In short
- Four routes reach a US group and they land on different entities. Work out which entity carries which duty before anything else.
- The Article 40a group threshold tripled to EUR 450 million of EU net turnover. Many groups that were preparing are now out.
- Product rules like EUDR and PPWR bind by role in the chain with no size threshold, so a small US exporter can be fully in scope.
Four routes, and they land on different legal entities on different dates. Your EU subsidiary can be caught in its own right from financial year 2027 if it exceeds both EUR 450 million of net turnover and 1,000 employees. From financial year 2028 your EU subsidiary or branch must publish a report about your US group under Article 40a if the group generated more than EUR 450 million of EU net turnover in each of the last two consecutive years. Product rules catch you by role, with no size threshold at all. And your EU customers will ask regardless. Sort the entity question first.
Most US groups run this backwards, starting with the reporting standard and only later asking which company in the structure actually owes anything.
Which four routes actually reach you?
Here they are with the entity that carries each one, which is the column that decides who does the work.
| Route | What triggers it | Which entity carries it | First financial year |
|---|---|---|---|
| CSRD in its own right | An EU undertaking above both EUR 450 million turnover and 1,000 employees | That EU undertaking, or its EU parent on a consolidated basis | Beginning on or after 1 January 2027 |
| Article 40a third-country regime | Group EU net turnover above EUR 450 million in each of the last two consecutive years, plus an EU subsidiary or branch above EUR 200 million | The EU subsidiary or branch, publishing about the third-country group | Beginning on or after 1 January 2028 |
| Product and market access rules | Your role in the chain, not your size | Whichever entity places goods on the EU market | Already running |
| Customer demand | Being in the value chain of a company that reports | Whichever entity holds the relationship | Now |
The first two are separate obligations on separate timetables with different first years, and a group can be caught by both, by one, or by neither. Treating them as a single CSRD question is the most expensive mistake in this area.
Can your EU subsidiary be caught on its own?
Yes, and this is the route people forget because it has nothing to do with being American.
Since Directive (EU) 2026/470 of 24 February 2026, Article 19a(1) of Directive 2013/34/EU reaches undertakings that exceed, on their balance sheet dates, a net turnover of EUR 450 000 000 and an average of 1 000 employees during the financial year. Article 29a(1) applies the same test to a parent undertaking of a group on a consolidated basis. Both tests, not either.
For a US group with a large European operating company, that means the European company runs the test on its own numbers, or on the numbers of the EU sub-group it heads. Your global turnover does not enter into it. Nor does your US headcount.
If an EU entity is caught this way, Article 8 of the EU Taxonomy comes with it automatically, because that provision binds whoever is already subject to Articles 19a or 29a. It asks for three financial ratios rather than a carbon number, and it arrives without a separate scope test.
What does the Article 40a regime actually require?
Publication by an EU entity about the third-country group, and the numbers moved sharply in your favour in February 2026.
The group must have generated net turnover in the Union above EUR 450 000 000, raised from EUR 150 000 000, in each of the last two consecutive financial years. The EU subsidiary or branch that has to publish must itself exceed EUR 200 000 000 of net turnover. The regime applies for financial years starting on or after 1 January 2028, a date Omnibus I did not move.
The threshold change is the practical headline. A group with, say, EUR 250 million of EU turnover was inside the old regime and is outside the new one. If your preparation budget was set before February 2026, re-run the arithmetic before spending any more of it.
Two things worth knowing about the mechanics. If the third-country parent will not supply the data or an assurance opinion, the obligation does not lapse. It converts into a published statement recording that the parent did not cooperate, which is a reputational outcome rather than an escape. And the empowerment for a separate third-country reporting standard under Article 40b survived Omnibus I, but no such standard has been published, so nobody can currently tell you the final content of a 40a report. If you are close to the line, CSRD consulting is where to test it.
What catches you regardless of size?
Product and market access rules, and they are the ones a mid-sized US exporter is most likely to actually meet.
EUDR binds by role in the chain rather than by company size. Whoever first places a relevant product on the EU market or exports it from the EU is an operator and carries the full due diligence and due diligence statement obligation. Seven commodities are covered: cattle, cocoa, coffee, oil palm, rubber, soya and wood, along with the products made from them. Note what it does not ask for. It creates no greenhouse gas accounting obligation of any kind. What it wants is plot geolocation, evidence of legal production, a documented risk assessment and a statement filed in the EU information system.
PPWR works the same way. It sets product requirements for all packaging placed on the EU market and rebuilds extended producer responsibility around them, with no general turnover or headcount threshold. There are targeted micro-enterprise carve-outs written into individual articles, and they should not be generalised into a blanket small-company exemption. It contains no carbon footprint requirement either.
If your exports include specific goods rather than general merchandise, there is also a separate border mechanism that attaches to the goods rather than to your company, and we cover it in CBAM.
What if you are under every threshold and still being asked?
That is the normal case, and it now comes with one piece of leverage.
Your European customers that do report have to disclose value chain information, have to include scope 3 for every significant category, and are told to estimate with sector averages where they cannot collect. So the questionnaire survives the narrowing of the rule that produced it.
Since February 2026, an undertaking that does not exceed an average of 1,000 employees in the preceding financial year and sits in the value chain of a reporting undertaking has a statutory right to decline information exceeding the voluntary standard, where the request is made for that customer's own sustainability reporting. Any contractual provision to the contrary is not binding.
One honest caveat for a US reader. The definition in the enacted text turns on headcount and on being in a reporter's value chain, and CSRD is a directive, so the right reaches anyone through national transposing law due by 19 March 2027. How that works for a supplier established outside the Union is a question to put to your customer and your counsel rather than one to assume the answer to. What is not in doubt is that the cap covers reporting requests only. It does not touch due diligence, risk management or ordinary commercial questions. We set out how to use it in which ESG questions you can refuse.
What should a US group do first?
In this order, because each step can make the next one unnecessary.
Run the group EU turnover test. Above EUR 450 million in each of the last two consecutive years, or not. If not, Article 40a is closed and you can stop reading about it.
Run the subsidiary test separately. Any EU entity above both EUR 450 million and 1,000 employees carries its own duty, on a 2027 timetable rather than a 2028 one.
Map your role in the chain for product rules. Operator, importer, manufacturer or none. This is a question about logistics and contracts, not about size.
Build one global inventory anyway. Every route above that wants an emissions number wants the same one, and consolidating across jurisdictions is the longest lead item by a wide margin. Scope 3 consulting is usually what sets the timetable, and CSRD consulting is the route if an EU entity is genuinely in scope. Below the thresholds, aim at the VSME standard rather than full ESRS.
You can start on a free account without a sales call. The platform serves 5,000+ users, covers more than 20,000 spend-based and activity-based factors and handles multiple entities across locations and sites.
One limit relevant to a multi-entity group. A Mid-Market reviewer on G2 asked in June 2026 for more integrations with other software in future, and we have few today. If you are hoping to pipe ERP data in automatically across a dozen entities, that is not where the product is yet.
Sources: Directive (EU) 2026/470, Directive (EU) 2022/2464 Article 5(2), Directive 2013/34/EU Articles 19a, 29a and 40a, Regulation (EU) 2020/852 Article 8, Regulation (EU) 2023/1115, Regulation (EU) 2025/40, all read against the enacted texts on 28 August 2026. No Article 40b third-country reporting standard had been published on that date. Hedgehog platform and Hedgehog on G2, both read on 27 August 2026. Page verified 17 September 2026.
Facts on this page were last verified on 2026-09-17.
