Sustainability reporting has moved from the margins of corporate disclosure to the center of it. For finance teams at organizations operating in or selling into the EU, the Corporate Sustainability Reporting Directive (CSRD) is not a future consideration — it is a current compliance requirement with active deadlines, significant scope, and real consequences for non-compliance.
This guide explains what CSRD requires, which organizations it affects, how the timeline is unfolding in 2026, and what finance teams need to do to meet its demands.
What Is the Corporate Sustainability Reporting Directive?
The Corporate Sustainability Reporting Directive (CSRD) is an EU regulation that came into effect in January 2023. It replaces and significantly expands the earlier Non-Financial Reporting Directive (NFRD), requiring companies to disclose detailed, standardized information about how their activities impact environmental, social, and governance (ESG) factors — and how those factors in turn affect their business.
The CSRD is designed to create a unified, transparent framework for sustainability reporting across all EU member states. It introduces more rigorous reporting standards, mandatory digital tagging, third-party assurance requirements, and alignment with a new set of reporting standards — the European Sustainability Reporting Standards (ESRS) — developed by the European Financial Reporting Advisory Group (EFRAG).
Who Does CSRD Apply To?
The scope of CSRD is significantly broader than the NFRD it replaces. The NFRD covered approximately 11,000 companies. CSRD is expected to affect close to 50,000 organizations across the EU — and its reach extends beyond European borders.
The directive applies to:
Large EU companies meeting two of three criteria: more than 250 employees, annual turnover above €40 million, or total assets above €20 million.
Listed SMEs on EU-regulated markets (with a simplified reporting option available).
Non-EU companies with annual EU net turnover above €150 million and at least one subsidiary or branch in the EU above defined thresholds.
For non-EU organizations, this means CSRD can apply even without a European headquarters. Any business with significant EU revenue and a local presence may be in scope. The European Commission's CSRD FAQ provides detailed guidance on scope determination.
The CSRD Timeline in 2026
Reporting requirements are being phased in by company size and type:
Already required (FY2024 reports, published in 2025): Large public-interest entities previously covered by the NFRD — approximately 2,000 of the largest EU companies.
Currently phasing in (FY2025 reports, published in 2026): Other large EU companies not previously covered by NFRD — this is the wave affecting the majority of large organizations now.
Next phase (FY2026 reports, published in 2027): Listed SMEs, small and non-complex credit institutions, and captive insurance undertakings.
Non-EU companies (FY2028 reports, published in 2029): Large non-EU companies with significant EU operations.
For finance teams whose organizations fall into the second or third phase, 2026 is the year to build the data infrastructure, reporting processes, and assurance readiness that CSRD requires. Waiting until reporting deadlines arrive without that infrastructure in place is the most common and most avoidable compliance failure.
Note: The European Commission has proposed an Omnibus simplification package that may narrow CSRD scope and simplify some requirements for certain company categories. As of mid-2026 this remains under discussion — organizations should continue preparing for CSRD as currently enacted while monitoring legislative developments.
What CSRD Requires Organizations to Report
Under CSRD, companies must report across the full range of ESG topics defined in the ESRS, subject to a materiality assessment. The key reporting areas include:
Environmental: Climate change (including Scope 1, 2, and 3 greenhouse gas emissions), pollution, water and marine resources, biodiversity, resource use and circular economy.
Social: Own workforce (working conditions, equal treatment, human rights), workers in the value chain, affected communities, consumers and end-users.
Governance: Business conduct, anti-corruption, political engagement, and management of relationships with suppliers and other business partners.
Reports must be prepared in accordance with the ESRS, submitted in XHTML format with iXBRL tagging, and subject to independent third-party assurance — initially limited assurance, moving toward reasonable assurance in future years. The EFRAG ESRS documentation provides the full set of standards and guidance.
Why This Is a Finance Team Challenge, Not Just a Sustainability Team Challenge
CSRD is often treated as a sustainability or ESG function responsibility. In practice, it creates significant demands on finance teams — for three reasons.
Data quality and auditability. CSRD reports require third-party assurance, which means the data behind sustainability disclosures must meet the same standards of accuracy, traceability, and documentation as financial statements. Finance teams are experienced in managing auditable data; sustainability teams typically are not. The data governance challenge is fundamentally a finance function problem.
Integration with financial reporting. CSRD requires companies to report on how sustainability risks and opportunities affect financial performance — and how financial flows affect sustainability outcomes. This double materiality framework means sustainability reporting and financial reporting must be aligned, not produced in parallel silos.
ERP data as a sustainability data source. Much of the data that feeds CSRD reporting — supplier spend, energy and resource procurement, logistics costs, travel expenses, waste disposal — originates in the ERP. Finance teams that can extract and structure this data accurately are significantly better positioned for CSRD compliance than those relying on manual data collection.
What Double Materiality Means in Practice
One of the most important — and most misunderstood — concepts in CSRD is double materiality. Organizations must assess:
Impact materiality: How does the company's activity impact people and the environment? (Outward impact)
Financial materiality: How do sustainability factors — climate risk, resource scarcity, regulatory exposure — affect the company's financial performance and prospects? (Inward risk)
Both dimensions must be assessed and disclosed. This is different from the single materiality approach used in most financial reporting, where only financial impact is considered. The EFRAG's double materiality guidance provides the methodology for conducting the assessment.
For finance teams, financial materiality is the more familiar dimension — assessing how climate transition risks, physical climate risks, and social factors affect revenue, costs, asset values, and access to capital. This analysis connects directly to risk management, financial planning, and investor disclosure.
The Data Infrastructure Challenge
CSRD compliance fails at the data layer more than anywhere else. Organizations discover that the information they need for ESRS disclosures is scattered across systems, inconsistently defined, not captured at all, or not auditable.
The most common data gaps:
Scope 3 emissions. Scope 3 — indirect emissions from the value chain — are the most significant and most difficult to measure. They require supplier-level data on emissions, which most procurement and AP systems don't capture by default. The GHG Protocol's Scope 3 guidance is the authoritative framework for measurement methodology.
Supply chain sustainability data. CSRD requires disclosure on working conditions and human rights in the value chain. This demands engagement with suppliers and data collection processes that don't exist in most current AP workflows.
Energy and resource consumption. While large facilities typically have metering data, smaller sites, vehicles, and remote operations often don't. Manual data collection is slow, inconsistent, and difficult to audit.
Comparability over time. CSRD requires multi-year trend data, which means the data collection infrastructure needs to be consistent and documented from the point it starts — not reconstructed retrospectively.
How Dynamics 365 Supports CSRD Readiness
Microsoft Dynamics 365 provides a strong foundation for building CSRD-ready data infrastructure, particularly for the financial materiality and supply chain dimensions of the directive.
Supplier spend data. D365 holds complete, auditable records of supplier transactions, making it the most reliable source for supply chain spend analysis. This data is the starting point for Scope 3 Category 1 (purchased goods and services) emissions calculations and supplier sustainability assessments.
Expense and travel data. Business travel and employee commuting are Scope 3 emissions categories. Expense data in D365 — particularly when captured through automated expense management — provides the structured input needed for emissions calculations without manual data collection.
Financial risk assessment. D365's reporting and analytics capabilities support the financial materiality assessment that CSRD requires — modeling how climate and sustainability risks affect revenue forecasts, asset values, and cost structures.
Audit trail and data governance. Third-party assurance under CSRD requires the same data governance standards as financial audit. D365's native audit trails, role-based access controls, and document retention capabilities apply directly to sustainability data managed within the ERP.
Microsoft's sustainability resources and the Microsoft Cloud for Sustainability platform provide additional tools for organizations building end-to-end sustainability data management on the Microsoft stack.
Steps Finance Teams Should Take Now
Conduct a materiality assessment. Determine which ESRS topics are material to your business — both from an impact and a financial risk perspective. This scopes the reporting requirement and focuses data collection effort where it matters most.
Map your data sources. For each material topic, identify where the underlying data currently lives — ERP, HR systems, facility management, supplier portals, or manual collection — and assess its quality and auditability.
Establish a data governance framework. CSRD data needs to meet audit standards. Define ownership, collection methodology, validation processes, and retention policies for every data point that will appear in your CSRD report.
Engage your supply chain early. Scope 3 data collection requires supplier cooperation. Starting supplier engagement now — through questionnaires, data sharing agreements, or procurement policy updates — gives you time to build the data relationships that CSRD requires.
Integrate sustainability reporting with financial reporting. The double materiality framework means these two functions need to work from shared data and aligned assumptions. Establish a working relationship between finance and sustainability teams now, before the reporting deadline creates urgency.
Monitor the Omnibus proposal. The European Commission's simplification package may affect scope and requirements for some organizations. Track developments through the European Commission's CSRD page and adjust your preparation accordingly.
Book a demo to discuss how Truvio's solutions inside Dynamics 365 support the data infrastructure your organization needs for CSRD readiness.
Frequently Asked Questions
When does CSRD apply to our organization? It depends on your size, listing status, and whether you were previously covered by the NFRD. Large EU companies not previously covered by NFRD are reporting on FY2025 data (published in 2026). Non-EU companies with significant EU operations report on FY2028 data (published in 2029). Use the European Commission's scope guidance to confirm your timeline.
What are the ESRS? The European Sustainability Reporting Standards are the reporting standards developed by EFRAG that organizations must follow when preparing CSRD disclosures. They cover environmental, social, and governance topics and define the specific data points, methodologies, and disclosure formats required. The full set is available at EFRAG's website.
What is the penalty for non-compliance with CSRD? Penalties are set by individual member states and vary by country. They can include financial fines, public disclosure of non-compliance, and in some cases restrictions on business operations. The reputational and investor relations consequences of non-compliance are often more significant than direct financial penalties for listed companies.
Does CSRD apply to non-EU companies? Yes, if they have annual EU net turnover above €150 million and at least one EU subsidiary or branch above the relevant thresholds. Non-EU companies have a later reporting deadline (FY2028 data, published in 2029) but should begin building data infrastructure now given the volume and complexity of data required.
What is the difference between CSRD and ESG reporting? ESG (Environmental, Social, and Governance) reporting is a broad term for voluntary or mandatory disclosure of sustainability-related information. CSRD is a specific EU legal framework that mandates ESG reporting for in-scope companies, defines the standards (ESRS) they must follow, and requires third-party assurance. Not all ESG reporting is CSRD-compliant — only disclosures prepared in accordance with the ESRS and meeting CSRD's format and assurance requirements satisfy the directive.
.svg "truvio_logo"){kind=small}
