Most companies that took CSRD seriously did so in 2024. They commissioned a scoping memo, ran a double materiality assessment against ESRS Set 1, and budgeted for reasonable assurance by 2028. Almost every number in that memo is now wrong. Not because the work was bad, but because the operative text changed twice, in March and July 2026, and the practical consequences are only now landing in datapoint lists, transposition acts and audit tenders. This is the re-baseline.
Scope: 1,000 employees and EUR 450 million, and FY2027
Directive (EU) 2026/470, in force since 18 March 2026, replaced the 250-employee test with a two-part threshold: more than 1,000 employees and net turnover above EUR 450 million. The Commission's own estimate is that about 80% of the previously in-scope population fell out. Wave-one companies that already report keep reporting. Everyone else newly in scope starts with FY2027, reported in 2028. Listed SMEs are out of the mandatory regime entirely.
If your 2024 memo put you in Wave 2 with a FY2025 start, check the new test against your consolidated numbers for the last two financial years. A surprising number of groups sit just under one of the two prongs, and the answer is different for an EU subsidiary of a non-EU parent than it is for an EU-headquartered group.
The standards: about 530 datapoints, in force 10 November
The Commission adopted the revised ESRS on 3 July 2026. The headline is a cut of more than 60% in mandatory datapoints, with all voluntary datapoints removed; practitioner estimates go from 1,073 mandatory items to roughly 320. EFRAG's 28 August draft datapoint list, the artefact your data model will actually be built on, runs to about 530 items in total and ships with a draft XBRL taxonomy. Fatal-flaw comments on the list close on 23 October.
The delegated act is still inside its two-month scrutiny period, extendable by two months. If neither Parliament nor Council objects, entry into force is expected on 10 November 2026, with mandatory application for financial years beginning on or after 1 January 2027. No objection has surfaced. But until the act is in the Official Journal, a report cannot cite the revised standards as law.
That creates a three-way choice for a company reporting on FY2026. You can stay on ESRS Set 1. You can early-adopt the revised ESRS in full. Or you can stay on Set 1 and apply the eight transitional reliefs and clarifications selectively. For a second-year reporter with a working data pipeline, the third option is usually the cheapest. For a company that has never reported, early adoption avoids building to a standard that is about to be superseded.
Materiality: the DMA is not going away
The revised standards encourage a top-down double materiality assessment and cut the datapoint burden that follows from it, but they do not remove the assessment. EFRAG's 2025 implementation review found that more than 40% of Wave 1 undertakings lacked a robust DMA. That finding is now the benchmark a limited-assurance practitioner working under ISSA 5000 will hold you to. A DMA that cannot show how impacts, risks and opportunities were identified, scored and thresholded is the most common reason a first report gets qualified.
Assurance: limited, permanent, and ISSA 5000 from December
The Omnibus removed the pathway to reasonable assurance and made limited assurance permanent. The requirement for the Commission to adopt a limited-assurance standard by 1 October 2026 was also removed; a harmonised standard is now expected by July 2027. In the meantime the market has settled on ISSA 5000, effective for periods beginning on or after 15 December 2026. If you are tendering for FY2027 assurance now, ask the practitioner which standard the engagement letter will cite and what control documentation they expect around emission factors, boundaries and estimates. The price difference between a company with a documented control environment and one without is the whole engagement.
Fell out of scope? The stranded-compliance-asset decision
Companies that built a CSRD programme in 2024 and are now out of scope face a decision they did not plan for. The value-chain cap means a company with fewer than 1,000 employees cannot be asked by an in-scope customer for more than the VSME standard. That is a ceiling on what your customers can demand. It is not a ceiling on what your lender will ask under PCAF, or what a Japanese, Australian or Californian regime asks of a subsidiary. The sensible move is to keep the inventory and the DMA, retire the ESRS datapoint build, and map what remains to VSME so the customer questionnaires answer themselves.
Non-EU parents: ESRS-40a, consultation to 31 October
Non-EU groups with more than EUR 450 million of EU net turnover in each of the last two years and a qualifying EU subsidiary or branch are covered by Article 40a. EFRAG's exposure draft, published 23 July 2026, uses an impact-only materiality basis, lets groups limit certain disclosures to EU-related impacts, and excuses value-chain data gaps for the first three years. First statements cover FY2028, published in 2029. The consultation closes on 31 October and EFRAG plans its technical advice for early 2027. US, UK and Gulf parents should comment now; the Commission tends to adopt EFRAG's advice largely as written.
Transposition: the map is not uniform
Only a handful of Member States have fully transposed the amended directive. Germany's CSRD implementation act is still pending; the Netherlands has a repair clause that applies to FY2026 if the law is not in force by 1 October; Romania transposed a stricter version. Which text binds an EU subsidiary depends on where it is incorporated, not on the directive alone. Check the national act before you commit to a first reporting year.
What to do now
- Re-run scope against the 1,000 employee and EUR 450 million test using two years of consolidated numbers, per legal entity.
- Rebuild the data-owner map against EFRAG's 530-datapoint list before 23 October, and log any structural problem as a fatal-flaw comment.
- Decide the FY2026 route (Set 1, early adoption, or Set 1 plus reliefs) in writing, with the reasoning, because the auditor will ask.
- Re-paper the DMA to the top-down method and keep the evidence trail; that is what assurance will test.
- If you are out of scope, map the inventory to VSME and stop the ESRS build. If you are a non-EU parent, comment on ESRS-40a by 31 October.
ESG Advising runs disclosure-readiness reviews and double materiality assessments scoped to the regime that actually binds you, which in 2026 is a narrower and more specific question than it was in 2024.
