The new EU Corporate Sustainability Reporting Directive (“CSRD”) is set to revolutionize ESG reporting for companies around the world. Certain large EU companies are already conducting double materiality assessments and collecting data for the first round of reports (due next year). EU subsidiaries of foreign companies and non-EU parent companies with significant business in the EU will soon be required to do the same. In this Client Alert, we focus on the application of the CSRD to non-EU companies and look at the steps which potentially affected companies should be taking to prepare in 2024.

WHAT IS THE CSRD?

The CSRD¹ is an EU Directive which replaces the Non-Financial Reporting Directive (“NFRD”).

It requires certain entities operating or generating revenue within the EU to disclose their ESG impacts, risks and opportunities according to an extensive set of prescribed standards: the European Sustainability Reporting Standards (“ESRS”).² The ESRS cover the full range of ESG issues, from climate and other environmental issues, through to labor and other human rights issues in a company’s own workforce and supply chain, and “downstream” impacts such as the effect of the company’s operations, products and services on communities, consumers, and end users.

The CSRD significantly expands the scope of the previous EU ESG reporting regime, with respect to both (i) the companies subject to the reporting obligation (estimated to increase from 11,700 companies subject to the NFRD to approximately 50,000 companies subject to the CSRD) and (ii) the breadth and depth of the ESG information which companies must disclose.

Under the CSRD (and unlike other voluntary reporting frameworks such as GRI and SASB), companies must conduct a “double materiality” assessment to determine: their material ESG impacts on people and the planet (“impact materiality”); and how ESG issues create financial risks and opportunities for the company (“financial materiality”). This double materiality assessment (which is subject to mandatory external assurance by auditors) determines the specific standards which will apply and the data which the company must collect in order to report under the CSRD.

WHICH COMPANIES DOES IT APPLY TO, AND FROM WHEN?

The CSRD came into force on 5 January 2023.³ However, the implementation dates are staggered according to the size, type, and domicile of in-scope companies. To simplify the process, in-scope companies have been classified into four groups (see below). The first group of companies to report will be required to do so in 2025 for calendar year 2024.

Non-EU companies are therefore affected when they have large EU seated subsidiaries (Group 2) or meet the criteria for Group 4.

However, their subsidiaries may be exempted where a consolidated report is provided by the parent company, provided that certain conditions are met:

1. The parent company publishes a management report containing prescribed information in the consolidated report; and
2. The consolidated report is consistent with the ESRS, or their equivalent.⁴

In the case of Group 4 companies, the reporting information can cover the consolidated group, including the non-EU entity, but shall be delivered by each in-scope EU subsidiary or branch in a sustainability report.

WHERE DO COMPANIES REPORT?

Information is to be disclosed yearly in a dedicated section of the responsible company’s annual management report or, if applicable, the consolidated management report. A separate sustainability report is not required. The position is different for Group 4 subsidiaries and branches, which are required to disclose the relevant information in a dedicated sustainability report (see above).

Reports shall be made available on the entities’ website, respecting a XHTML European single electronic reporting format.⁵ Information published in the (consolidated) management/sustainability reports must be certified by an accredited independent third party, in accordance with conditions set out in the CSRD.

WHAT NEEDS TO BE DISCLOSED?

According to the ESRS, the report must contain:

• Business model and strategy: a description of the company’s business model and strategy including sustainability opportunities and resilience to sustainability risks, as well as transition and implementation plans.
• Targets: a description of the company’s sustainability targets and their progress status.
• Governance: a description of the company’s sustainability governance process, e., the role of administrative, management and supervisory bodies/boards of directors and committees thereof, and their expertise and skills to fulfil their role.
• Policies: a description of the company’s sustainability policies.
• Incentives: information on incentive schemes linked to sustainability matters offered to members of the administrative, management and supervisory bodies.
• Due diligence: a description of the due diligence of sustainability matters. Also, a description of principal actual or potential adverse impacts and actions to prevent, mitigate and remediate them.
• Risks: a description of the company’s principal sustainability risks and their management.
• Indicators relevant to the disclosure requirements mentioned above.
• The process carried out to identify the information required above.
• Value chain: where applicable, companies must include information on their business operations and their value chain, including relating to products and services and business relationships (including in the supply chain, from tier-one right down to the extraction of raw materials).

The first set of ESRS was adopted on July 31, 2023, and published on the Official Journal of the European Union on December 22, 2023.⁶ They include 10 topical standards, encompassing the three pillars of ESG:

• Environmental. 5 ESRS, divided into 32 Disclosure Requirements (“DR”), for the Environmental pillar, covering Climate change (ESRS E1), Pollution (ESRS E2), Water and marine resources (ESRS E3), Biodiversity and ecosystems (ESRS E4), and Resource use and circular economy (ESRS E5).
• Social. 4 ESRS, divided into 32 DRs, for the Social pillar, covering Own workforce (ESRS S1), Workers in the value chain (ESRS S2), Affected communities (ESRS S3), and Consumer and end-users (ESRS S4).
• Governance. 1 ESRS, divided into 6 DRs, for the Governance pillar, covering Business conduct (ESRS G1).

A company is only required to disclose against those topical standards which, through its “double materiality assessment”, it determines to be material. This concept ensures that all stakeholders have access to the information necessary to assess the material ESG impact of the company, and that investors, specifically, can assess financial risks and opportunities associated with material sustainability issues.

In addition, all companies must make General disclosures (ESRS 2), which are divided into 12 DRs covering issues such as the Board’s gender diversity (ESRS 2 GOV-1), or involvement in activities related to fossil fuel (ESRS 2 SBM-1).

HOW DOES REPORTING VARY DEPENDING ON THE SECTOR AND DOMICILE OF IN-SCOPE COMPANIES?

These standards apply to any in-scope company, regardless of sector or domicile. In addition, the EU Commission will publish the following, supplementary standards:

• Sector specific ESRS. These are currently being drafted for the following sectors: Oil and Gas, Coal, Quarries and Mining, Road Transport, Agriculture, Farming and Fisheries, Motor Vehicles, Energy Production and Utilities, Food and Beverages, and Textiles, Accessories, Footwear and Jewelry. It is anticipated that they will provide additional guidance on sector specific issues which should be considered in a company’s report.
• Third-country ESRS. It is anticipated that these supplementary standards will clarify the specific disclosure standards for Group 4 companies. In particular, it is anticipated that these companies may face less onerous disclosure requirements relating to ESG risks and opportunities for the company.

However, companies may have to wait until June 2026 for sight of these supplementary standards.⁷ This means that companies in Groups 1 – 2 will be required to begin collecting data and reporting without the benefit of the supplementary sector-specific standards.

WHAT ARE THE PENALTIES FOR NON-COMPLIANCE?

The CSRD delegates power to the Member States to adopt and enforce penalties under domestic law which are “effective, proportionate and dissuasive”.⁸

In France, which was the first country to transpose the CSRD into domestic law, these provide for financial penalties (of up to € 18,750) and ancillary punishment (such as exclusion from public procurement contracts) for failure to publish the sustainability report, and several criminal penalties, for instance in the event of lack of appointment of an accredited independent third party or obstruction of its audit (criminal fine of up to €375,000 and 5 years of imprisonment).⁹

However, it is important to note that legal risk is not restricted to the measures contained in the CSRD and domestic implementing legislation. Disclosures of ESG impacts, risks, or opportunities, or about the measures taken to address these issues, face increasing scrutiny from private plaintiffs and regulators globally, and allegations of “greenwashing” are on the rise. Companies face potential risk of civil and regulatory action in a range of jurisdictions (including the US and UK), for example under general tort law, misrepresentation or securities law, as well as reputational risk.

HOW DOES THE CSRD RELATE TO OTHER EUROPEAN ESG LEGISLATION?

The CSRD is part of a raft of EU regulatory measures in the field of ESG introduced as part of its Green Deal. These include:

• the Corporate Sustainability Due Diligence Directive (“CSDDD”):¹⁰ in December 2023, the EU Parliament and the Council agreed on the text of a directive which will require large EU companies (more than 500 employees and annual worldwide turnover of over €150 million) and large non-EU companies (more than €150 million net turnover generated in the EU) and smaller companies in high risk sectors to integrate human rights and environmental due diligence policies across their business and value chains. This is likely to come into force in Q1 2026 for EU companies and Q1 2027 for non-EU companies.
• the Deforestation Regulation, adopted earlier in 2023:¹¹ operators (whether based in the EU or not) are required to adopt risk mitigation policies, controls, and procedures to ensure that in-scope products they place on the EU market are not originated from deforestation and have been produced in accordance with the relevant legislation of the country of production. The latter only covers listed products made of the following commodities: cattle, cocoa, coffee, oil palm, rubber, soya, and wood.
• the Batteries Regulation, also adopted in 2023:¹² operators (whether based in the EU or not) placing batteries on the EU market are required to adopt dedicated battery due diligence policies to identify, prevent and address both environmental and social risks associated with raw materials acquired for battery manufacturing.

While each instrument imposes distinct reporting obligations, these initiatives are complementary. They are all based on the underlying standards relating to due diligence which are contained in the UN Guiding Principles and OECD Guidelines for Multinational Enterprises. Accordingly, provided that a company aligns with these standards, a company needs only conduct one impact materiality (or salience) assessment and adopt one, central due diligence program. It can then report on the relevant elements of this program for each measure for which it is in scope.

Even those companies which are not within scope of these measures will likely be affected. Under the CSRD, in-scope companies are required to report on the “flow down” of their due diligence obligations onto suppliers and contractors through commercial contracts and tender requirements. Under the CSDDD, it is anticipated that this flow-down will become a regulatory requirement.

WHAT PRACTICAL STEPS SHOULD NON-EU COMPANIES TAKE TO GET READY FOR THE CSRD?

1. Ascertain whether your company (or one of its subsidiaries) meets the thresholds for the CSRD outlined above and, if so, when your first report will be due.
2. Convene internal stakeholders from relevant business functions (including legal, sustainability, HSE, HR, purchasing / procurement, net zero / energy transition) and (if relevant) from the EU subsidiary or branch into a steering group focused on the CSRD and mandatory human rights and environmental due diligence.
3. Map external stakeholders (including workers, supply chain workers, affected community members and users of products and services) and their proxies and develop a plan for stakeholder engagement.
4. Conduct a preliminary double materiality assessment to determine a longlist of those ESG topics which are likely to be material and against which disclosure will be required (to complete the materiality assessment, you will also need to engage with appropriate external stakeholders on these topics).
5. Evaluate existing sustainability data and reporting and conduct a gap analysis against the applicable ESRS. Coordinate internally to ensure consistency and comparability, and leverage existing processes and controls, as applicable.
6. Start collecting the data necessary to meet reporting standards.

Critically, steps 1 to 5 must be complete before the beginning of the reporting period. So, for any company within Group 2 (large EU subsidiaries), during FY 2024. These steps take time and resources so action needs to be taken now.

Member States have until 6 July 2024 to transpose the CSRD into national law. France is the first Member State to have already transposed the measures contained in the CSRD into domestic law, through the ordinance of 6 December 2023, supplemented by the decree of 30 December 2023. The decree, which specifies the application thresholds for companies, confirms the turnover thresholds for non-EU companies (described in the table above).

¹Directive (EU) 2022/2464 of the European Parliament and of the Council of 14 December 2022 amending Regulation (EU) No 537/2014, Directive 2004/109/EC, Directive 2006/43/EC and Directive 2013/34/EU, as regards corporate sustainability reporting.

²See Commission Delegated Regulation (EU) 2023/2772 of 31 July 2023 supplementing Directive 2013/34/EU of the European Parliament and of the Council as regards sustainability reporting standards: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ%3AL_202302772.

³The CSRD has now to be transposed into the 27-EU Member States’ national law by July 6, 2024. Additional practical details are progressively implemented at national level.

⁴A delegated act on the equivalence of sustainability reporting standards is to be adopted by the EU Commission.

⁵See Article 29d of the Directive 2013/34/EU as amended by the CSRD (referring to Article 3 of Commission Delegated Regulation (EU) 2019/815).

⁶See endnote No. 2.

⁷The CSRD requires the EU Commission to adopt these sector specific standards before June 30, 2024 (Article 29b(1), third subparagraph, introductory wording, and Article 40b of Directive 2013/34/EU as amended by the CSRD). However, the EU Commission issued a Proposal to postpone this time limit until June 30, 2026. See EU Commission, Proposal for a Decision of the European Parliament and of the Council amending Directive 2013/34/EU as regards the time limits for the adoption of sustainability reporting standards for certain sectors and for certain third-country undertakings, COM(2023) 596 final, Brussels, October 17, 2023. This is currently under scrutiny before the European Parliament and the Council of the European Union (https://eur-lex.europa.eu/legal-content/EN/HIS/?uri=CELEX:52023PC0596.)

⁸See Article 51 of Directive 2013/34/EU amended by the CSRD.

⁹Some countries, like France, already implemented the CSRD: See Ordonnance n° 2023-1142 du 6 décembre 2023 relative à la publication et à la certification d'informations en matière de durabilité et aux obligations environnementales, sociales et de gouvernement d'entreprise des sociétés commerciales and Décret n° 2023-1394 du 30 décembre 2023 pris en application de l’ordonnance n° 2023-1142 du 6 décembre 2023 relative à la publication et à la certification d’informations en matière de durabilité et aux obligations environnementales, sociales et de gouvernement d’entreprise des sociétés commerciales.

¹⁰Proposal of the EU Commission for a Directive of the European Parliament and of the Council on Corporate Sustainability Due Diligence and amending Directive (EU) 2019/1937 of 23 February 2022 and press release of the Council of the EU of 14 December 2023 “Corporate sustainability due diligence: Council and Parliament strike deal to protect environment and human rights”.

¹¹Regulation (EU) 2023/1115 of the European Parliament and of the Council of 31 May 2023 on the making available on the Union market and the export from the Union of certain commodities and products associated with deforestation and forest degradation and repealing Regulation (EU) No 995/201.

¹²Regulation (EU) 2023/1542 of the European Parliament and of the Council of 12 July 2023 concerning batteries and waste batteries, amending Directive 2008/98/EC and Regulation (EU) 2019/1020 and repealing Directive 2006/66/EC.