CSRD readiness for US groups with EU operations

In most cases only through its EU entities. A US company with no EU subsidiary or branch is generally outside CSRD, and counsel confirms edge cases such as an EU listing. For groups that do have EU entities, three routes exist, using the thresholds in Directive (EU) 2026/470.

A subsidiary included in its parent's consolidated management report is generally exempt from reporting separately (Article 19a(9)), and must say so in its own report, naming the parent that reports. Directive (EU) 2022/2464 applies the Article 40a route to financial years starting on or after January 1, 2028, and the Omnibus text does not move that date.

Each member state sets the details when it transposes the directive, so the table is the starting point for a worksheet and not a conclusion. The conclusion belongs to counsel.

The Omnibus I package cut the number of companies in scope and moved dates. The ones a US group is most likely to need:

• February 24, 2026: Directive (EU) 2026/470 signed. February 26: published in the Official Journal. March 18: in force.
• March 19, 2027: member states must bring the CSRD amendments into national law (Article 5 of the Omnibus directive).
• Financial years starting on or after January 1, 2027: the second set of reporting undertakings applies, on the new thresholds. Undertakings that were in the first set but fall outside the new scope drop out from that date, and member states may exempt them for financial years beginning between January 1, 2025 and December 31, 2026.
• July 1, 2027: deadline for the Commission to adopt limited assurance standards. The requirement to adopt reasonable assurance standards was removed.
• July 3, 2026: the Commission adopted two delegated acts, one simplifying certain European Sustainability Reporting Standards (ESRS) and one setting voluntary standards for companies protected by the value chain cap (European Commission page, updated July 3, 2026).

The value chain cap matters to US suppliers of EU reporters. Companies in a reporting company's value chain with an average employee count of 1,000 or fewer may decline to provide information beyond the voluntary standard (Article 19a(3), and Article 29a(3) for groups, as amended by Directive (EU) 2026/470; the voluntary standards are those referred to in Article 29ca).

A report under CSRD follows the ESRS, set out in Commission Delegated Regulation (EU) 2023/2772: two cross-cutting standards (ESRS 1 and ESRS 2), five environmental standards (climate change, pollution, water and marine resources, biodiversity, and resource use and circular economy), four social standards (own workforce, workers in the value chain, affected communities and consumers) and one on business conduct. The July 3, 2026 delegated act simplifies certain of these standards, so a data request template built in 2024 may need trimming before it goes to a US entity.

Which topics a company reports depends on its double materiality assessment. ESRS 1 asks the company to assess impact materiality (its effect on people and the environment) and financial materiality (sustainability risks and opportunities that affect the company), and to report what is material on either view. That is a management judgment. Finbryn documents the inputs, such as the stakeholder list, the impact list and the scoring basis, and leaves the conclusions to management and the EU adviser.

The climate standard overlaps with a GHG inventory. A US entity that already holds Scope 1 and Scope 2 totals on the GHG Protocol basis has most of the emissions data the group will ask for.

The work starts from the ledgers Finbryn already works with, because CSRD asks for turnover, headcount and spend by entity.

• Applicability worksheet. Net turnover and average employee counts for each EU entity for the relevant years, with the source for each figure and the definition used, for counsel to read. For a non-EU parent, EU turnover of the group in each of the last two consecutive financial years and each EU subsidiary's turnover.
• Entity data schedules. One schedule per entity mapped to the data requests the group issues, tied to the general ledger or payroll report it came from. The IFRS reporting packs and consolidations work gives the same entity structure.
• Data request pack. A single list for the US parent's finance, HR and operations teams, with owners and the format the EU entity needs.
• Draft sections. Narrative and tables for management and the EU adviser to edit. Nothing is published until they approve it.

Where the information needed for a non-EU group report is not available, Article 40a(2) has the EU subsidiary or branch publish what it holds with a statement that the parent did not supply the rest. A tidy data request pack is the practical defense against having to issue that statement.

Three things stay outside Finbryn. Legal applicability is for counsel in the relevant member state, because national transposition varies and the first national laws are only due by March 19, 2027. The assurance opinion is for the statutory auditor or another firm authorised to give one. For a non-EU group report under Article 40a(3), the report is published with an assurance opinion from a person or firm authorised under the national law of the third country or of a member state, and if the parent does not provide one, the EU subsidiary states that. Finbryn gives neither the legal conclusion nor the opinion.

The third thing is the materiality conclusions and the sign-off. Finbryn drafts, management decides.