standards to be established by the European Commission should be based on the Commission Recommendation 2025/1710, which adopted the VSME developed by EFRAG. Under this regulatory framework, it is quite possible that larger companies will make this optional regime mandatory for companies in their value chain through contractual requirements.
It should be noted that the status of “protected undertakings” can be obtained by a company via a self-declaration, with the reporting company not being required to verify that information. This shall not apply where the reporting company is aware, or can reasonably be presumed to know, that the self-declaration is manifestly incorrect.
