The entry into force of the CSRD (Corporate Sustainability Reporting Directive) has changed the business world over the past two years. While large groups (the “first wave”) are currently experiencing the pain of their very first reporting, many mid-sized companies (ETI) are looking at a horizon that seems distant: 2028.
Faced with this delay, it is tempting to postpone the exercise, but nevertheless, building robust and auditable extra-financial reporting requires a long time of work. CSRD compliance cannot be improvised when you close your accounts. Find out why Anticipation is your best strategy and how to get your business up and running by going step by step, from analyzing double materiality to choosing your tools.
1. Who is part of this 2nd wave of CSRD and why is the year 2028 crucial?
Before allocating internal resources, it is essential to understand if your business is targeted by this deadline.
Which businesses are directly affected?
Following recent changes by the European Commission via the Omnibus proposal, the application thresholds have been raised. Now, second-wave companies are the big structures surpassing 1,000 employees and achieving more than 450 million euros in turnover. It is these companies that will have to comply with European sustainability reporting standards (the standards ESRS) for their fiscal year 2027 with a report published in 2028.
Who can be indirectly affected by this wave?
This is where the most massive phenomenon is found. If you are an SME or a mid-cap company that does not reach these thresholds (1,000 employees and €450 million in turnover), you can be in the value chain (supplier, subcontractor, partner) of these large companies subject to the directive.
To calculate their own carbon footprint or assess the risks of their supply chain, these large companies may require ESG (Environmental, Social, Governance) data from you. You will not be asked to produce a comprehensive CSRD report, but to provide reliable indicators.
Fortunately, a regulatory shield for SMEs exists: the Value Chain Cap. This principle states that large companies cannot require more information from their suppliers and value chain partners than what is strictly contained in the voluntary standard dedicated to SMEs: the standard VS (ex-VSME). So you know exactly what the maximum level of requirements is to be prepared for.
The "N-1" year trap: why act now?
If your official obligation is set for 2028 (covering the 2027 financial year), the countdown has in fact already started. A report published in year N must be based on real and consolidated data for year N-1. This means that as of January 1, 2028, all your data collection, traceability, and calculation systems must be 100% operational and bug-free. Arriving in 2028 without having tested these processes in 2026 and 2027 exposes the company to missing data, non-certification of the report, and ultimately, to the loss of strategic markets.
To navigate this smoothly and ensure your future reporting is reliable, we have identified four priority projects to launch today:
- Perform a double materiality assessment
- Validate this analysis with an early audit
- Carry out a dry-run reporting exercise in 2027
- Implement a tailored digital tool.
.png)
2. Conduct a double materiality assessment now and secure it through an early audit
If the CSRD were a house, the double materiality assessment would be the foundation. There is no point in collecting hundreds of data points without first completing this mandatory strategic exercise.
The foundation of your compliance
The methodology requires you to evaluate all environmental, social, and governance issues through two lenses:
- Impact materiality: Do your activities have a material impact (positive or negative) on ecosystems, the climate, or populations?
- Financial materiality: Do climate or social changes represent a material risk or financial opportunity for your business model?
This exercise will allow you to sort out. If the subject of biodiversity is not material for your business, you will not have to publish the corresponding indicators. This analysis saves you valuable time by focusing your data collection efforts. The good news is that you can start these reflections now to approach the exercise with greater peace of mind.
Once you have established your double materiality assessment, don't just file it away. The best practice is to have it audited immediately by a statutory auditor (CAC) or an independent third-party organization (OTI).
Why is it a good idea to have your double materiality audited?
Having your double materiality audited is necessary because these organizations are the ones that will certify your final report. If, on the big day, your auditor feels that your methodology and justifications are inadequate, they can invalidate your entire report. By having your DMA validated in advance, you fully secure the scope of your future data collection in the eyes of regulatory authorities.
3. Conducting a dry run in 2027: insurance for peace of mind
Once your double materiality assessment has been validated, 2027 should become your training ground.
What is a dry-run report?
A dry-run exercise consists of simulating the entire production of your CSRD report using data from the 2026 fiscal year, strictly for internal use. You will ask your HR, Purchasing, and Environment teams to report the data required by the identified material ESRS. The objective is not perfection, but to test your organization's processes.
The strategic benefits of dry-run reporting
The dry-run exercise is the only way to confront the reality on the ground. This full-scale test will allow you to:
- identify the gaps in your data: You will quickly realize that some data simply does not exist yet, allowing you to take corrective action and generate the missing information.
- train and align teams: The CSRD requires the CSR Director, the CFO, and operational staff to speak the same language. A dry run builds this synergy without the pressure of regulatory compliance.
- adapt and optimize internal processes: you can step back at the end of this initial test to identify bottlenecks and prepare a more effective process for the actual 2028 reporting cycle.
4. Equip yourself to automate and ensure data reliability
The CSRD marks the end of an era: sustainability reporting conducted via Excel files exchanged by email once a year. The European Union now demands the same rigor, traceability, and reliability for non-financial data as it does for your financial data.
The limitations of traditional tools for CSRD compliance
The volume of data required makes manual management impossible. Furthermore, spreadsheets present unacceptable risks for auditors: a lack of a clear audit trail, accidental overwriting of history, formula errors, and consolidation difficulties between subsidiaries.
In addition, The CSRD eventually requires digital tagging of your sustainability report in XBRL format (the same format as your annual financial reports), ensuring it is machine-readable and easily comparable across Europe. A standard Excel file cannot natively generate this format.
Why adopt a dedicated software platform?
To approach 2028 with confidence, you should begin deploying a digital tool specialized in ESG reporting during your dry run. Such a platform allows you to:
- automate data collection: By connecting directly to your existing software (ERP, HRIS), the tool drastically reduces the risk of human error.
- ensure compliance and auditability: CSRD software allows you to document every piece of data (source, manager, update date, and supporting documentation). This integrated traceability is valuable for your internal teams and essential for external auditors.
- manage your data: With dedicated software, you can monitor your ESG indicators over time, visualize your progress, and identify key areas for improvement.
Conclusion
In summary, CSRD compliance for 2028 is at stake today. Anticipation is not just about managing stress; it is an imperative for controlling compliance costs and securing your reporting. Start with your double materiality analysis, involve your auditors early, test your processes with a dry run, and equip yourself with the right technology. By following this gradual path, CSRD will be a breeze.
Are you part of the “second wave”? Don't wait any longer and book a demo of our tool !
Discover more articles
Dive into the heart of the subjects
Scope 3 Carbon Footprint: how to prioritize, refine, and collect your data without getting overwhelmed?
PPWR: Everything you need to know about this new packaging regulation
.png)
Carbon Footprint from A to Z
FAQs
Find answers to common questions about CSRD and Kiosk
The CSRD or Corporate Sustainability Reporting Directive is the new European directive which aims to impose and better regulate corporate sustainability reports.
It makes companies more transparent, with standardized ESG reporting standards called ESRS (European Sustainability Reporting Standards)
The application of the Corporate Sustainability Reporting Directive is progressive. Here is a summary table.
| Effective year | Businesses impacted | Standard |
|---|---|---|
| 2025 (over the financial year 2024) | Listed companies with more than 500 employees | ESRS |
| 2026 (sur l’exercice 2025) | Autres grandes entreprises de plus de 1000 salariés | ESRS |
| 2026 (over the financial year 2025) | Businesses that meet two out of three criteria: | VSME |
| 2027 (over the year 2026) | SMEs listed on the stock exchange | VSME |
| 2029 (over the fiscal year 2028) | Non-European companies with at least €150M in turnover on the European market | ESRS |
Want to know when your business is impacted? Use our regulatory monitoring tool to find out.
The "omnibus" bill is a recent initiative by the European Commission aimed at reducing the scope of the CSRD directive. It proposes, in particular, to raise the application thresholds: only companies with more than 1,000 employees would be affected, compared to 250 previously.
It promotes the adoption of the VSME framework to reduce the reporting burden on SMEs and mid-cap companies.
The VSME (Voluntary Sustainability Reporting Standard) is a voluntary European standard designed to help unlisted small and medium-sized enterprises (SMEs) structure and communicate their sustainability initiatives. Developed by EFRAG, this standard offers a lighter framework compared to ESRS standards, covering ESG aspects. It allows in particular to:
- Harmonizing sustainable reporting practices in Europe
- Facilitate the response to the expectations of business partners
- Improving access to responsible financing
It aims to harmonize sustainable reporting practices, facilitate meeting the expectations of business partners, and improve access to responsible financing. Although not mandatory, adopting VSME allows SMEs to demonstrate their commitment to sustainability and anticipate future regulatory developments.
- Complete the preliminary steps for the CSRD
These steps are dual materiality analysis and gap analysis. They will help you understand the material issues, impacts, risks, and opportunities for your business. They will also allow you to create a roadmap based on what you have already achieved.
Check out our article on double materiality here.
- Compile your data and produce your indicators
Centralizing sustainability data is essential for your compliance, particularly to facilitate understanding and consistency when producing quantitative indicators.
- Produce your detailed report in XHTML format with XBRL tags
Thanks to its tagging and visualization technologies, Kiosk guarantees a very high level of consistency.
Find our article on XBRL tagging here .
- Audit your data
At the end of these steps, your sustainability report is ready to be audited by an Independent Third Party Organization (ITO).
Kiosk supports your compliance journey throughout this process. For more information on these steps, we invite you to contact our team.
CSRD compliance requires companies to:
- understanding the 12 ESRS and 82 disclosure requirements
- the collection of more than 1,000 data points
- the calculation of 50-147 quantitative indicators
- tagging 4,000 items in the final report
Kiosk is a software that allows companies to save 5 months on the preparation of their CSRD report by automating the most time-consuming steps.
- First of all, the security of your data is our priority.
- All data is stored in France, in Paris, via our French hosting provider.
- During transit, your data is encrypted in SSL/TLS from the user's browser to our servers guaranteeing the security of communications.
- Data is also encrypted at rest, both on the database and on file storage, protecting the data in the event of a leak or attempted theft.
- Kiosk's technical teams are the only ones who can access your data.
- Kiosk is in the process of ISO27001 certification.
- Our technical support is available 24/7.