CSRD Corporate Sustainability Reporting Directive: Obligations and Deadlines for Italian Companies (Who Must Do What)

The CSRD (Corporate Sustainability Reporting Directive) requirements for Italian companies are not an optional “green report.” They are a mandatory reporting obligation with ESRS standards, consolidation scopes, verifiable data, and assurance. In Italy, the CSRD has been transposed through Legislative Decree (D.Lgs.) 125/2024 (in force since September 2024). In 2025 the “stop-the-clock” shifted the timeline, not the scope; in February 2026 the EU then adopted Directive (EU) 2026/470, which narrows the scope to the largest companies. EU adoption is not national application: Member States must transpose the 2026 directive by 19 March 2027, and this guide does not assume an Italian transposition it has not verified.

Which Italian companies fall under the CSRD—and how to tell if you’re required (size, groups, listed companies and SMEs)

Status at 1 October 2026: three layers to keep apart

1. The original framework (CSRD of 2022, as deferred by the 2025 stop-the-clock): the four waves below. Still useful as history, and because wave 1 reports already exist.
2. The EU framework adopted in 2026 (Directive (EU) 2026/470 of 24 February 2026, published in the Official Journal on 26 February 2026): a narrower scope, no listed-SME wave, no move to reasonable assurance.
3. The national law that applies to your financial year: in Italy, D.Lgs. 125/2024 as amended. The 2026 directive must be transposed by 19 March 2027: check the Italian transposition measure and its effective dates before relying on the new thresholds or on any exemption.

What Directive (EU) 2026/470 changes at EU level

• Scope from financial year 2027: undertakings that, on their balance-sheet date, exceed both a net turnover of €450 million and an average of 1,000 employees during the financial year; for groups, the same thresholds on a consolidated basis.
• Wave 1 (former NFRD entities): the original rules cover financial years 2024–2026; those below the new thresholds leave the scope from financial year 2027. Member States may exempt them already for financial years 2025 and 2026: a national option, not an automatic exemption.
• Listed SMEs: the third wave and its two-year opt-out are deleted; at EU level SME reporting becomes voluntary, with standards for voluntary use based on Commission Recommendation (EU) 2025/1710.
• Non-EU groups: reporting applies only where the group’s net turnover in the Union exceeds €450 million in each of the last two consecutive financial years and the EU subsidiary or branch exceeds €200 million.
• Value chain: companies with up to 1,000 employees may decline to provide information beyond what the standards for voluntary use specify.
• Assurance: the Commission’s limited-assurance standards are now due by 1 July 2027, and the requirement to adopt reasonable-assurance standards has been removed.

Source: Directive (EU) 2026/470, Official Journal L of 26 February 2026 — Art. 1(3) and recitals 4–5; Art. 2(4)(a), 2(5)(a), 2(8), 2(12)(b) and 2(13) (new Art. 19a(1), 29a(1), 29ca, 34(2a) and 40a(1) of Directive 2013/34/EU); Art. 3(1)(a)(ii)–(iii) and 3(1)(c), recitals 15–16 and 30–31; Art. 5(1)

CSRD scope “in waves” under the original framework (historical reference)

1. Companies already under the NFRD In practice: public-interest entities (PIEs) already subject to the NFRD, typically with more than 500 employees. They are the first wave and start earlier.

2. Large undertakings (including non-PIEs) Companies that exceed the size thresholds set for a “large undertaking.” This includes many unlisted B2B industrial businesses.

3. Listed SMEs (excluding micro-undertakings) If you are an SME but are listed on a regulated market, you may be in scope. Micro-undertakings are excluded. For some SMEs, deferral/opt-out options are available and should be assessed as a strategic choice (compliance cost vs access to capital and supply chains).

4. Non-EU groups with “significant” activity in the EU If you are part of a non-EU group with a significant presence in the Union, a reporting obligation may apply at group level. For many Italian subsidiaries, this means “we inherit processes and data requests from HQ.” (Context: Italy is an EU Member State, so EU-level thresholds and group rules apply to Italian entities.)

Key point: the stop-the-clock (Directive (EU) 2025/794) postponed certain deadlines, but did not narrow the population of entities in scope. The narrowing came afterwards, with Directive (EU) 2026/470 (see above).

Practical “large undertaking” test (CFO / Corporate Affairs checklist)

If you want a quick B2B-style check, use this checklist. It does not replace legal analysis, but it tells you whether you are “CSRD-exposed” and how much work is likely required.

A. Size (thresholds to verify)

• EU framework from FY 2027 (Directive (EU) 2026/470): net turnover above €450 million and more than 1,000 employees on average, on a consolidated basis for groups?
• National law applicable to your financial year: until the Italian transposition is confirmed, check which thresholds of D.Lgs. 125/2024 (employees, revenue, total assets) still apply to you.

B. Group structure (this changes everything)

• Are you the parent company and do you prepare consolidated accounts? Then you must consider the reporting scope and which subsidiaries are included.
• Are you a subsidiary of an EU group? Typically, HQ will cascade data and process requirements down to you for CSRD consolidation.
• Are you an Italian subsidiary in a group with multiple legal entities? Expect requests on: energy consumption, Scope 1–2 emissions, HR data, accidents, procurement and suppliers.

C. Listing status

• Are you a listed SME? At EU level Directive (EU) 2026/470 removes listed SMEs from mandatory reporting; check the national transposition before stopping work already planned.

Listed companies and SMEs: what “listed SME” and “excluding micro” mean

Under the original CSRD, listed SMEs (excluding micro-undertakings) formed a third wave, with a two-year opt-out. Directive (EU) 2026/470 deletes that wave and the opt-out: at EU level, SME reporting becomes voluntary, based on standards for voluntary use derived from Commission Recommendation (EU) 2025/1710. Until the Italian transposition is in force, check the national position. Voluntary reporting remains a positioning decision: in many supply chains, showing up “CSRD-ready” helps with tenders, vendor ratings, and access to financing.

Supply-chain effect: even if you’re not required, you may still be involved

If one of your customers is subject to the CSRD, they will ask you for data for their Scope 3 and for value-chain disclosures. And they will often ask for it with audit-like frequency and formatting. Directive (EU) 2026/470 sets a limit: a value-chain company with up to 1,000 employees may decline to provide information beyond what the standards for voluntary use specify.

Concrete example: a mechanical components or packaging supplier

• emission factors and energy consumption, sometimes even monthly
• data on materials, traceability, recycled content, end-of-life
• labour, human-rights, and subcontracting policies
• supplier audits or evidence of controls

This is where the CSRD (Corporate Sustainability Reporting Directive) requirements for Italian companies effectively become a commercial requirement.

Italy: transposition and national references

In Italy, the CSRD was transposed through Legislative Decree (D.Lgs.) 125/2024 (effective September 2024). In 2025, measures were introduced to align the timeline with the EU “stop-the-clock” deferral, which is useful for certainty in project planning. (Context: “D.Lgs.” is the Italian instrument used to implement EU directives into national law.) For Directive (EU) 2026/470 the transposition deadline is 19 March 2027; this guide has not verified an Italian transposition measure as of 1 October 2026, so it does not state that the new thresholds or the FY 2025–2026 exemption already apply in Italy.

When CSRD obligations start in Italy: timeline, reporting financial years, and first operational deadlines

What matters is the reporting financial year (FY) and the year the report is published. Two EU timelines now coexist and must not be confused.

Timeline after the 2025 stop-the-clock (historical reference)

With the stop-the-clock (Directive (EU) 2025/794), waves 2 and 3 were postponed by two years; wave 1 remained the first to start.

Note: at EU level this table has been superseded by Directive (EU) 2026/470 (below): wave 3 no longer exists and wave 2 is limited to the largest companies.

EU timeline after Directive (EU) 2026/470 (subject to national transposition)

The directive entered into force on the twentieth day after its publication of 26 February 2026; the transposition deadline is 19 March 2027 (Art. 5(1)). Until the national measure applies, plan on the basis of the law in force for your financial year. Source: Directive (EU) 2026/470, Official Journal L of 26 February 2026 — Art. 1(3) and recitals 4–5; Art. 2(4)(a), 2(5)(a), 2(8), 2(12)(b) and 2(13) (new Art. 19a(1), 29a(1), 29ca, 34(2a) and 40a(1) of Directive 2013/34/EU); Art. 3(1)(a)(ii)–(iii) and 3(1)(c), recitals 15–16 and 30–31; Art. 5(1)

Italy: national alignment with the deferral

Industry sources and regulatory updates pointed to Italy’s 2025 alignment with the EU deferral. For those planning budgets, tools, and resources, this matters for legal certainty and to avoid projects launched against deadlines that later changed. (Context: Italy must align its national implementation with EU-level timing changes.) Whether Italy uses the option to exempt FY 2025–2026 reports, and from when the 2026 thresholds apply nationally, depends on the Italian transposition act, which this guide has not verified.

First “project-style” operational deadlines (retroplanning that actually works)

The legal deadline comes last, but the data must be closed earlier. A typical retroplan:

• T-9/12 months: double materiality + ESRS gap analysis Output: IRO matrix, value-chain scope, “must-have” datapoint list.
• T-6/9 months: ESRS data model + controls + ownership Output: data dictionary, consolidation rules, quality checks.
• T-3/6 months: consolidated dry run Output: “near-final” numbers, methodological notes, first reconciliations.
• Ongoing: assurance readiness and evidence collection Output: evidence repository, calculation traceability, versioning.

Practical example: if you publish in 2025, emissions and energy-consumption data often need to be closed by the end of Q1 to avoid blocking the reporting cycle.

Strategic note on Omnibus and simplifications

The Commission’s February 2025 Omnibus package led to two adopted directives: Directive (EU) 2025/794 (stop-the-clock, April 2025: deferral only) and Directive (EU) 2026/470 (adopted on 24 February 2026: scope, value chain and assurance). Status and dates are set out above. Operational translation: build a robust but modular data system, so you can adapt to clarifications and updates without rebuilding everything.

What you must report under ESRS: double materiality, value chain, and minimum data to collect

The ESRS do not ask for “stories.” They ask for comparable information, with traceable datapoints linked to governance, metrics, targets, and plans.

ESRS Set 1: what it looks like and what it implies

The foundation is ESRS Set 1:

• ESRS 1 and ESRS 2 (general principles and general disclosures)
• topical standards on E, S and G

Practical implication: for each disclosure you must know who owns the data, which system it comes from, how it is calculated, and what evidence supports it.

Double materiality (impact + financial): what it means in practice

Double materiality is not a theoretical exercise. It is a documented process that produces a list of material topics and an IRO (Impacts, Risks, Opportunities) map.

In practice:

• internal workshops and sessions with relevant stakeholders
• documented criteria and scoring
• IRO map and linkage to ESRS disclosures that are “mandatory if material”

B2B example: manufacturing

• financial side: risk from carbon costs, energy, customer requirements
• impact side: health and safety in contracting, impacts on workers in the supply chain

Value chain: data boundaries and typical cases

Many disclosures require looking upstream and downstream. The boundary is not just “inside the gates.”

Typical cases:

• packaging: end-of-life, recyclability, collection and treatment systems
• chemicals: feedstock suppliers and input traceability
• machinery: use phase (energy consumed by the product), maintenance, end-of-life

Here, requesting data from suppliers becomes part of the reporting system, not a one-off activity.

Minimum “climate-ready” data (ESRS E1)

If you want to start from the minimum needed to be credible and auditable on climate, prepare at least:

• energy consumption and energy mix
• Scope 1 and Scope 2 (with a clear organisational boundary)
• methodology for Scope 3 (relevant categories, estimates vs primary data)
• emission factors and sources
• consolidation rules and boundaries (sites, companies, joint ventures)
• base year and recalculation logic if boundaries change
• gross emissions and linkage to targets and the transition plan

Transitional provisions: how to use them without creating “gaps”

For undertakings below certain size thresholds (for example <750 employees), there are temporary omissions allowed for some datapoints (including, under certain conditions, Scope 3 in the first year and some social disclosures along the value chain for a limited period). Operationally, it only works if:

• you state what you omit and why
• you define a data ramp-up plan with responsibilities and internal deadlines

How CSRD changes the management of emissions and carbon credits: Scope 1-2-3, transition plans, and claims

Under ESRS E1, emissions become “financial-statement-grade” data: boundaries, controls, reconciliations. This also changes how you talk about carbon credits.

Scope 1-2-3: the backbone of climate disclosure

ESRS E1 requires gross emissions by scope and total. For many companies, Scope 3 outweighs Scope 1–2, so:

• Procurement must manage supplier data and contractual clauses
• SRM must manage data quality, audits, and improvement plans
• Operations must ensure measurement and traceability of energy and fuels

Transition plan: what it must contain in practice

A transition plan is not a slide. It must connect targets and numbers to operational decisions:

• decarbonisation capex and opex
• interim milestones and governance
• dependencies: PPAs, electrification, biomethane, efficiency, logistics
• incentives and internal accountabilities

Carbon credits and offsets: from claim to controllable data

If you use carbon credits, you must treat them as controllable information. In practice, it helps to prepare an “internal register” with:

• volumes and type of credits
• standards and registry traceability
• vintage year and retirement status
• use logic: what they cover and what they do not

Key point: always separate real reductions (gross emissions going down) from compensation and “net” claims. This is where many companies become exposed to challenges.

Claims and greenwashing risk: what changes for those selling to EU customers or public bodies

If you claim “carbon neutral” or similar, you must be able to defend it with:

• a consistent emissions inventory
• targets and a transition plan
• internal rules on who approves claims (Legal and Compliance)
• traceable evidence for any credits used

Tokenisation and MRV: a concrete example (no shortcuts)

Tokenising credits or environmental assets does not replace MRV (monitoring, reporting, verification) requirements. With CSRD and assurance, it becomes:

• token issued or transferred
• corresponding credit on a registry
• proof of retirement when the credit is “used”

Without this audit trail, the risk is having information that looks good on blockchain but cannot be defended under verification.

Mandatory assurance: who verifies the report, level of control, and how to prepare for audits and checks

Assurance is not an add-on. It is part of the CSRD package and pushes companies to treat ESG data like financial data: controls, evidence, traceability.

Assurance as the default requirement (and level of control)

The level is limited assurance. The original CSRD allowed a later move to reasonable assurance after a feasibility assessment; Directive (EU) 2026/470 removed the requirement for the Commission to adopt reasonable-assurance standards and postponed the limited-assurance standards to 1 July 2027 (Art. 1(3), recitals 4–5). Do not plan for an automatic escalation. Immediate impact:

Source: CarbonMeld — independent carbon credit market intelligence. Document-based quality scores and assessments across all major registries: carbonmeld.com

• you must retain evidence
• you must have process controls
• you must be able to reproduce calculations and explain methodological choices

Who verifies and how it coordinates with the financial audit

Verification is performed by the statutory auditor or an authorised assurance provider under national rules. In practice, you must coordinate:

• the audit calendar (walkthroughs, samples, requests)
• alignment with the financial audit team, because cycles influence each other (closures, controls, governance)

Audit-ready data: essential checklist

To avoid findings in year one, prepare at least:

• ESRS data dictionary (definitions, units of measure, sources)
• datapoint ownership (who signs off on what)
• IT controls: access, logs, versioning
• evidence for emission factors and sources
• Scope 2 calculations using the applicable method (location-based and, if used, market-based)
• reconciliation of consumption with bills, meters, and industrial accounting

Double materiality under assurance: typical risk and how to defend it

The most common risk is a materiality process that is “not defensible.” To reduce it:

• document stakeholder mapping
• retain criteria, scoring, and rationale
• minute decisions (minutes)
• link IROs to ERM and business risks, not opinions

Supply-chain controls: what the assurer may ask for

On Scope 3 and supplier data, requests may include:

• questionnaires and response rates
• contracts and data clauses
• supplier audits or sample checks
• rules for estimation when primary data is missing

Example: an automotive component supplier with many Tier-1s and PCF requests. Without a process, Scope 3 data remains fragile.

Practical roadmap to get compliant: gap analysis, governance, tools, and internal responsibilities (CFO/ESG/Procurement)

The roadmap must produce deliverables, not just activities. If you enter the scope from FY 2027 under the new thresholds, the deferral gives you time, but it does not remove the work; if you were a listed SME or a large company below the new thresholds, confirm your national position before scaling down. And if you are a supplier, it is still worth moving because requests arrive earlier.

6-step roadmap (with deliverables)

1. Scoping and wave Deliverable: legal scope, consolidated scope, project plan.
2. Double materiality Deliverable: IRO matrix, stakeholder map, material topics.
3. ESRS gap analysis Deliverable: datapoint list, priorities, data collection plan.
4. Data architecture and tools Deliverable: data model, integrations, supplier workflow, evidence repository.
5. Controls and assurance readiness Deliverable: controls manual, testing, pre-audit, remediation.
6. Reporting and continuous improvement Deliverable: report, lessons learned, ramp-up plan (Scope 3 and value chain).

Governance and roles: a practical RACI

• CFO: reporting owner, controls, assurance coordination
• Head of Sustainability/ESG: methodologies, stakeholders, targets, ESRS consistency
• Procurement: upstream Scope 3, supplier clauses, SRM and questionnaires
• Operations / Energy manager: Scope 1–2, meters, fuels, efficiency
• HR: social disclosures (e.g., S1)
• Legal/Compliance: claims, risks, policies and approvals
• IT/Data: systems, audit trail, access, integrations

Tools: a typical stack (without overcomplicating it)

Generally you need a combination of:

• ESG data platform
• integration with ERP and energy systems
• LCA/PCF tools where needed
• supplier workflow for Scope 3
• evidence repository (DMS) with versioning and access controls
• controls (GRC) if already present in the company

Technical quick win: automate the collection of utility bills and meter readings to reduce errors and time.

Project KPIs (the ones that actually help)

• % of ESRS datapoints covered and with an assigned owner
• % of Scope 3 based on primary data (vs estimates)
• supplier response lead time
• number of pre-audit non-conformities
• data quality indicators: completeness and accuracy

Realistic goal: a first-year “minimum viable report” that is auditable.

Quick wins even for non-required companies

If you are not in scope today, you can still prepare a package for customers who are:

• ESG data questionnaire and completion guide
• template for emission factors and consumption
• rules on boundaries and units of measure
• a single internal point of contact (Procurement or ESG)

This reduces the risk of being dropped from vendor lists and improves tender performance.