CSRD and US Companies: Does EU Sustainability Reporting Apply to You?

CSRD can apply to US companies, but only to a narrow set of large multinationals with substantial EU revenue. Under the EU’s revised Corporate Sustainability Reporting Directive, a US parent company is in scope if it generates more than EUR 450 million in EU net turnover in each of the past two consecutive financial years and has an EU subsidiary or branch that itself exceeds EUR 200 million in EU net turnover. If your company clears both thresholds, you face a binding obligation to publish a sustainability statement covering the 2028 financial year, with the report due in 2029. Most US mid-market companies do not meet these thresholds and are not directly in scope.

What Is the CSRD and Why Are US Companies Asking About It?

The Corporate Sustainability Reporting Directive is European Union legislation that requires in-scope companies to publicly disclose detailed environmental, social, and governance information using standardized formats called European Sustainability Reporting Standards (ESRS). Unlike voluntary ESG frameworks, CSRD carries a statutory mandate and requires independent assurance of the sustainability statement.

The reason US finance leaders are paying attention is straightforward: the CSRD was originally projected to reach roughly 50,000 companies globally, including a significant number of non-EU multinationals with EU operations. Even after the 2026 Omnibus revisions substantially narrowed that population, the directive still extends beyond the EU’s borders. For any US company with European subsidiaries, EU-listed securities, or large EU customer contracts, understanding the scope rules is essential compliance hygiene.

The Original CSRD Scope Was Much Broader

When first adopted in 2022, CSRD used a relatively low bar: a company needed to meet at least two of three criteria (more than 250 employees, turnover above EUR 50 million, or total assets above EUR 25 million) to be in scope. That framework was projected to pull in tens of thousands of companies in waves between 2024 and 2029.

The “Wave 1” cohort, large EU-listed companies, banks, and insurers with more than 500 employees, began reporting on FY 2024 data with publications due in 2025. Under the Omnibus, many of these companies fall out of scope from FY 2027 once the higher thresholds apply, and member states may exempt de-scoped Wave 1 companies from FY 2025 and FY 2026 filings. Wave 2 and Wave 3 companies, meanwhile, received a two-year “stop-the-clock” delay before the legislative landscape shifted further.

The Omnibus Directive: How the Rules Changed in 2026

The European Parliament approved the so-called “Omnibus I” directive on 16 December 2025, the Council of the European Union approved it on 24 February 2026, and it was published in the Official Journal as Directive (EU) 2026/470 on 26 February 2026. The directive entered into force on 18 March 2026. EU member states have until 19 March 2027 to transpose the CSRD amendments into national law, with first mandatory application for financial years beginning on or after 1 January 2027.

The Omnibus revisions were sweeping. By the European Commission’s own estimate, the population of in-scope companies falls from roughly 50,000 under the original directive to around 10,000, a reduction of roughly 80 percent. (These are estimates, not codified figures, and different analyses cite different percentages; EFRAG has estimated an even steeper cut of about 88 percent for non-EU groups specifically.) The revised threshold for EU companies requires both more than 1,000 employees and net annual turnover exceeding EUR 450 million. Under the original rules, meeting just two of three much lower criteria was enough. Many mid-market EU companies that anticipated compliance burdens are now out of scope entirely.

What the Omnibus Means for US Companies Specifically

The third-country rules, which determine whether a non-EU parent company must report, were revised in parallel. The current scope test for US companies has two prongs, and both must be satisfied:

1. EU turnover threshold. The non-EU parent group must generate more than EUR 450 million in net turnover within the EU in each of the last two consecutive financial years. This is measured at the consolidated group level.
2. EU presence threshold. The group must have either (a) an EU subsidiary whose own net turnover in the EU exceeds EUR 200 million in the prior financial year, or (b) an EU branch with more than EUR 200 million in EU net turnover in the prior financial year.

Critically, there is no separate employee headcount requirement in the third-country trigger. A US company that clears both revenue tests is in scope regardless of how many people it employs in the EU.

The Reporting Standard for Non-EU Parents

US parent companies in scope will not report under the same ESRS that apply to EU companies. EFRAG, the EU’s technical advisory body for sustainability standards, is developing a dedicated standard called the ESRS for Non-EU Undertakings, commonly referred to as the ESRS-40a. As of late July 2026, EFRAG launched a public consultation on the exposure draft, with the comment period running through 31 October 2026. EFRAG expects to deliver its final technical advice to the European Commission in January 2027. The first sustainability reports prepared under the ESRS-40a are expected to cover financial year 2028, with publication in 2029.

CSRD US Companies: Who Is Actually In Scope?

Given the dual EUR 450 million / EUR 200 million test, the realistic population of in-scope US companies is concentrated in large multinationals. Think manufacturing conglomerates with EU factories, global financial services firms with EU subsidiaries, and technology companies with significant European revenue streams. A US company with USD 2 billion in total revenue but only USD 200 million generated from EU customers, for example, likely falls short of the EUR 450 million EU turnover threshold even before accounting for exchange rates.

Here is a simplified decision tree:

• Does your consolidated group generate more than EUR 450 million in EU net turnover in each of the last 2 years? If no, you are not in scope under the third-country rules.
• If yes: does your EU subsidiary or EU branch generate more than EUR 200 million in EU net turnover? If no, still not in scope. If yes, you are in scope and must prepare to report under the ESRS-40a for financial year 2028.

One nuance: if your company has EU-listed securities and meets the thresholds applicable to EU issuers, a separate set of rules may apply. Most US-headquartered companies are not listed on EU regulated markets, so this path is less common.

What Does Compliance Actually Require?

For US companies that do clear the thresholds, compliance is a multi-year undertaking. The sustainability statement must cover environmental topics (climate, pollution, water, biodiversity, resource use), social topics (workforce, value chain workers, affected communities, consumers), and governance topics. Disclosures must follow the double materiality principle: companies assess both how sustainability issues affect the business (financial materiality) and how the business affects society and the environment (impact materiality).

Assurance Requirements

CSRD requires independent assurance of the sustainability statement. Under the Omnibus revisions, companies will obtain limited assurance. The directive removed the obligation on the European Commission to transition to the more demanding reasonable assurance standard that the original CSRD had contemplated for a future phase, so limited assurance is now the indefinite standard. The EU must adopt limited assurance standards by 1 July 2027. The International Auditing and Assurance Standards Board’s ISSA 5000, the global standard for sustainability assurance engagements, is effective for periods beginning on or after 15 December 2026 and is expected to serve as the technical baseline for the EU standard. ISSA 5000 itself supports both limited and reasonable assurance engagements; CSRD simply requires the limited assurance level.

Limited assurance means the assurance provider concludes that nothing has come to attention indicating the sustainability statement is materially misstated. It is a lower bar than a full audit opinion but still requires meaningful engagement with the underlying data, systems, and controls. For US companies, that means engaging an assurance provider with sustainability expertise well in advance of the 2028 reporting year. Modus provides audit and assurance services including readiness assessments for companies preparing for sustainability assurance requirements.

The Data and Systems Challenge

The practical challenge for most US companies is not the standard itself. It is the underlying data infrastructure. CSRD disclosures require granular data on energy consumption, greenhouse gas emissions across Scope 1, 2, and 3, workforce metrics, and supply chain practices. Most mid-market finance functions do not currently collect or verify this data with the rigor required for an assured disclosure.

Companies that are in scope, or that want to build optionality, should start by mapping what data exists, identifying gaps, and evaluating whether current systems can produce auditable outputs. Engaging advisory support early reduces the cost of last-minute remediation.

What Should US CFOs Do Right Now?

Even if your company is not currently in scope, several developments warrant attention.

Voluntary disclosure pressure. Major EU customers and EU-based investors increasingly request sustainability data from suppliers and portfolio companies under CSRD’s value chain provisions. Even companies below the threshold may face informal requests as a condition of doing business. Preparing a defensible data set now reduces friction when those requests arrive.

EU scope could expand. The Omnibus scaled back CSRD’s reach in response to competitiveness concerns, but the EU has a long track record of phased expansion. Companies approaching the EUR 450 million EU revenue threshold should monitor future rulemaking.

US regulatory environment. The SEC’s climate disclosure rule, adopted in March 2024, never took effect. The SEC voluntarily stayed the rule in April 2024, voted to end its defense of the rule in March 2025, and in 2026 proposed rescinding the rule in full through notice-and-comment rulemaking. As of this writing the rescission is not yet finalized, but the rule is stayed and unenforced, so US companies have no operative federal climate disclosure mandate. That gap between US and EU approaches creates strategic complexity for multinationals, and understanding CSRD scope is part of the broader international regulatory monitoring every sophisticated finance function should maintain.

Timeline math matters. With ESRS-40a technical advice due in January 2027 and first reports covering 2028, companies that wait until 2027 to assess scope and build data infrastructure will be starting very late. The better approach is a scoping assessment in 2026, data gap analysis in 2027, and dry-run preparation throughout 2027 before the live reporting year.

Related reading: ESG Assurance 101: Limited vs. Reasonable Assurance

Frequently Asked Questions

Does CSRD apply to US companies?

CSRD can apply to US companies, but only to large multinationals. A US parent company must generate more than EUR 450 million in EU net turnover in each of the last two consecutive years and have an EU subsidiary or branch with more than EUR 200 million in EU net turnover. Companies that do not meet both thresholds are not directly subject to CSRD reporting obligations.

What is the reporting deadline for US companies under CSRD?

US companies in scope under CSRD’s third-country rules (Article 40a) will first report on financial year 2028 data, with the sustainability statement published in 2029. This timeline assumes the ESRS-40a standard is finalized by the European Commission following EFRAG’s technical advice, which is expected in January 2027.

What standard will US companies use to report under CSRD?

In-scope US parent companies will report under the ESRS-40a, a dedicated standard for non-EU undertakings being developed by EFRAG. As of September 2026, EFRAG’s exposure draft is out for public consultation. The standard is expected to be less burdensome than the full ESRS that apply to EU companies, reflecting the practicalities of reporting from outside the EU.

What did the Omnibus directive change for CSRD?

The Omnibus I Directive (Directive (EU) 2026/470), which entered into force in March 2026, reduced the scope of CSRD by approximately 80 percent. For EU companies, the new threshold requires both more than 1,000 employees and net turnover exceeding EUR 450 million. For non-EU (including US) companies, the dual threshold of EUR 450 million EU group turnover and EUR 200 million EU subsidiary/branch turnover remained. The directive also removed the planned escalation to reasonable assurance, keeping CSRD assurance at the limited assurance level.

Does CSRD apply to US companies that are not listed on EU stock exchanges?

Yes, the third-country provisions of CSRD (Article 40a) apply based on revenue thresholds, not on where a company’s securities are listed. A US company that is privately held can be in scope if its EU revenue exceeds the applicable thresholds. Being listed on an EU regulated market triggers a separate, earlier set of disclosure rules, but the absence of an EU listing does not create an exemption from the third-country rules.

What assurance is required for a US company’s CSRD sustainability statement?

In-scope US companies must obtain limited assurance, not a full audit, on their sustainability statement. Limited assurance requires the assurance provider to conclude that nothing has come to attention indicating the sustainability statement is materially misstated. The Omnibus directive removed the earlier planned transition to reasonable assurance, so limited assurance is the indefinite standard unless a future review changes course. The EU must adopt its limited assurance standards by 1 July 2027, and those standards are expected to draw on ISSA 5000. Companies should begin engaging a qualified assurance provider well before their first reporting year.