In short
- The CSRD test is turnover above EUR 450 million AND 1,000 employees. Both, not either.
- Fail either test and you are out of scope, and VSME is the standard to aim at.
- Most published guides still quote thresholds that were repealed in February 2026.
Run two tests. Did your undertaking exceed a net turnover of EUR 450 million during the financial year, and did it exceed an average of 1,000 employees during the financial year? If the answer to both is yes, you report under CSRD. If the answer to either is no, you do not, and the standard worth aiming at is the voluntary one, with one caveat about its status that this page comes back to. There is no third category and no partial scope. This page runs the test properly, including the cases where the simple version gives the wrong answer.
Which test do you actually have to pass?
Since Directive (EU) 2026/470 of 24 February 2026, Article 19a(1) of Directive 2013/34/EU applies to undertakings which, on their balance sheet dates, exceed a net turnover of EUR 450 000 000 and an average number of 1 000 employees during the financial year. Article 29a(1) says the same for a parent undertaking of a group, measured on a consolidated basis.
The conjunction in the enacted text is "and". Both tests, not either.
That single word decides most borderline cases, so it is worth being blunt about the consequences. A company with EUR 2 billion of turnover and 600 employees is out. A company with 4,000 employees and EUR 300 million of turnover is out. Neither of those is a loophole. It is what the directive says.
| Net turnover | Average employees | Result |
|---|---|---|
| Above EUR 450 million | Above 1,000 | In scope. CSRD reporting under Article 19a or 29a |
| Above EUR 450 million | 1,000 or below | Out of scope, and a protected undertaking in your customers' value chains |
| EUR 450 million or below | Above 1,000 | Out of scope. No value chain protection, because the cap is set at 1,000 employees |
| EUR 450 million or below | 1,000 or below | Out of scope, and protected |
The second and third rows are the ones people get wrong. Failing one test takes you out of CSRD, but only the employee number decides whether the value chain cap protects you, because the protected undertaking definition in Directive (EU) 2026/470 is written on employees alone: an undertaking that does not exceed, on its balance sheet date, an average number of 1,000 employees during the preceding financial year, and is in the value chain of a reporting undertaking.
What if you reported for financial year 2024 already?
Then you were in the first wave, and your position is genuinely more complicated than the table above.
The first wave, large public interest entities above 500 employees, was not given a stop-the-clock and was not removed retrospectively. It stayed in for financial years 2024, 2025 and 2026. Directive (EU) 2026/470 closed the window by rewriting Article 5(2)(a) of Directive (EU) 2022/2464 to read "for financial years starting between 1 January 2024 and 31 December 2026". From financial year 2027 a first-wave company reports only if it exceeds both new thresholds.
For the two years in between there is a Member State option, not a rule. Directive (EU) 2026/470 added a power for Member States to exempt undertakings that do not exceed EUR 450 000 000 net turnover or 1 000 employees for financial years starting between 1 January 2025 and 31 December 2026. Whether that exemption exists where you are depends on your own national transposition, so check the national law rather than the directive.
What if you were preparing for the second wave?
Then you are almost certainly out, and you may have spent two years getting ready for nothing.
The second wave was other large undertakings, and it was due to report for financial year 2025. Directive (EU) 2025/794 postponed it to financial year 2027, and Directive (EU) 2026/470 then narrowed the scope to the two tests above. Most of that population never filed a report and now never will.
If that is you, the work is not wasted, but its purpose has changed. What you built is no longer a compliance artefact with a filing date. It is the thing you answer customers with, and the rest of this page is about who those customers are.
What happened to listed SMEs?
They are gone from the regime, and this is one of the most commonly repeated errors on the open web.
Directive (EU) 2026/470 deleted point (c) of both the first and the third subparagraph of Article 5(2) of Directive (EU) 2022/2464, and deleted Article 29c of Directive 2013/34/EU, which was the empowerment for a separate listed-SME standard. Recital 21 states it plainly: the directive excludes small and medium-sized undertakings whose securities are admitted to trading on a regulated market in the Union from the sustainability reporting regime.
If you are a listed SME and someone has told you that you report from financial year 2026, or from financial year 2028 after the postponement, they are working from a repealed version.
What about a non-EU parent?
Third-country undertakings survive under Article 40a with raised numbers, and they are on their own timetable.
The third-country group must have generated net turnover in the Union above EUR 450 000 000, raised from EUR 150 000 000, in each of the last two consecutive financial years, and the EU subsidiary or branch that has to publish must exceed EUR 200 000 000 net turnover. That regime applies for financial years starting on or after 1 January 2028.
So a US or UK parent with a modest European footprint that was preparing for 2028 under the old EUR 150 million figure should re-run the arithmetic before spending anything.
What should you do with each answer?
In scope. You need a greenhouse gas inventory that survives a limited assurance opinion. ESRS E1-6 requires gross scope 1, gross scope 2 and gross scope 3 in tonnes of CO2eq plus a total, with scope 2 reported twice, once location-based and once market-based, and the total presented on both bases. Scope 3 covers each significant category, meaning each category that is a priority for you, not all fifteen automatically. Start at CSRD consulting and, for the value chain half, scope 3 consulting.
Out of scope and protected. Your obligation is commercial, not legal. Build a repeatable inventory good enough to answer a customer and aim at the voluntary standard rather than full ESRS. What VSME covers is the starting point, and which ESG questions you can refuse is what to read before your next questionnaire.
Out of scope and not protected, meaning above 1,000 employees but under the turnover threshold. This is the awkward middle. You have no reporting duty and no statutory ceiling on requests, so the answer is a good inventory and a firm commercial line.
If you are out of scope, what exactly are you aiming at?
Be careful here, because "the voluntary standard" is not yet a settled thing and a lot of writing treats it as one.
VSME is an EFRAG standard, developed at the Commission's request and delivered in December 2024, with a basic module and a comprehensive module. Its only standing in EU law today is Commission Recommendation (EU) 2025/1710 of 30 July 2025, which reproduces it in Annex I and recommends its use. A recommendation binds nobody, and that Recommendation says there is no obligation to provide assurance on information reported by non-listed SMEs and that a self-declaration is sufficient.
What is coming is different. Article 29ca of Directive 2013/34/EU, inserted by Directive (EU) 2026/470, requires the Commission to establish sustainability reporting standards for voluntary use, based on that Recommendation in its original version. The Commission adopted that act on 3 July 2026 as C(2026) 5011. It was still in Parliament and Council scrutiny on 28 August 2026, and its own Article 3 applies from financial years beginning on or after 1 January 2027.
The practical reading: build to VSME now, because the delegated act is based on it and the emissions work underneath does not change. But do not tell a customer, or let a customer tell you, that the voluntary standard is in force with fixed content. It is not yet, and that also means nobody can yet say with authority which questions sit above it, which is the line the value chain cap turns on.
Why do so many guides still give the wrong answer?
Because the scope was cut twice in eighteen months. Directive (EU) 2025/794 moved the dates and Directive (EU) 2026/470 replaced the thresholds and deleted two of the three waves. Anything written before late February 2026, and a great deal written after it, still describes large undertakings meeting two of three criteria at EUR 25 million balance sheet, EUR 50 million net turnover and 250 employees. That has not been the trigger since 24 February 2026.
If a page quotes 250 employees, 500 employees, or a listed-SME wave, stop reading it.
When does your answer take effect?
Financial years starting on or after 1 January 2027 are the first ones reported under the revised scope. Because CSRD is a directive, the obligation reaches you through national law, and Member States must transpose Articles 1, 2 and 3 of Directive (EU) 2026/470 by 19 March 2027. The date that governs you is therefore the national one, not the EU one.
Whichever answer you got, the calculation underneath is the same work. The Hedgehog platform covers the GHG Protocol with named legislation support including CSRD, has more than 20,000 spend-based and activity-based factors, handles multiple entities with roles for data owners, auditors and managers, and serves 5,000+ users. Free account, no sales call, Pro from EUR 1,200 per year.
One caveat if you landed in scope: a Mid-Market reviewer on G2 rated us 4 out of 5 in July 2026 and said the applied conversion factors and distance calculations are not exposed in the interface, so you cannot always trace how an input became an entry. Under limited assurance that traceability matters, so raise it with us early rather than at audit.
Not sure which row you are in? Book a call and we will run the test with your actual numbers.
Sources: Directive (EU) 2026/470, Directive (EU) 2025/794, Directive (EU) 2022/2464, Directive 2013/34/EU, Commission Recommendation (EU) 2025/1710, and Annex I to Delegated Regulation (EU) 2023/2772 as amended by Delegated Regulation (EU) 2025/1416, which is the version of the ESRS in force. Commission Delegated Regulation C(2026) 5011 of 3 July 2026 was adopted but still in scrutiny when we read it. All verified against the Official Journal text on 28 August 2026. Hedgehog facts verified 27 August 2026. Page verified 17 September 2026.
Facts on this page were last verified on 2026-09-17.
