Sustainability reporting: New mandatory requirements and what they mean for businesses

New and upcoming mandatory reporting requirements

EU: The Corporate Sustainability Reporting Directive (CSRD) and Omnibus Package

Early 2025 has been a whirlwind for EU corporate sustainability reporting requirements. When the Corporate Sustainability Reporting Directive (CSRD) was originally adopted, it was planned that all large EU companies (two or more of: 250+ employees, €50M+ revenue, €25M+ balance sheet) would have joined large, listed EU companies in assessing and disclosing material sustainability issues this year.

However, after significant discussion and anticipation, the EU Commission has now released the Omnibus Package, which proposes to streamline and simplify sustainability reporting under the overall goal of increasing future EU competitiveness.

If enacted in its current form, the Omnibus proposals would:

Postpone reporting timelines for all companies not currently reporting (i.e. large, listed EU companies) by two years. For example, large, non-listed EU companies would not be required to report until 2028 (using 2027 data).

Significantly increase reporting thresholds. Only EU companies with 1,000+ employees will be required to report, with listed SMEs completely taken out of scope, and the threshold of large companies increasing from 250 to 1,000 employees (revenue and balance sheet thresholds remain). Most non-EU companies would also drop out of scope, with only those generating EU turnover of greater than €450M included (up from €150M per year). Overall, this is projected to reduce the number of in-scope companies by about 80%, from c. 50,000 to less than 7,000.

Remove requirement for reasonable assurance of reports (though limited assurance is still required). It is also proposed that more flexibility is given for the assurance standard to be used across the EU (with potential ‘guidelines’ EU-wide, leaving specification of assurance standards to individual member states).

Limit the amount of information that can be requested from the value chain. Companies with less than 1,000 employees would only be required to share information set out in supplementary voluntary reporting standards (alongside other information required as part of supplier/customer agreements). Assurance providers would be required to take this into account when considering data and scope limitations.

Remove sector specific standards (which were in development, but no drafts had been released).

Revise the European Sustainability Reporting Standards (ESRS). Though any changes would be implemented c. 6 months after the main Omnibus Package, it is likely that the number of ESRS datapoints will be substantially reduced, in particular qualitative datapoints, and greater number of datapoints will be voluntary rather than mandatory.

What does this mean for companies?

As yet, no legal amendments to the CSRD have been made. The Omnibus Package is being fast-tracked through EU Parliament, but it is likely that further changes will be made before it becomes law. The scope of future CSRD requirements will therefore not be finalised until later this year (likely summer 2025 at the earliest). Companies should keep a close eye on future developments, in particular those currently in-scope but are likely to move out of scope, and consider implications and requirements of the CSRD in its current form. Key points of the CSRD, which are not affected by the Omnibus Package, are:

• Double materiality assessment – The CSRD disclosure framework is based upon a double materiality assessment to identify key sustainability issues. Double materiality includes:
  • Financial materiality – the impact of sustainability issues on the organisation,
  • Impact materiality – the impact of the organisation on sustainability issues.

Organisations must conduct this materiality assessment to establish material risks, opportunities and impacts, and provide a series of disclosures relating to these issues.

• Value chain reporting –  Though the Omnibus Package proposes to limit the burden on value chain reporting, organisations must still assess and disclose on sustainability issues relating to not just their own operations, but upstream (suppliers) and downstream (customers and end users). This necessitates stakeholder engagement at or before the materiality assessment stage, in order to identify the most important issues across the full value chain.
• Climate disclosure –  Whilst recent updates to the CSRD wording remove the mandatory requirement on climate reporting, there is still an expectation for disclosure, with detailed justification required if climate change is not deemed material. Where material, companies must disclose scope 1, 2 and 3 emissions (i.e. emissions from both own operations and the wider value chain), and Taskforce of Climate-related Financial Disclosures-aligned risk and opportunity analysis.

The UK Sustainability Disclosure Requirements (SDR)

In 2023, the UK Government endorsed the International Sustainability Standards Board (ISSB) sustainability disclosure standards, consisting of IFRS S1 (General Requirements for Sustainability Disclosure) and IFRS S2 (Climate Related Disclosures). It has announced its intention to develop UK-specific sustainability reporting standards in line with the ISSB standards by Q1 2025. Requirements are anticipated to be effective from 2026 at the earliest.

Though we are approaching the end of Q1 2025, draft requirements are yet to emerge. However, given they are to be based on the ISSB standards, requirements are likely to revolve around the following principles:

• IFRS S1 provides a general framework for sustainability management and reporting. This includes disclosure of sustainability information that is material to investors and wider stakeholders. Companies could report relevant governance, strategy, risk management and performance metrics and targets in relation to material sustainability issues (similarly to datapoint disclosure in the CSRD above), and integrate sustainability disclosures within their wider financial reporting process.
• IFRS S2 focuses on climate disclosure reporting, in line with the recommendations of the Taskforce of Climate-related Financial Disclosures (TCFD). This involves disclosure of how climate change impacts an organisation’s business model, resilience of their strategy under different climate scenarios, and metrics and targets used to assess and manage risks (including scope 1, 2 and 3 emissions). Large UK companies (500+ employees and £500M+ annual turnover) are already required to disclose climate-related risks and opportunities, and the UK SDR will likely complement these requirements. The UK SDR may also include requirements for transition plan disclosure in line with the recommendations of the Transition Plan Taskforce (TPT).

Our key ESG reporting takeaways

Whilst compliance requirements may be reduced, the wider strategic benefits to ESG and sustainability reporting are well documented, such as improved risk management, operational efficiencies, public, customer and investor image, and access to sustainability-linked finance. Sustainability management and reporting should therefore remain a priority for companies. We recommend that you:

Start early with materiality

A full year of data must be collected, aligned with a company’s financial reporting timelines, prior to first CSRD disclosure (or other reporting requirements). To ensure that appropriate data is collected in the most efficient way, the materiality assessment should be completed before the start of data collection. This enables prioritisation of data streams and time to develop forward-looking policies, actions and targets, rather than implementing them retrospectively.

Data prioritisation is key

Once the materiality assessment has been completed, gaps should be identified and prioritised through a robust gap analysis and action plan. Owing to the volume of disclosures required, not all material topics will be able to be fully disclosed in the first year of the requirements, in particular for areas where the company has not historically focused sustainability efforts (such as biodiversity or water).

Instead, prioritise disclosure based on stakeholder priorities – the most material topics – as well as ‘quick wins’ from a practicality and resource standpoint (e.g. where data is most readily available). Data may be available from various sources across the company, in particular for social metric data, product-level data, or where there are already legal requirements in place for monitoring (e.g. waste or air quality). Overall, the ‘80:20’ rule is a good rule of thumb for sustainability data and disclosure – in general, 20% of datapoints are responsible for 80% of the material data. Focus on the most material data and don’t worry about perfection, particularly in the first years of disclosure.

Research assurance requirements and engage early

Although the European Commission has not adopted an EU-wide mandatory assurance standard for the CSRD, individual member states can choose to adopt their own standards. As such, assurance requirements and expectations may differ across the EU, including in Ireland where all CSRD reports must be assured against the ISAE (Ireland) 3000 Assurance Standard. This limits the range of independent assurance providers to choose from. In other member states, no assurance standard has been specified, therefore any internationally recognised standard can be used (such as AccountAbility’s AA1000 Assurance Standard). Scope and subsequent cost of licenced assurance providers can vary substantially.

Once you have identified an appropriate assurance provider, it is important to get them on board early, as you are going through the process of prioritisation, developing methodologies and data collection. This will mean there are fewer surprises later in the process, and provide confidence in the data collection methodologies used.