CSRD compliance for US companies: what you need to know before 2028

Most American executives discover CSRD the same way — someone from their EU subsidiary sends an email asking about "sustainability reporting requirements," and the whole compliance team goes quiet. The EU's Corporate Sustainability Reporting Directive is one of the most sweeping environmental disclosure mandates ever enacted, and unlike SEC climate rules (still contested in U.S. courts), CSRD is active and phasing in now.

The headline that matters for US companies: CSRD applies to non-EU companies with significant EU revenue or EU subsidiaries. Headquartered in New York, San Francisco, or Chicago doesn't insulate you. If Europe is a meaningful part of your business, CSRD is already on your horizon — and for many companies, the 2028 first-reporting deadline is less than 24 months away.

This guide covers who's in scope, what's required, the phased timeline, how penalties work, and — critically — how to satisfy both CSRD and California's SB 253 with a single emissions data infrastructure instead of running two parallel compliance programs.

Quick comparison: CSRD vs. SB 253 at a glance

Does CSRD apply to your US company?

The threshold test for non-EU (third-country) companies is defined in Article 40 of the CSRD and amended by the CSRD Omnibus proposal currently moving through EU institutions:

A non-EU company triggers CSRD reporting obligations if it meets all three of the following conditions:

1. It generates €150 million or more in net turnover in the EU in each of the two most recent consecutive financial years
2. It has at least one large EU subsidiary (defined as exceeding two of three thresholds: €25M balance sheet, €50M revenue, 250+ employees) OR a listed EU branch
3. The subsidiary or branch is subject to reporting under EU national law

The practical test: if your company files consolidated accounts, has an EU subsidiary that would independently qualify as "large" under EU accounting rules, and generates significant EU revenue — assume you're in scope and verify with EU counsel. Waiting for the threshold test to become obvious is how companies end up with 18 months to stand up an ESRS reporting infrastructure that takes 24 months to build properly.

What CSRD actually requires

CSRD reporting is built on the European Sustainability Reporting Standards (ESRS), a comprehensive set of disclosure standards developed by EFRAG (European Financial Reporting Advisory Group). The scope is much broader than carbon emissions alone.

The double materiality assessment

The foundational concept in CSRD that has no equivalent in SB 253 or SEC climate rules is double materiality. Every company subject to CSRD must conduct a formal materiality assessment that evaluates sustainability topics from two angles simultaneously:

• Financial materiality: How do sustainability issues affect the company's financial performance, cash flows, and value? (The direction regulators like the SEC focus on)
• Impact materiality: How does the company's operations affect the environment, society, and people across its value chain?

A topic is material for CSRD purposes if it passes either test — not just the financial one. This means a company that has minimal financial exposure to climate change but has large operational emissions must still report on climate. The assessment determines which of the ESRS topic standards apply to your specific company and value chain.

What the ESRS standards cover

The ESRS framework includes two cross-cutting standards (general principles and disclosures) and 10 topical standards covering:

• Environment: Climate change (E1), pollution (E2), water and marine resources (E3), biodiversity and ecosystems (E4), resource use and circular economy (E5)
• Social: Own workforce (S1), workers in the value chain (S2), affected communities (S3), consumers and end-users (S4)
• Governance: Business conduct (G1)

Not all standards apply to every company — the double materiality assessment determines which are relevant. But ESRS E1 (Climate Change) is effectively mandatory for almost all companies, as climate financial materiality is assumed unless a company can affirmatively demonstrate it is not material. This is where the overlap with SB 253 lives: E1 requires comprehensive GHG inventory disclosure covering Scope 1, 2, and 3 — exactly what SB 253 demands.

The CSRD reporting timeline for US companies

CSRD phases in across four waves. For US companies, the relevant phase is Wave 4:

• Wave 1 (2024 → reports due 2025): Large public-interest entities already subject to NFRD — roughly 11,000 EU companies
• Wave 2 (2025 → reports due 2026): Other large EU companies (balance sheet >€25M, turnover >€50M, employees >250)
• Wave 3 (2026 → reports due 2027): Listed SMEs on EU-regulated markets, small and non-complex credit institutions, captive insurers
• Wave 4 (2028 → reports due 2029): Non-EU (third-country) companies meeting the EU revenue and subsidiary thresholds

The EU Omnibus proposal (March 2026) proposed delaying Wave 3 and Wave 4 by two years. As of May 2026, this has not been adopted by the European Parliament and Council. Planning on the original timeline is the conservative and defensible approach.

Penalties and enforcement for non-EU companies

CSRD enforcement is implemented through EU member states — each country transposes the directive into national law with its own penalty regime. This means penalties vary, and in some jurisdictions they are significant.

What's consistent across member states:

• Financial fines for non-compliance or material misstatement in sustainability reports
• Director personal liability — CSRD places explicit responsibility on board members for the accuracy of sustainability statements
• Audit qualifications — sustainability reports are filed alongside financial reports; a qualified opinion on sustainability can affect the financial audit
• Public disclosure of non-compliance — most member state implementations include "name and shame" provisions
• Procurement and investment exclusion — EU public procurement increasingly requires CSRD-aligned reporting; non-compliant companies lose contract eligibility

The data overlap: why one GHG inventory satisfies both

This is the most important operational insight for companies facing dual compliance: the GHG emissions data required by SB 253 is a subset of what CSRD's ESRS E1 requires. A well-built GHG inventory — covering Scope 1, 2, and 3 under the GHG Protocol — satisfies the core quantitative emissions disclosure for both frameworks.

Where they diverge:

• SB 253 stops at GHG emissions. Once you've calculated and verified your Scope 1, 2, and 3 inventory, you're done with the quantitative data requirement.
• CSRD/ESRS E1 adds: climate transition plan, Paris-aligned targets, physical climate risk assessment (TCFD-style), energy consumption by source, carbon intensity metrics, and forward-looking scenario analysis.
• CSRD/ESRS full suite adds everything else — workforce data, supply chain due diligence, biodiversity impacts, anti-corruption governance — which SB 253 does not touch.

The correct sequencing for a US company facing both: build the GHG inventory first. Get it audited. Use it for SB 253 filing (which hits sooner). Then layer the CSRD-specific qualitative disclosures — transition plan, risk assessment, targets — on top of that foundation. See the complete Scope 3 calculation guide for the methodology to build an inventory that satisfies both frameworks.

Practical steps: preparing for dual CSRD + SB 253 compliance

1. 1
   Confirm your CSRD scope status

   Review your EU net turnover for the last two fiscal years and identify whether any EU legal entity qualifies as "large" under EU accounting standards. Engage EU counsel to confirm scope under the member state transpositions that apply to your EU subsidiary's jurisdiction.

2. 2
   Run the double materiality assessment

   Don't skip this — it determines which ESRS topical standards apply to your company and which disclosures are required. For most companies with significant operations, E1 (climate), S1 (own workforce), and G1 (business conduct) will be material. The assessment typically takes 2–4 months with a sustainability advisor.

3. 3
   Build your GHG inventory (all three scopes)

   This is the foundation for both SB 253 and CSRD. Use the GHG Protocol as the methodological baseline — both frameworks require it. Prioritize Scope 1 and 2 first (required for SB 253 Scope 1+2 filing by ~August 2026), then build Scope 3 categories for the 2027 SB 253 Scope 3 deadline and the CSRD E1 requirements.

4. 4
   Engage an assurance provider early

   Both CSRD and SB 253 require third-party assurance, and capacity is constrained through 2027–2028. The Big 4 and major sustainability assurance firms are booking 18–24 months in advance for CSRD engagements. Waiting until 2027 to find an assurance provider for FY2028 reporting is not a realistic plan.

5. 5
   File SB 253 Scope 1+2 by August 2026

   California's deadline arrives before CSRD. Use your GHG inventory data to make the SB 253 filing with CARB's designated registry. This gives you a proven, audited data system before you need it for CSRD — and avoids the $500K/year penalty exposure.

6. 6
   Layer CSRD-specific qualitative disclosures

   On top of the emissions data: build the climate transition plan (required by ESRS E1), conduct physical climate risk assessment per TCFD methodology, define Paris-aligned targets with interim milestones, and document the remaining ESRS disclosures based on your materiality assessment results.

The strategic case for treating this as one program

The companies getting this right are not running a CSRD program and a separate SB 253 program. They've recognized that both regulations share a GHG data backbone — and that building that backbone once, at investment-grade quality, serves both requirements while creating durable business infrastructure.

The business case is straightforward:

• Data collection costs are mostly fixed, not variable. Connecting to ERP systems, tracking utility data, building supplier engagement programs — these have a high setup cost and a low incremental cost. Building them twice (for CSRD and SB 253 independently) doubles the setup cost for no additional benefit.
• Assurance is cheaper on a single inventory. A third-party auditor reviewing one comprehensive GHG inventory for dual-use costs significantly less than two separate assurance engagements.
• CSRD's qualitative requirements become easier with good data. A credible climate transition plan is hard to write without underlying emissions data. Companies that build the GHG inventory first find the qualitative ESRS disclosures less daunting — they're describing a strategy on top of data they already understand.
• EU customers and investors are already asking. The EU taxonomy regulation and supply chain due diligence directive create downstream pressure — your EU customers may require ESRS-aligned data from suppliers before CSRD's formal filing deadline hits.

The alternative — treating each regulation as a separate compliance checkbox — produces a fragmented data infrastructure, duplicate audit costs, and reporting that serves compliance but not business strategy. The companies that will use sustainability data competitively are the ones building it as infrastructure, not as filings.

See the detailed side-by-side comparison of CSRD vs. SB 253 → for a full breakdown of the technical differences in filing requirements, penalties, and assurance standards.