Why "am I in scope" is the wrong first question

Most companies trying to figure out their CSRD obligations start by asking whether the rule applies to them at all. The better question is when it applies, because CSRD was never designed as a single cutover date. It phases in by company size and listing status, and the reporting obligation reaches different tiers of companies at different points. If you only check whether you're "in" or "out," you'll miss the fact that a company currently outside scope can move into scope as the rollout advances, or as its own footprint grows.

The practical implication is that CSRD readiness isn't a one-time compliance project you either need or don't. It's a moving target that tracks your size band, and the work of preparing — building a Scope 1/2/3 inventory, standing up double materiality assessment, getting assurance-ready data — takes long enough that waiting for your exact wave to arrive is a bad strategy.

The size-band logic

CSRD's phasing is built around the idea that the largest, most market-relevant companies should report first, with the reporting population widening over subsequent waves to bring in a broader set of large companies, and eventually listed small and medium-sized enterprises. The underlying test involves company size — measured through the kind of thresholds already used elsewhere in EU accounting law, such as balance sheet total, net turnover, and employee count — combined with whether the company's securities are listed on an EU-regulated market.

Rather than fixing exact figures and years here, the operating principle to remember is this: bigger and already-listed companies move first, and the reporting perimeter expands outward from there. Because the specific thresholds and timing are the kind of detail that gets refined and occasionally delayed at the EU level, treat any calendar you see quoted as something to verify against the current official text rather than something to plan around blindly.

Double materiality doesn't wait for your wave

Whatever wave a company lands in, the substance of what CSRD asks for under ESRS E1 doesn't change: disclosure of Scope 1, 2, and 3 emissions, assessed through a double materiality lens. That means reporting both how climate change affects the company financially (outside-in) and how the company's operations and value chain affect climate and the broader environment (inside-out). Scope 3 is where double materiality does the most work, because a company's purchased goods, use-phase emissions, or investments are frequently where the outside-in financial risk and the inside-out impact both concentrate.

This is also where the GHG Protocol's data quality hierarchy becomes relevant to CSRD readiness specifically. Spend-based estimates might get a company through an initial disclosure, but double materiality assessments and assurance expectations put pressure on moving toward hybrid and supplier-specific data over time. A company that waits until its size band is confirmed before starting this work is choosing to compress years of data maturation into whatever runway is left.

The non-EU trap: how a subsidiary pulls in the parent

The part of CSRD that catches non-EU companies off guard isn't the size-band logic — it's the third-country mechanism. CSRD isn't limited to companies incorporated in the EU. A non-EU parent company can be brought into scope through the activity of its EU subsidiaries or branches, if that EU presence generates a large enough share of net turnover within the EU.

The mechanism works like this: regulators aren't trying to reach every multinational with an EU sales office. They're targeting non-EU groups whose EU footprint, measured through subsidiary or branch turnover, is substantial enough that the group's climate-related risks and impacts are material to EU stakeholders. When that turnover condition is met, the reporting obligation can apply at the level of the ultimate non-EU parent, not just the EU subsidiary itself — meaning the parent may need to produce a consolidated sustainability report covering the group, not a report scoped narrowly to the EU entity.

For a non-EU headquartered company, this means the CSRD applicability question can't be answered by looking at headcount or turnover at the group level alone. It requires mapping where EU subsidiaries and branches sit in the corporate structure and what share of group-wide EU turnover they represent. A company with a modest EU presence today can cross that line as it grows in the region, well before its global size would otherwise put it in a size-band wave.

What this means operationally

Two practical takeaways follow from all of this. First, don't treat CSRD scope as static — reassess it periodically as your company's size, listing status, and EU subsidiary turnover evolve, rather than checking once and filing the answer away. Second, start building the Scope 3 inventory and double materiality process before your wave is confirmed, because supplier engagement and data quality improvement take multiple reporting cycles to mature, and assurance readiness is not something you build in a single quarter.

If you're trying to work out whether your group's EU subsidiary footprint creates an obligation at the parent level, or you need to get ESRS E1-aligned Scope 3 data in shape before your size band is confirmed, that's the kind of scoping and build-out work our CSRD & SEC-Ready Reporting practice handles. Reach out at carbon@digi.ai.in.