In short
- Only CSRD reporters must have emissions assured, and the level is limited assurance, not reasonable.
- The empowerment to introduce reasonable assurance was deleted in February 2026. There is no route to it in the text.
- Harmonised limited assurance standards are not due until 1 July 2027, so today's opinions are given under national standards.
Almost nobody, by law. The only emissions figures that must carry an assurance opinion are those inside a CSRD sustainability statement, which means undertakings above both EUR 450 million of net turnover and 1,000 employees, from financial years starting on or after 1 January 2027. The level is limited assurance. It is not going up: the empowerment to introduce reasonable assurance standards was deleted in February 2026. Everything else you have been told needs verifying is a certification audit, a rating, or a customer preference.
Those three things get called assurance in ordinary speech and they are not the same, which is why suppliers routinely buy the wrong one.
Who actually has to have their emissions assured?
CSRD reporters, through Article 34(1), second subparagraph, point (aa) of Directive 2013/34/EU as replaced by Directive (EU) 2026/470.
That provision requires the statutory auditor or assurance provider to express an opinion based on a limited assurance engagement as regards the compliance of the sustainability reporting with the requirements of the Directive. The opinion covers compliance with the ESRS, the process the undertaking used to identify the reported information, the Article 29d machine readable markup, and the Article 8 EU Taxonomy disclosures.
So the assured object is the sustainability statement, not the emissions number in isolation. Your greenhouse gas figures fall inside it because ESRS E1-6 puts them there, and the assurance provider is examining whether the statement complies rather than certifying your tonnage.
Who is inside that population is a narrow question with a precise answer. Both thresholds must be exceeded, turnover and headcount, not either. Fail one and you are outside the reporting duty, and therefore outside the assurance duty as well.
What does limited assurance mean, and what does it not mean?
Limited assurance is the lower of the two conventional levels, and the distinction is about the depth of work and the form of the conclusion rather than about how seriously anyone takes it.
What it does not mean is that the work is cosmetic. The opinion covers the process used to identify the reported information, which in practice means your boundary decisions, your materiality assessment and your data trail get looked at, not just the arithmetic.
What it also does not mean, right now, is that there is a single harmonised way of doing it. The Commission's deadline to adopt limited assurance standards under Article 26a(3) of Directive 2006/43/EC was moved from 1 October 2026 to 1 July 2027 by Directive (EU) 2026/470. Until those exist, assurance is performed under national standards. If you operate in several Member States, that is a practical variation worth asking your provider about early.
Whatever happened to reasonable assurance?
It was removed, and this is the single most out of date claim in circulation on the subject.
A great deal of published guidance still says that CSRD assurance will step up from limited to reasonable in 2028. Directive (EU) 2026/470 deleted the empowerment to adopt reasonable assurance standards by 1 October 2028, on the stated ground of avoiding an increase in assurance costs. There is no reasonable assurance requirement in the text and no longer a route to one.
If you are budgeting a multi-year assurance programme on the assumption of a step up, that assumption is now wrong, and the difference in cost is not small.
Who assures what, across the instruments?
The word covers five quite different situations.
| Instrument | Is assurance required? | Level and form | Who provides it | Under what standard |
|---|---|---|---|---|
| CSRD sustainability statement | Yes | Limited assurance opinion | Statutory auditor or assurance provider | National standards until harmonised ones arrive |
| The voluntary standard for SMEs | No | Self-declaration | You | None. Recital 16 says self-declaration is sufficient |
| CO2-Prestatieladder | Yes, to hold the certificate | Certification audit | An accredited certifying body | The SKAO handbook and certification scheme |
| EcoVadis | No | A rating, expressly its own opinion | EcoVadis analysts | Its published methodology |
| A customer questionnaire | Only if the contract says so | Whatever was agreed | Whoever the contract names | Whatever the contract names |
The second row is the one most SMEs need and least often hear. Commission Recommendation (EU) 2025/1710 states in recital 16 that there is no obligation to provide assurance on information reported by non-listed SMEs and that a self-declaration by the SME is sufficient. If a customer tells you your voluntary report must be third-party verified, that is a contractual demand they are making, not a rule they are relaying. We cover the surrounding regime in the VSME standard.
Is a certification audit the same as assurance?
No, and treating them as interchangeable is how Dutch contractors end up double-paying.
A CO2-Prestatieladder audit is a conformity assessment against a certification scheme. An accredited certifying body checks whether your CO2 management system meets the requirements of the tier you are certifying against, and the output is a certificate. What sits underneath it is an audited organisational inventory: scope 1 and 2 at trede 1, quantified scope 3 at trede 2, with the certifying body needing to trace the numbers. That is genuinely rigorous, and it is a different transaction from an opinion on a published statement.
The practical overlap is the evidence. Both want a stated boundary, activity data with records behind it, applied factors you can show, and a prior year on the same basis. Build that once and both engagements get cheaper. We set out the Dutch route in the CO2 Performance Ladder for SMEs.
A rating is a third thing again. EcoVadis states plainly that the rating is its own opinion and can differ from assessments provided by other providers, and that a medal or badge should not be understood as certification or an endorsement. Its analysts check documents against declarations. That is not third-party assurance of a greenhouse gas inventory and EcoVadis does not present it as such. Read on 28 August 2026 from the published methodology disclosure.
If nobody requires it, why would anyone buy it?
Because someone else's scoring rewards it, which is a reason but not an obligation.
The clearest published example is EcoVadis's separate Carbon Rating, not its general Sustainability Rating. The Carbon Rating's higher levels are defined partly by what you have had verified elsewhere: Advanced (51-75) requires publicly reporting third-party verified greenhouse gas emissions, and Leader (76-100) additionally requires formal absolute scope 1 and 2 reduction targets with evidence of science-aligned targets. So the Carbon Rating does not verify your emissions itself, and it does credit you for having had them verified by somebody else. That is a commercial calculation about what the rating is worth to you.
The other honest reason is internal. If your figures are about to be used in a bid, a bond covenant or a public claim, having an independent party test them before that happens is cheap insurance. That is a decision, not a compliance step, and it should be argued on its own terms.
What should you do before your first assured year?
Fix the traceability, not the presentation.
The thing that fails in a first assurance engagement is not the total. It is the inability to show how an input became an entry: which invoice, which factor, which conversion, which judgement about boundary. Assurance providers work backwards from the number, so the audit trail is the deliverable.
Three things to have in place before the engagement starts. A boundary written down and reconciled to your financial consolidation scope. A prior year computed on the same basis, so a movement can be explained. And a record of every estimate, with the reason it was necessary and the source used, because estimation is expected rather than exceptional.
You can build that structure on a free account before committing to anything. The platform serves 5,000+ users, covers more than 20,000 spend-based and activity-based factors and handles multiple entities with roles for data owners, auditors and managers. CSRD consulting is the route if the limited assurance opinion is yours to obtain.
One limit to raise before you rely on it in an engagement. A Mid-Market reviewer on G2 said in July 2026 that applied conversion factors and distance calculations are not exposed in the interface, so a customer cannot always trace how an input became an entry. Under limited assurance that traceability is precisely what gets tested, so bring it up with us at the start of the year rather than at the audit.
Sources: Directive (EU) 2026/470 and Article 34(1) of Directive 2013/34/EU, Article 26a(3) of Directive 2006/43/EC, Commission Recommendation (EU) 2025/1710 recital 16, Delegated Regulation (EU) 2023/2772 ESRS E1-6, SKAO Handboek 4.0 and certification scheme, EcoVadis Sustainability Rating and Carbon Rating methodology disclosures. Verified 28 August 2026.
Facts on this page were last verified on 2026-09-17.
