CSRD FAQ: 20 Questions Enterprise Compliance Teams Are Actually Asking

By Selin Yilmaz, VP Customer Success

In our conversations with enterprise sustainability and legal teams preparing their first CSRD disclosure, the same questions come up again and again. Some are scope questions ("who does this actually apply to?"), some are technical ("what do we do when we don't have the data?"), and some are anxiety questions ("what happens if we get something wrong?"). This article addresses the 20 we hear most frequently, in the order they tend to surface during a preparation cycle.

Applicability and Scope

1. We're a US company. Does CSRD apply to us?

CSRD applies to any company that meets the size thresholds and has either a registered office in the EU, a listed securities on an EU-regulated market, or generates more than EUR 150 million in net turnover in the EU and has either a branch with more than EUR 40 million turnover or a subsidiary that meets the size thresholds. Many US multinationals with significant EU operations will fall under CSRD through the subsidiary or branch route. The first mandatory filing year for those companies is FY2028 (under the current timeline for third-country companies), though parent-company disclosure requirements may come earlier through EU subsidiary reporting obligations.

2. Our EU subsidiary needs to report. Does the US parent need to do anything?

An EU subsidiary subject to CSRD must produce a sustainability statement compliant with ESRS. If the EU subsidiary is part of a consolidated group and the group produces a group-level CSRD-compliant sustainability report that includes the subsidiary, the subsidiary-level reporting obligation is waived. In practice, this means the parent company often ends up preparing a group CSRD report that satisfies both the EU subsidiary's legal obligation and the parent's own reporting goals. This consolidation benefit is worth planning for early — it avoids duplicate reporting effort.

3. Does CSRD apply to our non-EU subsidiaries and operations?

Yes, in the sense that your organisational boundary for GHG reporting should follow your consolidation approach (operational control or equity share) and include all operations within that boundary, regardless of geography. A US manufacturing plant owned by an EU-reporting entity is inside the reporting boundary. Its Scope 1 and 2 emissions are part of the group inventory. The CSRD filing obligation is with the EU entity; the data collection obligation extends globally.

4. We have 450 employees and EUR 45 million revenue. Do we have to report?

Not yet under mandatory CSRD timelines. The Wave 1 threshold was large public-interest entities with more than 500 employees. Wave 2 (FY2025 mandatory) covers large companies meeting two of three criteria: more than 250 employees, more than EUR 40 million net turnover, or more than EUR 20 million balance sheet total. If you exceed two of those three criteria, you are in Wave 2. At 450 employees and EUR 45 million turnover, you likely meet two criteria and would fall under Wave 2 mandatory reporting for FY2025.

5. We're privately held. Does CSRD still apply?

Yes — CSRD applies to both listed and unlisted companies that meet the size criteria. The EU-listed requirement applies only to the smallest Wave — micro-enterprises listed on EU-regulated markets. Mid-market private companies meeting the two-of-three size criteria are in-scope from Wave 2 regardless of listing status.

GHG Inventory and Scope 3

6. Do we have to report all 15 Scope 3 categories?

No — but you must conduct a materiality assessment of all 15 categories and disclose which ones are material, which are not, and the basis for each materiality determination. For material categories, you must report inventory figures. For non-material categories, you must document the analysis that led to the non-materiality conclusion. Omitting a category without documented justification is not compliant — it's an undocumented gap.

7. We don't have data for Category 1 (purchased goods and services). What do we do?

Category 1 is almost always material for manufacturers and product companies, so the first question is whether it can be excluded. Typically it cannot. For companies without primary supplier data, the GHG Protocol allows spend-based estimation using economic input-output models (Exiobase for EU operations, USEEIO for North American operations). Spend-based estimates have ±30-50% relative uncertainty — that uncertainty must be disclosed. Over subsequent reporting cycles, the expectation under ESRS E1 is that primary data coverage improves, particularly for the top suppliers by spend concentration.

8. How do we handle suppliers who refuse to share emission data?

This is common, especially in early years of supply chain engagement. When a supplier declines to provide primary data, you fall back to spend-based or activity-based estimates using the best available proxy factor. You document the estimation method and note that primary data was requested but not received. Over time, supplier engagement programs — structured data requests with response tracking — gradually shift the balance toward primary data. Some enterprises use procurement policy tools — preferred supplier status, contract requirements — to improve response rates. We've seen response rates move from below 15% to above 40% in two reporting cycles for companies with systematic engagement programs.

9. Do financed emissions (Category 15) apply to us?

Category 15 — investments — applies to financial institutions and companies with significant investment portfolios. For non-financial enterprises, investments in subsidiaries, joint ventures, and unconsolidated entities may require Category 15 accounting if those investments are material and outside the operational boundary. The PCAF (Partnership for Carbon Accounting Financials) standard provides the methodology for financed emission calculations. If your group has significant minority stakes in industrial operations, a Category 15 materiality assessment is worth conducting.

Disclosure Mechanics and Format

10. What is XBRL and do we have to produce it ourselves?

XBRL (eXtensible Business Reporting Language) is the machine-readable tagging format required for CSRD disclosures. The ESRS XBRL taxonomy, which maps each ESRS disclosure requirement to a structured data element, has been developed by EFRAG and the EC. Companies are required to tag their sustainability statements in XBRL as part of the electronic reporting format under the European Single Electronic Format (ESEF) rules. In practice, most enterprises use reporting software or specialist tagging services to produce the XBRL output — manual tagging by hand is possible in theory but impractical at scale. Check whether your existing financial reporting tool (SAP, Oracle Financials, Workiva) supports ESRS XBRL tagging; many are adding that capability.

11. Does our CSRD disclosure have to be in the annual report?

CSRD requires the sustainability statement to be included in the management report — which is part of the annual report under EU accounting directives. It cannot be a separate stand-alone document. The sustainability statement must be clearly identified and positioned within the management report, and the XBRL tagging applies to the digital version submitted to the relevant national registry.

12. What language must the sustainability statement be in?

The management report (and therefore the sustainability statement) must be submitted in the official language of the EU member state where the reporting entity is incorporated. For group-level reporting by a parent company with subsidiaries across multiple member states, the language requirement follows the parent's incorporation country. Many multinationals produce disclosures in English as an additional version, particularly for investor audiences, but the official filed version must comply with national language requirements.

Assurance Requirements

13. What is limited assurance and how is it different from financial audit?

Limited assurance is a lower-rigor review than the reasonable assurance applied to financial statements. A limited assurance engagement produces a conclusion in negative form: "nothing has come to our attention that causes us to believe the sustainability statement is materially misstated." It does not provide positive confirmation that the statement is correct. The auditor performs sufficient procedures to identify material misstatements but doesn't seek to obtain the same level of evidence as a financial audit. CSRD starts with limited assurance requirements, with the expectation that reasonable assurance requirements will be phased in after 2028.

14. Who can provide CSRD assurance?

CSRD allows assurance by the statutory financial auditor or, in some member states, by an independent assurance provider (IAP) where national law permits. In practice, Wave 1 filers have primarily used their Big-4 or mid-tier financial auditor for sustainability assurance, since that relationship already exists and the auditor is familiar with the entity. Specialized sustainability assurance providers are also emerging, particularly for companies seeking a different perspective than their financial auditor offers.

15. What if the auditor qualifies our sustainability statement?

A qualified assurance conclusion is a significant outcome — it signals to investors, regulators, and stakeholders that the sustainability statement has material limitations. The most common causes of qualification in early CSRD assurance engagements are: insufficient data lineage for GHG calculations, unsupported Scope 3 materiality exclusions, and financial impact quantifications for climate risks that the auditor cannot substantiate. None of these are unavoidable — they are addressable with proper preparation. The question to ask when a qualification risk is identified is: can we fix the underlying data or documentation issue before the auditor issues their conclusion? In most cases, if identified 6-8 weeks before the filing deadline, yes.

Practical Preparation Questions

16. We missed the Wave 1 filing date. What are the consequences?

CSRD non-compliance enforcement is implemented by EU member states, not by Brussels directly, and the enforcement mechanisms and penalties vary by country. Late filing is treated as a compliance failure under the relevant national implementation of CSRD, typically with financial penalties and potential disclosure in the national registry. More consequentially, institutional investors subject to SFDR disclosure obligations need to access CSRD data from portfolio companies — a late or missing CSRD report creates downstream problems for those investors. If you missed Wave 1, the practical priority is to file as soon as possible and document the circumstances of the delay.

17. Can we disclose a range for our Scope 3 emissions instead of a point estimate?

ESRS E1-6 requires disclosure of GHG figures in tCO2e. Ranges are not standard — you report a figure. However, you are required to disclose the estimation uncertainty and methodological limitations for each significant Scope 3 category. In practice, this means reporting a figure derived from spend-based or activity-based estimation, then disclosing the uncertainty range (e.g., "±40% relative to primary data") and the methodology used. The disclosure of uncertainty does not replace the point estimate; it contextualizes it.

18. What happens when we restate a prior year figure?

GHG Protocol and ESRS E1 both require restatement of base year and comparative figures when changes are significant. The restatement must be disclosed: what changed, why, the magnitude of the change, and whether the base year has been revised as a result. Auditors reviewing your current-year disclosure will check that prior-year comparative figures in the current report match the prior-year filed figures, or that differences are explained as documented restatements. Undisclosed restatements — where numbers have quietly changed between filings — are a red flag in assurance engagements.

19. How do we handle data gaps for the first filing when we simply don't have historical data?

First-year filers almost always have some data gaps, particularly in Scope 3. ESRS E1 accommodates this within the materiality and estimation framework: you disclose that data is not available, explain the estimation method used as a proxy, and set out a data collection roadmap for subsequent periods. What you cannot do is leave a material category blank without explanation. The narrative around data gaps is as important as the figures themselves — it shows auditors and stakeholders that you understand your inventory boundaries and have a plan to improve data quality.

20. Is there a safe harbor period where early CSRD disclosures are given more flexibility?

EFRAG and the European Commission have acknowledged that first-year disclosures will reflect immature data collection processes, and auditors are expected to apply judgment appropriate for the maturity of the reporting entity. Some ESRS requirements include explicit phase-in provisions — for example, Scope 3 Category 15 financial institutions' requirements have a longer phase-in under EFRAG guidance. However, "phase-in" doesn't mean "exempt" — it means the specific requirement doesn't apply until the stated year. For the categories and requirements that are in scope for your filing year, there is no formal safe harbor. The expectation is reasonable effort, documented methodology, and honest disclosure of limitations — not perfection, but not blank fields either.

CSRD preparation is complex enough that there will always be another question. The enterprises that navigate it best are the ones that start structured data collection 18-24 months before the first filing date, document every methodological decision as they go, and treat the first filing as the baseline for continuous improvement — not a one-time compliance exercise. That approach produces both better disclosures and less painful assurance reviews.