CSRD and SMEs: who must prepare a sustainability statement and when

Obligations, timelines, essential ESRS and a six-month roadmap to get started without blocking the business.

CSRD extends the scope beyond NFRD to large undertakings and listed companies, including listed SMEs. In Italy, listed SMEs are in scope for financial years starting on or after 1 January 2028, with the first sustainability report due in 2029. Earlier listed-SME opt-out windows do not extend beyond 2028.

Which ESRS apply

Sustainability information must follow the ESRS approved by Delegated Regulation (EU) 2023/2772, available in consolidated form on EUR-Lex. The ESRS set general principles, cross-cutting disclosures and topical standards for environmental, social and governance matters.

Unlisted SMEs: the “light” route

For SMEs not directly subject to CSRD, the Commission has issued a voluntary VSME standard so they can respond proportionately to customer or bank requests along the value chain. Q&A and support materials are available on the Commission’s portal.

Assurance: what to expect

CSRD requires limited assurance on sustainability information. While the final EU assurance standard is pending, the CEAOB has issued guidance for limited assurance. A target date of 1 October 2026 was previously indicated. In 2025, through the Omnibus proposal, the Commission suggested removing the fixed date while keeping the power to adopt the standard and announcing focused guidance in 2026. Keep this in mind when planning.

Double materiality in practice

Create a list of potentially relevant topics.
Assess impacts on the company and the company’s impacts on people and the environment.
Engage stakeholders and document evidence.
Decide which topics are material and select KPIs with verifiable data sources.
The ESRS always require general disclosures and control information, with proportionality options for smaller entities.

Six-month operational roadmap

Month 1 Scoping, stakeholder map, ESRS gap analysis.
Month 2 Double materiality, data plan, roles and responsibilities.
Month 3-4 KPI collection, IT controls and data quality, traceable archiving.
Month 5 Draft report with methodology notes and links to the financial statements.
Month 7 Review with the auditor for limited assurance, fixes and approval.

Watch the group perimeter

Groups with EU and non-EU components need coordination between the group auditor and component auditors with access to the reporting package. Group audits are framed by ISA 600 (Revised).

How D-Audit can support you

We set up double materiality in a lean way, define business-relevant KPIs, design data flows between Finance and Sustainability and prepare a verifiable ESG chapter. The goal is to reach reporting with files ready, data quality under control and reliable timelines for assurance.