In short
- No EU-level CSRD penalty exists. It is a directive, so sanctions are set by each Member State in its transposing law.
- Any specific fine figure quoted as an EU CSRD penalty is not coming from the directive text.
- The one enforcement mechanism the directive does create runs the other way: a supplier's statutory right to refuse over-broad requests.
Here is the position, and it is less dramatic and less certain than most pages will tell you. CSRD is an amending directive. It creates duties for Member States to legislate, not a fine schedule you can look up. There is no EU-level CSRD penalty, no tariff table and no published enforcement statistic, and the national regimes that will do the enforcing follow from a transposition deadline of 19 March 2027 for the revised scope. If you have been quoted a euro figure as the CSRD fine, it did not come from the directive. What the text does establish is narrower and more useful, and it is below.
Why can nobody tell you the fine?
Because of what kind of instrument this is, not because the information is hidden.
Directive (EU) 2022/2464 does not stand alone. It writes sustainability reporting duties into the Accounting Directive, 2013/34/EU, at Articles 19a, 29a and the surrounding provisions. A directive binds Member States to produce a result in national law. It does not bind your company directly, and it is national law that carries the sanction, the enforcing body and the procedure.
That means the honest answer to "what is the penalty" is a question back: which Member State are you filing in, and has it transposed yet? Directive (EU) 2026/470, which reset the scope in February 2026, has a transposition deadline of 19 March 2027 for its Articles 1, 2 and 3. The separate amendments it makes to the due diligence directive run to 26 July 2028.
We are not going to invent a number to fill the gap. A page that tells you plainly that this is not published anywhere reliable is worth more than a confident figure you would repeat to your board.
What does the directive actually establish?
Quite a lot, none of it a sanction. Separating the two is the useful part.
| Question | What the text establishes |
|---|---|
| Who must report | Undertakings above both EUR 450 million net turnover and an average of 1,000 employees |
| From when | Financial years beginning on or after 1 January 2027 |
| Where the report goes | Inside the management report, marked up in a machine readable format under Article 29d |
| Who checks it | A statutory auditor or assurance provider, giving a limited assurance opinion under Article 34(1) |
| What the opinion covers | Compliance with the directive and the ESRS, the process used to identify the information, the Article 29d markup, and the Article 8 EU Taxonomy disclosures |
| What the sanction is | Not established at EU level. National law, following transposition |
| When national regimes exist | After each Member State transposes, deadline 19 March 2027 |
The fifth row is where the practical pressure sits. There is a professional opinion attached to your sustainability statement, given by someone with their own regulator and their own liability. That is a real consequence and it arrives long before any authority comes looking.
Note what that opinion is not. It is limited assurance, not reasonable assurance. Directive (EU) 2026/470 removed the empowerment that would have introduced reasonable assurance standards, so the planned escalation no longer exists. The Commission's own harmonised limited assurance standards are not due until 1 July 2027, which means assurance is currently performed under national standards. Practically, your provider will ask how each number was produced and will want to see the trail rather than the total.
Is there any enforcement mechanism written into the text?
One, and it runs in the direction people do not expect: it protects suppliers from reporters.
Directive (EU) 2026/470 turned the value chain cap into a statutory right in Articles 19a(3) and 29a(3) of the Accounting Directive. An undertaking that does not exceed an average of 1,000 employees, and that sits in a reporting company's value chain, is a protected undertaking. Protected undertakings have the right to decline to provide information exceeding what the voluntary standards specify, where the request is made for the purpose of CSRD reporting. Reporting undertakings must not require more than that. And the enforcement clause is unusually blunt: any contractual provision to the contrary is not binding.
The reporter also has positive duties. If it asks for more, it has to tell the supplier which information exceeds the voluntary standard and that the supplier has a statutory right to decline. It may rely on a supplier's self-declaration of size without verifying it, unless it knows the declaration is manifestly incorrect.
The limits are equally clear, and overstating them will cost you a customer. The cap covers information gathering for CSRD reporting only. It does not touch due diligence requests, risk management requests, a tender, or a customer's own procurement questions, and it does not stop voluntary sharing or override an existing contractual obligation to provide information that sits inside the voluntary standard. We walk through where that line falls in what a supplier may refuse to answer.
What are the consequences that actually arrive first?
In practice, three, in this order, and none of them is an authority.
The assurance opinion. A qualified or modified opinion on a public document is visible to everyone who reads the management report, including lenders and rating providers. This is the fastest-acting consequence in the system.
The commercial one. Companies inside CSRD must report value chain information, and they push that requirement down their supply base. If you cannot answer, the account is the enforcement mechanism, whatever national law does or does not say. That applies to companies with no reporting duty of their own.
The national one, later. Whatever each Member State legislates, arriving after transposition. Until your country's act exists and is published, that is genuinely unknown, and treating it as unknown is the correct planning posture.
What should you do about a risk nobody can size?
Stop trying to size it and work on the thing that removes it. Two cases.
If you are above both thresholds, the exposure you can act on is the assurance opinion, not a hypothetical fine. That means the evidence trail: which source file produced which figure, who owns it, and whether a reviewer can follow it without you in the room. Scope 2 held separately on location based and market based figures, scope 3 by significant category with a defensible selection, and an intensity denominator reconciled to a line in the financial statements. If assembling the full statement around the emissions work is the gap, that is CSRD consulting territory, and the scope 3 selection specifically is scope 3 consulting.
If you are below either threshold, you have no CSRD filing duty and therefore no CSRD sanction to worry about, in any Member State. Do not let a vendor tell you otherwise. Your real risk is commercial, and the answer to it is a repeatable inventory plus knowing where the cap sits.
Where does Hedgehog help, and where does it not?
On the evidence side, which is the part an assurance provider actually tests. The platform walks you through GHG Protocol setup, identifying data sources, data owners and documents, and lets you invite consultants and auditors into the account with their own roles. It covers over 20,000 spend based and activity based factors and has 5,000+ users. Free account, no sales call.
Two limits worth having before you commit. A Mid-Market reviewer rated us 5 out of 5 on G2 in June 2026 and said they want more integrations with other software in future. We have few today, which matters if your evidence has to be pulled automatically from finance systems rather than loaded. And we are not a legal service: nothing here tells you what your Member State will enact, and we would rather say that than guess.
If your national transposing act has been published, read it, because that is the only document that answers the question this page is about.
Sources: Directive (EU) 2022/2464, Directive (EU) 2026/470 of 24 February 2026, Directive 2013/34/EU Articles 19a, 29a, 29d and 34, Directive 2006/43/EC Article 26a, all read against the Official Journal text. Verified 28 August 2026. No EU-level CSRD sanction is established in these sources; national penalty regimes follow transposition and are outside them.
Facts on this page were last verified on 2026-09-17.
