A US client with a French factory, a German sales subsidiary or a large EU customer base now asks one question: does the EU's Corporate Sustainability Reporting Directive (CSRD) reach us? The answer changed in 2026. Directive (EU) 2026/470, the first Omnibus simplification package, cut the scope sharply. This post sets out the tests as they stand on November 5, 2026, so you can document a scoping conclusion for a client in an afternoon.
It covers scoping only. It does not cover who may sign a CSRD assurance report in the EU.
What changed in 2026
Directive (EU) 2026/470 was published in the Official Journal on February 26, 2026. The European Commission's own delegated acts of July 3, 2026 state that it entered into force on March 18, 2026 and that member states must transpose it by March 19, 2027. Two things follow from that timeline:
- The thresholds below come from the directive, but each member state's national law must catch up by March 2027. Scoping for a specific EU subsidiary should read the law of the country where it is established.
- Companies that were in scope under the original 2022 directive may now fall out of scope. A client that built a CSRD project in 2025 should re-run the tests.
Test 1: EU companies, including EU subsidiaries of US groups
An EU undertaking must report if it exceeds both of these:
- an average of more than 1,000 employees during the financial year, and
- net turnover of more than EUR 450 million.
Both conditions are cumulative. A company with 3,000 employees and EUR 300 million of turnover is out. Reporting under this test begins in 2028 for financial years starting on or after January 1, 2027.
For a US group, each EU legal entity is measured on its own numbers. A subsidiary is not required to report individually if it is included in its parent's consolidated sustainability reporting. A law firm summary of the directive notes that large companies with securities admitted to trading on an EEA regulated market, which were previously carved out of that exemption, can now rely on it.
Test 2: non-EU parents
A non-EU company is in scope if it meets both of these:
- net turnover generated in the EU above EUR 450 million, at group or individual level, in each of the last two consecutive financial years, and
- an EU subsidiary or branch with net turnover above EUR 200 million in the preceding financial year.
Reporting under this test begins in 2029 for financial years starting on or after January 1, 2028. A US parent that needs a number for the board can use the sequence below.
| Step | Question | Source of data |
|---|---|---|
| 1 | What was group net turnover generated in the EU in each of the last two years? | Revenue by customer location, from the consolidation |
| 2 | Is each year above EUR 450 million? | Step 1 |
| 3 | Does any EU subsidiary or branch exceed EUR 200 million net turnover in the preceding year? | Statutory accounts of each EU entity |
| 4 | Both yes: in scope from financial years starting January 1, 2028 |
Worked example
All figures are illustrative. A US manufacturer has EU-customer revenue of EUR 410 million in year 1 and EUR 470 million in year 2. Its Dutch subsidiary has net turnover of EUR 230 million. The test needs EU turnover above EUR 450 million in both of the last two years. Year 1 fails, so the parent is not in scope on those facts. If year 3 also exceeds EUR 450 million, the two-year window is satisfied at that point and the Dutch subsidiary's EUR 230 million exceeds the EUR 200 million subsidiary test. The conclusion is a date-specific position, so document the years tested and the data used.
The Dutch subsidiary is tested separately under Test 1. At EUR 230 million of turnover it is below EUR 450 million and out of scope there, whatever its headcount.
The value chain cap
Many US companies are caught indirectly: an EU customer in scope asks its suppliers for emissions and other data. The directive limits this. A company with 1,000 employees or fewer may refuse information requests from a reporting customer that go beyond a voluntary reporting standard, and contractual clauses to the contrary are ineffective.
The Commission adopted that voluntary standard for undertakings protected by the value chain cap in a delegated regulation dated July 3, 2026. A supplier that receives a questionnaire longer than the voluntary standard has a documented basis to answer only what the standard asks.
The revised ESRS
A second delegated regulation of July 3, 2026 amends the European Sustainability Reporting Standards (ESRS) to simplify them. Its explanatory memorandum says the amended standards apply to financial years beginning on or after January 1, 2027, and that for financial years beginning in 2026 undertakings may choose between the existing and the amended version. A law firm summary reports that the revised ESRS draft EFRAG submitted to the Commission cut the number of datapoints by 61 percent.
For a client reporting for the first time, the practical effect is that data collection should be built to the amended standards, not the 2023 version.
Assurance
Under the amended directive, the deadline for the Commission to adopt limited assurance standards moves to July 1, 2027, and the obligation to adopt reasonable assurance standards is removed. For US firms, the connected piece is the international standard, ISSA 5000, covered in GHG emissions assurance under ISSA 5000, and the US attestation drafts in AICPA sustainability attestation: examination vs review.
What a CPA firm should put in the file
- A scoping memo for each client with EU operations, showing employees, net turnover and EU turnover by year against each test.
- The legal entity list with the country of establishment, since transposition varies by country.
- A note on the value chain cap for any client that is a supplier to EU reporters.
- A decision on whether the client will prepare data to the amended ESRS for 2027.
Revenue by customer location and by entity is the starting point. A QuickBooks ledger with class or location tracking produces it directly, and a mapped trial balance ties it to the consolidated total. See auditing a client on QuickBooks Online for how those reports tie to the books.
FAQ
Does a US company with no EU subsidiary fall under the CSRD?
Only if it generates more than EUR 450 million of net EU turnover for two consecutive years and has an EU subsidiary or branch above EUR 200 million. Without an EU subsidiary or branch, the second condition cannot be met.
What are the employee and turnover thresholds for EU companies?
More than 1,000 average employees and more than EUR 450 million of net turnover, both required.
When do the first reports fall due?
Reports for financial years starting January 1, 2027 are published in 2028 for EU companies. Non-EU parents start with financial years beginning January 1, 2028, with reports in 2029.
Sources
- European Parliament Legislative Observatory, Omnibus I summary
- European Commission, Delegated Regulation C(2026) 5010 of 3.7.2026 amending Delegated Regulation (EU) 2023/2772
- European Commission, Delegated Regulation C(2026) 5011 of 3.7.2026, standards for voluntary use by undertakings protected by the value chain cap
- Crowell & Moring, Key updates to the CSRD and the CS3D from the Omnibus I Directive
- William Fry, Omnibus 1 Directive comes into force in March 2026
CORAA prepares ready-to-review audit files for US CPA firms from client books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error