CSRD/ESRS: Mandatory Sustainability Reporting with Legal Consequences

The Corporate Sustainability Reporting Directive (CSRD) is EU Directive 2022/2464, which replaces the Non-Financial Reporting Directive (NFRD) and requires in-scope companies to publish a sustainability report that is part of their management report, prepared in accordance with the European Sustainability Reporting Standards (ESRS), and subject to limited external assurance. In Spain, large companies meeting two of three thresholds — more than 250 employees, annual turnover above EUR 50 million, or total assets above EUR 25 million — must report under CSRD from fiscal year 2025 onwards. The ESRS framework covers 12 thematic standards across environmental (E1–E5), social (S1–S4), and governance (G1) topics, and requires a double materiality assessment — evaluating both the company's impacts on people and the environment, and the financial effects of sustainability risks on the company — as the mandatory starting point for determining which disclosures apply.

The CSRD represents the most profound change in corporate reporting since the generalisation of audited financial accounting. Sustainability information is now held to the same standard of rigour, standardisation, and external verification as financial information. Companies that approach this as an enhanced ESG report will find requirements that go far beyond anything previous voluntary practice demanded.

Why CSRD Compliance Requires Much More Than an Enhanced ESG Report

Most companies approaching CSRD for the first time dramatically underestimate what is required. The 12 thematic ESRS standards — covering climate, biodiversity, pollution, water, employees, supply chain, communities, and governance — create a matrix of potential disclosure requirements. The double materiality assessment is the obligatory filter: only topics that are material from an impact or financial perspective trigger those requirements. But conducting that assessment correctly — with structured stakeholder engagement, documented evidence, and an outcome that auditors can verify — is itself a multi-month process. Without it, the entire report lacks its foundation. The limited assurance requirement further raises the bar: every reported data point must be supported by documented evidence and auditable internal controls. Preparing that documentation retroactively, after the assurance process starts, is costly and generates observations that damage the quality of the first report. Our CSRD advisory engages companies before those deadlines become urgent.

Our CSRD Double Materiality and ESRS Reporting Process

We guide companies through the full CSRD compliance cycle. The double materiality assessment identifies which sustainability topics are material from two complementary angles: what impacts the company has on people and the environment (impact materiality), and what external sustainability factors generate financial risks or opportunities (financial materiality). On that foundation, we design the ESRS-aligned reporting framework — report structure, key indicators, required policies and targets, value chain data collection processes. We establish data collection systems, coordinate with external auditors for limited assurance, and manage the full publication process in the required management report format. For companies already in progress with an internal CSRD process, we conduct a gap analysis against ESRS requirements and complete the process to audit-ready standard. The ESG strategy underpinning the report must be coherent and withstand scrutiny: we ensure both compliance and strategic credibility.

Real Results in CSRD Compliance: First Reports Published on Time with Limited Assurance

• 50+ companies guided through their first CSRD/ESRS materiality assessment and report.
• Double materiality assessment conducted with structured stakeholder engagement and documented evidence supporting the outcome.
• Data collection systems implemented and tested before the reporting year ends, not after.
• Limited assurance coordination with external auditors: all supporting documentation prepared proactively to eliminate material observations.
• EU Taxonomy alignment indicators calculated and integrated with financial data for consistency.

The CSRD also transforms the information available to capital markets and financial institutions. Institutional investors and banks applying ESG criteria will use this standardised information to compare companies with a precision that voluntary reports never permitted. For companies contemplating an IPO or the entry of a financial investor, the quality of the first CSRD report is a reputational and financial asset. The relationship between CSRD reporting and corporate governance is direct: effective sustainability reporting requires the same governance discipline — clear accountabilities, documented processes, auditable controls — that good governance demands for financial reporting. Companies that invest in building a robust reporting system now, rather than rushing to meet the minimum at deadline, will be better positioned for the next wave of mandatory requirements that European regulation will bring.

The CSRD timeline and who is affected

The Corporate Sustainability Reporting Directive (CSRD, EU 2022/2464) represents the most significant expansion of corporate reporting obligations in a generation. It replaces the Non-Financial Reporting Directive (NFRD) and extends mandatory sustainability reporting to a substantially larger population of companies in progressive waves:

• Wave 1 (FY 2024, reporting in 2025): large public interest entities with >500 employees already subject to NFRD.
• Wave 2 (FY 2025, reporting in 2026): other large undertakings (>250 employees, >EUR 50m turnover, or >EUR 25m total assets — meeting 2 of 3 criteria).
• Wave 3 (FY 2026, reporting in 2027): listed SMEs (with opt-out until 2028), small non-complex credit institutions, and captive insurance undertakings.
• Wave 4 (TBD): non-EU companies with significant EU operations (>EUR 150m net turnover in the EU for two consecutive years).

The Spanish transposition regulation establishes equivalent obligations under domestic law, enforced by the CNMV for listed entities and the Registro Mercantil for large unlisted companies.

European Sustainability Reporting Standards (ESRS)

CSRD reporting must comply with the European Sustainability Reporting Standards (ESRS), developed by EFRAG and adopted by the European Commission. The ESRS framework comprises:

• ESRS 1 and ESRS 2: cross-cutting general requirements and general disclosures (mandatory for all in-scope entities).
• Environmental standards (ESRS E1-E5): climate change, pollution, water, biodiversity, circular economy.
• Social standards (ESRS S1-S4): own workforce, workers in the value chain, affected communities, consumers and end-users.
• Governance standard (ESRS G1): business conduct (anti-corruption, lobbying, payment practices).

Not all standards apply equally to all companies — the double materiality assessment determines which topics are material for each company and therefore require full disclosure. Conducting a rigorous double materiality assessment is the critical first step in any CSRD programme.

Double materiality: the methodological foundation

Double materiality assesses both financial materiality (how sustainability issues affect the company’s financial position and performance) and impact materiality (how the company’s activities affect people and the environment). This is a significant conceptual departure from purely investor-focused financial reporting and requires a structured stakeholder engagement process alongside a comprehensive impact, risk, and opportunity (IRO) identification exercise.

Our double materiality assessments follow EFRAG guidance and the ESRS requirements, covering:

1. Value chain mapping: identifying the company’s upstream suppliers and downstream customers and the sustainability topics most likely to be material along the chain.
2. IRO identification: systematically identifying all potential impacts, risks, and opportunities across the ESRS topic universe.
3. Materiality determination: applying quantitative and qualitative thresholds to determine which IROs are material, using a structured scoring process with documented rationale.
4. Stakeholder validation: engaging with key stakeholders (employees, customers, investors, community representatives) to validate the materiality conclusions.

Data infrastructure for CSRD compliance

A significant proportion of the effort in CSRD implementation is not reporting — it is data infrastructure. Companies frequently discover that the data required to populate ESRS disclosures (Scope 3 emissions, workforce diversity data, supply chain due diligence records, energy consumption by facility) either does not exist or is held in siloed systems that cannot be efficiently aggregated.

Our implementation work typically involves: data gap assessment, data collection process design, system integration (connecting ERP, HR, and procurement systems to a sustainability data platform), and controls documentation for the limited assurance process that is required under CSRD from the first year of reporting.

Our carbon footprint and ESG sustainability teams provide integrated support for the environmental data dimensions of CSRD compliance.

Contact our sustainability team to discuss your CSRD readiness timeline and programme design.

Sectors with specific CSRD challenges

Financial services: banks, insurance companies, and investment firms face the most demanding CSRD disclosure requirements — not only their own operational sustainability performance but also Scope 3 Category 15 financed emissions (for banks) and investment portfolio alignment with EU Taxonomy objectives (for insurers and asset managers). The interaction between CSRD, SFDR (EU 2019/2088, Sustainable Finance Disclosure Regulation), and EU Taxonomy creates a complex, overlapping disclosure architecture. Our financial sector CSRD advisory integrates all three frameworks.

Manufacturing and industrial companies: Scope 3 emissions from purchased goods and services (Category 1) and use of sold products (Category 11) typically dominate the carbon footprint of manufacturing companies, but these figures require supplier-level data collection that most companies do not have systems for. Our carbon footprint team designs the supplier engagement and data collection process needed to populate ESRS E1 climate disclosures.

Retail and consumer goods: own-brand product impacts across the value chain (packaging waste, product end-of-life, supply chain labour conditions) and consumer use-phase emissions are material for most large retailers under ESRS. Customer-facing data requirements under ESRS S4 (consumers and end-users) — product safety, responsible marketing, access and inclusion — also apply. Supply chain due diligence documentation under CSDDD (which Spain must transpose by mid-2026) adds a further layer.

Real estate and construction: the EU Taxonomy’s substantial contribution criteria for “green buildings” (nearly zero-energy buildings — NZEB standard, EU Taxonomy Climate Delegated Act Article 7) and building renovation are directly relevant to real estate companies and construction firms. EU Taxonomy-aligned revenue calculation requires building-level energy performance certificate data. ESRS E5 (circular economy) applies to waste management and material use in construction.

Listed Spanish companies: CNMV oversight of the non-financial statement (Estado de Información No Financiera — EINF), the precursor to the CSRD report, has established Spanish investor expectations and CNMV review standards that will carry through to CSRD reporting quality expectations. Companies with CNMV-filed EINFs have a reporting baseline to build from; those without have a steeper ramp-up.

Company size segmentation

Wave 2 companies (first report FY 2025): approximately 5,000 Spanish companies must file their first CSRD-compliant report for fiscal year 2025 (submitted by June 2026). These companies typically have no NFRD baseline. Our Wave 2 accelerator programme runs on a 12-month timeline: double materiality assessment (months 1–3), data infrastructure design (months 3–6), first draft ESRS report (months 6–10), limited assurance readiness preparation (months 10–12).

Wave 1 companies (first report FY 2024 — already filed): first filers face continuous improvement requirements. The EFRAG consultation on ESRS amendments, the Commission’s review of sector-specific ESRS (expected 2026), and growing investor use of CSRD data for comparative analysis mean that first-year reports are a baseline, not a destination. Our continuous improvement advisory supports Wave 1 companies in strengthening materiality documentation, improving data quality, and preparing for the sector-specific ESRS standards.

Wave 3 listed SMEs (first report FY 2026): listed SMEs face a lighter version of the full ESRS framework (the ESRS for listed SMEs, developed by EFRAG separately from the full ESRS). These companies typically have fewer resources for CSRD implementation — our SME CSRD programme delivers the essentials: double materiality assessment, key ESRS disclosures (ESRS 1, ESRS 2, and material topical standards), and limited assurance documentation.

Companies preparing for Wave 4 (non-EU companies with EU revenue above EUR 150M): multinational groups headquartered outside the EU whose European operations generate more than EUR 150M in revenue will face CSRD-equivalent obligations from FY 2028 under Wave 4. Early readiness assessment and data infrastructure design in the EU operating entities is the appropriate preparation timeline.

Worked example: Wave 2 CSRD implementation for a EUR 180M manufacturing group

A Spanish manufacturing group (EUR 180M revenue, 820 employees, 3 production sites in Spain and 1 in Portugal) engaged our CSRD team in January 2025 for Wave 2 compliance (first report for FY 2025, to be filed by 30 June 2026).

Phase 1 — Double materiality assessment (January–March 2025):

• Value chain mapping: 340 active suppliers identified (80% Spanish/Portuguese, 15% Asian, 5% South American); key customer segments: industrial distributors (B2B), one major retailer (B2C).
• IRO identification workshop with 22 senior managers: 67 potential IROs identified across 11 ESRS topic areas.
• Materiality thresholds applied: 14 topics material (including ESRS E1 climate, ESRS E5 circular economy, ESRS S1 own workforce, ESRS G1 business conduct). 3 topics material only under financial materiality (water use, biodiversity).
• Stakeholder validation: surveys to 15 key suppliers, 3 major customers, and employee works council; materiality conclusions validated without changes to the 14 material topics.

Phase 2 — Data infrastructure (April–June 2025):

• GHG inventory: Scope 1 and 2 emissions calculated from energy invoices (3 Spanish sites) and Portuguese energy data. Scope 3 Category 1 (purchased goods): spend-based calculation as proxy, with plan to transition to supplier-specific data by FY 2026.
• Workforce data: HR system audit revealed that diversity data (gender, age, nationality) was available in the HRIS but disability data required a voluntary disclosure process. Employee wellbeing data (sickness absence, turnover, training hours) restructured to align with ESRS S1 requirements.
• Business conduct (ESRS G1): anti-corruption training records pulled from LMS; third-party due diligence process for new suppliers formalised (ESRS G1 requires disclosure of supplier screening practices).
• Data governance: sustainability data governance policy drafted, data owner for each ESRS data point nominated, quarterly data review process established.

Phase 3 — First CSRD report (July–November 2025):

• ESRS report drafted: 68 pages covering ESRS 1, ESRS 2, and 14 material topical ESRS disclosures.
• Limited assurance review: external auditor conducted CSRD limited assurance engagement (required under CSRD from first year). 3 observations (minor data inconsistencies) corrected before final sign-off.
• CNMV filing: report filed as part of the annual management report (informe de gestión) for FY 2025.

Key metrics in first report: Scope 1+2 market-based: 2,847 tCO2e; Scope 3 Category 1 (proxy): ~12,400 tCO2e; 38% female employees (management level 19%), LTIFR 4.2, 28 training hours/employee average.

Five common CSRD mistakes

1. Treating double materiality as a theoretical exercise. The double materiality assessment is the most important step in CSRD — it determines which topics require full disclosure and which can be explained away. Companies that conduct a box-ticking materiality exercise (everything is material, or nothing outside the obvious topics is material) will face challenges from auditors and investors who expect a rigorous, documented process with clear stakeholder engagement and defensible thresholds.

2. Starting data collection too late. FY 2025 data collection for a June 2026 filing starts on 1 January 2025. Companies that have not designed their data collection systems, nominated data owners, and tested their collection processes before the start of the reporting year will be reconstructing data from inadequate records under time pressure. Infrastructure design must happen before the fiscal year starts.

3. Scope 3 emissions as an afterthought. For most companies, Scope 3 emissions are 70–90% of the total carbon footprint. ESRS E1 requires disclosure of all material Scope 3 categories. Yet Scope 3 data requires supplier engagement, customer use-phase data, and logistics partner emissions data that cannot be collected retrospectively. Building the Scope 3 data collection process — even a spend-based proxy to start — must begin in parallel with the double materiality assessment.

4. Preparing the CSRD report as a static document. The CSRD report under ESRS must use the digital XBRL tagging format specified by ESMA (European Securities and Markets Authority) for inline XBRL (iXBRL) integration with the European Single Electronic Format (ESEF). Companies that prepare the narrative report without consideration of the digital tagging requirements face a significant rework effort before submission. Our implementation includes the ESEF/iXBRL technical preparation from the outset.

5. Confusing limited assurance with no assurance. CSRD requires limited assurance from an accredited auditor from the first year of reporting. Limited assurance is less intensive than reasonable assurance, but it still requires documented evidence for all material disclosures, a controlled data collection process, and auditable source documentation. Companies that approach limited assurance as a formality consistently receive qualified assurance opinions that attract CNMV or investor attention.

How we work: CSRD implementation programme

Phase 1 — Readiness assessment (4–6 weeks): CSRD in-scope analysis; current sustainability data and reporting capability assessment; double materiality pre-assessment; gap analysis and implementation programme design.

Phase 2 — Double materiality and IRO analysis (8–12 weeks): value chain mapping, IRO identification, materiality scoring, stakeholder engagement, and materiality conclusion documentation. Output: materiality matrix and ESRS reporting scope definition.

Phase 3 — Data infrastructure (3–4 months): data point inventory for all material ESRS disclosures, data owner nomination, data collection process design, system integration where feasible, and baseline measurement for KPIs.

Phase 4 — Report preparation (3–4 months): ESRS report drafting, ESEF/iXBRL technical preparation, internal review, limited assurance auditor coordination, and submission management.

Phase 5 — Continuous improvement (annual): data quality improvement, Scope 3 supplier engagement programme, sector-specific ESRS preparation, and CSRD report annual update.

Contact our sustainability reporting team for a complimentary CSRD readiness assessment — a 2-hour diagnostic covering your wave classification, likely material ESRS topics, and recommended implementation timeline.