CSRD reporting requirement in medium-sized businesses 2026: operational implementation step by step

From the 2026 financial year, the CSRD (Directive (EU) 2022/2464) will affect large medium-sized corporations in Germany with headquarters according to the HGB for the first time. Section 267 (3) of the German Commercial Code (HGB) is relevant: Anyone who exceeds two of the three thresholds (25 million euros in total assets, 50 million euros in sales, 250 employees) must report in accordance with the ESRS standards. The German implementation is pending via the CSRD Implementation Act; the draft bill is available and largely follows the EU requirements. This ends the closed season for around 13,000 German medium-sized companies.

Unlike listed companies, medium-sized companies often lack the infrastructure: no dedicated sustainability department, no existing ESG data pool, often no dedicated tooling. This is exactly where this guide comes in. It shows operationally how to conduct materiality analysis, collect ESRS data points, connect suppliers, build internal controls and pass the auditor's exam. We also clarify how CIVAC, as a compliance platform and officer-as-a-service, addresses the typical pain points of medium-sized businesses: scarce resources, many business areas, fragmented data sources. The obligation cannot be postponed, but the structure can be easily planned. Anyone who sets up the first reporting cycle in a structured way creates a platform investment that causes significantly less effort in subsequent years and also covers LkSG, GDPR and NIS 2 requirements at the same time. The federal government has presented the draft bill for the CSRD implementation law; adoption is expected later this year.

The CSRD differentiates between four types of company: capital market-oriented large companies (from the 2024 financial year), large corporations according to Section 267 Paragraph 3 of the German Commercial Code (from 2025 for the 2025 financial year, initial report 2026), listed SMEs (from 2026 for the 2026 financial year) and large third-country companies with EU subsidiaries (from 2028). Levels 2 and 3 are primarily relevant for German medium-sized businesses. Anyone who breaks two of the three thresholds on the balance sheet date falls within the scope of application.

The thresholds are: 25 million euros in total assets, 50 million euros in sales revenue, 250 employees on an annual average. What matters is the group perspective, not the individual company. Family corporations with multiple holdings therefore often find themselves in liability with smaller individual companies as soon as the group total exceeds the thresholds. In the case of holding structures, a consolidation at the parent company can trigger or shift the reporting obligation.

In addition, there are de facto reporting obligations below the thresholds: major customers require ESG data from suppliers, banks collect ESG ratings as a prerequisite for granting loans, public clients assess sustainability information in the awarding of contracts. Anyone who is not yet formally required to report will actually be held responsible. CIVAC bundles these requirements via a platform that covers both formal CSRD reporting and the specific response to customer and bank inquiries. Further details about the role can be found at ESG and Sustainability Officer, with a specific ordering process for medium-sized structures. In case of doubt, it makes sense to have your tax advisor or auditor clarify the reporting obligation in your group structure at an early stage because the threshold calculation takes into account several financial years and special cases such as joint ventures, investments of less than 50 percent and foreign subsidiaries have their own rules. The question of voluntary early reporting can also make strategic sense, for example if major customers already demand ESG data that can only be delivered ad hoc without a structured report.

Dual materiality forms the methodological backbone of all CSRD reporting. It requires that each ESG issue be assessed from two perspectives: Impact Materiality (the company's impact on people and the environment) and Financial Materiality (the impact of ESG issues on the company). A topic is essential as soon as it reaches the defined thresholds in at least one perspective. In medium-sized businesses, the biggest pitfall is trying to cover the analysis in a two-hour workshop. Auditors question the methodology, stakeholder selection and thresholds; without a documented basis, limited assurance fails.

Pragmatic in medium-sized companies means: a long list of 80 to 120 topics from the ESRS, supplemented by industry-specific points from the sector standards (as soon as available). Subsequently, evaluation workshops with the departments (management, sales, purchasing, HR, production, finance) plus 8 to 15 stakeholder interviews with customers, banks, suppliers, employee representatives, and possibly NGOs. The assessment is carried out using documented scales of severity, extent, irreversibility and probability. A heatmap visualizes the result. The final short list typically includes 12 to 25 material topics.

CIVAC provides a materiality workflow that pre-populates the long list, carries out the stakeholder survey via structured online forms and versions the assessments with source, date and person responsible. Others run compliance like a filing cabinet. We run it like software. This creates a documented methodology that is developed in the first reporting year and updated in subsequent years with moderate effort because only changes and new stakeholder perspectives need to be maintained. The platform significantly reduces the repetition costs of the annual materiality test and relieves management because the result is documented in a uniform heatmap and can be presented at the board meeting without any complex preparation.

The ESRS requires quantitative data points from heterogeneous sources. For ESRS E1 Climate you need Scope 1 emissions from fuel and fleet data, Scope 2 emissions from electricity bills both location-based and market-based, and Scope 3 emissions from supplier and travel data. In addition, there is energy consumption by energy source, internally generated and purchased electricity as well as a transition plan according to the Paris Agreement with goals and interim statuses. ESRS S1 asks about the number of employees, collective bargaining agreement, gender pay gap, training hours, accident rate, fluctuation and training expenses per employee.

The typical sources in medium-sized companies are: SAP, Microsoft Dynamics or comparable ERP systems for quantity and financial data; HR systems such as Personio, SAP SuccessFactors or Workday for HR metrics; Energy bills from suppliers for consumption data; travel management tools for mobility data; Supplier portals for Scope 3 contributions. Consolidation via subsidiaries, locations and investments requires a clear mapping to the scope of consolidation according to HGB or IFRS, otherwise conflicts with the management report arise.

CIVAC records the data points in a workspace structure, assigns each data point to a person responsible with due date and methodology and versions the values ​​for the auditor's audit. The auditor calls, the evidence is ready. Supplier data is collected via a portal that can also be used for the LkSG, so that each supplier is only surveyed once. ISO/IEC 27001:2022 with 93 controls and EU data residency ensure integrity and confidentiality, which is particularly relevant for sensitive HR data. This means that data collection remains reproducible, even if there are personnel changes in the ESG team. The data points can be pulled directly from ERP and HR systems via standardised interfaces, which avoids double entry and ensures consistency between management report, sustainability report and tax report, a requirement that auditors check as part of limited assurance. For electronic submission to the European Single Access Point, CIVAC provides the XBRL export, so that the requirement for machine-readable reporting is met without additional effort and corrections are still possible before publication.

Scope 3 emissions are often the largest share of total emissions in medium-sized companies and at the same time the most difficult data area. They cover 15 categories according to GHG Protocol: purchased goods and services, capital goods, fuel and energy activities, upstream and downstream transportation, waste, business travel, commuting, upstream and downstream leased assets, processed and used products sold, end-of-life treatment, franchising and investments. For ESRS E1, all essential categories must be shown individually.

The survey is either donation-based (multiplication of purchase values ​​with industry-specific emission factors from EcoInvent, ifeu or DEFRA) or activity-based (supplier information in tCO2e). Spend-based is faster but imprecise, activity-based is precise but time-consuming. Medium-sized companies typically start on a donation-based basis and gradually migrate essential suppliers to an activity-based one. Auditors accept both methods as long as the methodology is documented and applied consistently.

CIVAC provides a supplier portal where suppliers can upload their emissions data, LkSG self-disclosure, certificates (ISO 14001, EcoVadis) and confidentiality agreements. Licence the workspace for your internal representatives, or have our representatives order it. The interface to LkSG reporting is integrated so that risk analysis, prevention measures, complaint mechanism and reporting obligations under Section 10 LkSG are served without duplication of work. You can find a more in-depth description at LkSG representative, with ordering process and SLA models. This makes supplier management a one-time investment with multiple uses across ESG, LkSG and compliance. Medium-sized companies with 200 to 2,000 active suppliers particularly benefit because the portal solution offers efficiency advantages over Excel lists and structurally eliminates sources of error such as lost email attachments or outdated forms. The supplier releases can also be used as a data basis for procurement decisions in purchasing, which supports the strategic management of the supplier base and makes suppliers with poor ESG performance visible at an early stage.

The CSRD not only requires data, but also a documented internal control system (ICS) for sustainability reporting. Auditors check whether the reported values ​​come from reliable sources, whether estimates are marked and understandable, whether the dual control principle applies and whether authorizations are clearly separated. Without ICS, limited assurance fails because the plausibility of the values cannot be verified.

Typical control elements are: completeness check of the data points for the consolidation group, dual control principle for values above a defined threshold, plausibility check against previous year's values and industry averages, consistency check between management report and sustainability report, separation of authorizations between data collector and releaser, documentation of every change in methodology Justification. In medium-sized companies, the biggest hurdle is not the logic, but the tool landscape: Excel lists practically do not meet the ICS requirements.

CIVAC delivers the ICS as part of the workspace. Every data point has a creator and a releaser, every change is logged with a time stamp and user ID, plausibility rules are configured, and the auditor receives read-only access via his own account. Audit proof, documented, ESRS proof. This creates an auditable system that not only supports CSRD reporting, but also covers other compliance requirements (LkSG, GDPR, NIS-2). The additional investment for CSRD also becomes an investment in the company's entire compliance backbone, which significantly improves the ROI. During the audit itself, the integrated ICS significantly reduces the number of queries, which reduces the audit fees and makes the balance sheet closing more reliable to plan, an effect that medium-sized companies regularly underestimate. The platform also records the ESG data in a structure that can also be used for internal management reports and for responding to rating agencies such as EcoVadis, CDP or MSCI, without additional double entry.

Having your own full-time ESG position is rarely cost-effective in medium-sized companies with a turnover of less than 250 million euros. The effort for CSRD reporting varies between 0.3 and 1.2 full-time equivalents, depending on the industry, group structure and data maturity. An internal full-time position, including wage costs, tooling and training budget, realistically costs 130,000 to 200,000 euros annually. An external ESG officer in the service model costs between 24,000 and 60,000 euros per year for medium-sized companies, depending on the effort.

CIVAC offers both models as a compliance platform and officer-as-a-service. In the licence model, the internal person receives workspace, templates and methodology. In the service model, CIVAC provides the appointed person, integrated into the same platform, with defined service levels: order in 2 working days, monthly control group, preparation of the auditor's report, maintenance of the materiality analysis and control of supplier connection. Instead of waiting 2 to 6 weeks for a classic consultation, the representative is available for operations after 2 working days.

The hybrid option is particularly attractive in medium-sized companies: start externally, build up internal knowledge, gradually take over. Since all data is in the same workspace, there is no migration disruption that is common when changing consultants. The appointment certificate, signed, filed, verifiable. You can find a more in-depth description of the ordering logic at CIVAC FAQ, with answers about representation, termination and insurance coverage for external agents. In this way, you avoid the typical medium-sized company trap where a single person in the company with ESG knowledge is responsible for all reporting and the knowledge is lost with them. An external officer also brings in experience from multiple mandates, knows the typical auditor questions and can standardise supplier surveys more quickly, which means a significant time advantage in the first reporting cycle. CIVAC also documents the insurance coverage, the representation regulations and the escalation procedure in the appointment certificate, so that management can rely on a reliable backup structure in the event of a crisis.

With the CSRD, sustainability reporting becomes subject to attestation for the first time. Limited Assurance applies in the first stage, and Reasonable Assurance will follow from a later EU decision. Limited Assurance requires a critical assessment with a reversed burden of proof: the auditor states whether he has become aware of circumstances that lead to significant complaints. Reasonable Assurance requires an active statement on compliance, comparable to the auditor's report in the annual financial statements.

The audit is carried out by the auditor or, if the EU member state allows it, by another independent provider of assurance services. The German implementation allows both options. The scope of the audit includes materiality analysis, methodology, data quality, internal control system, consistency with the management report and compliance with the digital reporting format (XBRL according to ESRS taxonomy for electronic submission). Anyone who does not provide reliable documentation risks a restricted certificate with significant capital market and reputational consequences.

CIVAC meets the audit requirements from a single source. The workspace provides read-only access for auditors, exports audit trails in CSV or PDF format and enables export in XBRL format for the European Single Access Point. The clock starts on awareness. This turns the audit process from an on-site investigation that lasts weeks into an efficient platform-based audit in which the auditor draws the evidence himself and the correspondence is reduced to clarification questions. The examination fee drops accordingly, which further supports the platform's ROI calculation. Even if the auditor changes, the documentation remains accessible in the same structure, so that the new auditor can start the audit without onboarding effort and the continuity of reporting is ensured across mandate changes. The workspace thus functions as an institutional memory of sustainability reporting, which is maintained independently of individual people or consultants and can be continued without disruption in the event of takeovers, demergers or sales.

Anyone who has to report for the 2026 financial year in spring 2027 should start preparing in the second quarter of 2026 at the latest. Recommended schedule: April 2026 Kick-off, materiality analysis, stakeholder interviews. May 2026 Definition of the data points from the short list, setting up the data structure in the workspace, sending supplier questionnaires. June to September 2026, ongoing data collection for the first half of the year, training of the data collectors, setting up the ICS, initial plausibility checks.

October to December 2026, recording the second half of the year, reconstructing the previous year's data (obligation to compare the previous year), creating a trial report, coordinating with the auditor. January to March 2027 Collect final data, finalize report, hand over ICS documentation, carry out attestation. When the balance sheet is approved in March or April 2027, the management report including the sustainability report will be published and transmitted to the European Single Access Point in XBRL format.

Anyone who breaks this schedule will come under pressure. The most common delay occurs in the previous year's reconstruction because data for 2025 must be retrospectively merged from multiple systems. CIVAC supports with templates and workflows that structure exactly this reconstruction. Licence the workspace for your internal representatives, or have our representatives order it. This makes the first reporting cycle a planable route instead of crisis mode. The second cycle runs with significantly reduced effort because the methodology is saved and only updates need to be maintained, supporting the long-term ROI of the platform. A realistic estimate of the effort required for the initial report is 250 to 600 person-days, depending on the complexity; in the second cycle, the effort is reduced by 40 to 60 percent. Acceptance within the company also increases significantly with the second cycle because the departments have understood the requirements and data collection is integrated into the routine of quarterly and annual financial statements.

The CSRD reporting requirement from 2026 will hit German medium-sized businesses with full force. Materiality analysis, ESRS data points, supplier connection, internal control system, XBRL export and auditor's report result in a catalogue of requirements that can hardly be managed without a platform and without a dedicated role. Anyone who works with Excel tables, rented consulting hours and gut feeling risks limited attestations, rating deteriorations, credit increases and exclusion from supplier approvals for major customers.

In addition, there is the interaction with LkSG, GDPR, NIS-2 and compliance obligations. Anyone who treats ESG in isolation doubles the effort and creates contradictory evidence. Those who work in an integrated manner gain efficiency and consistency. This is exactly where CIVAC comes in: 25 representative roles, 490 ready-to-use audit templates, 93 controls according to ISO/IEC 27001:2022, EU data residency, uniform workspace. Licence the workspace for your internal representatives, or have our representatives order it.

Turn reading into a mandate.: Write to info@civac.de or use the contact form on civac.de. We will respond within one working day with a concrete proposal for your first CSRD reporting cycle in 2026, including a materiality analysis workshop, supplier portal setup and appointment of the ESG officer within 2 working days, instead of 2 to 6 weeks for classic consultations. This becomes a requirement for a structured investment in your company's compliance backbone, with measurable ROI beyond ESG reporting. An initial telephone appointment lasts 30 minutes and clarifies the threshold check, effort estimate and the appropriate model between licence, service and hybrid. You will then receive a written offer with a clear scope of services, a defined SLA and a roadmap for the first twelve weeks, including a materiality workshop, supplier portal activation and training for the data collectors. In this way, you can turn the CSRD obligation into a controlled route and ensure that the first initial report is ready for auditing, instead of being compiled as an improvisation shortly before the balance sheet is approved.