Your Governance, Risk, and Compliance (GRC) stance changes by the Corporate Sustainability Reporting Directive (CSRD), which substitutes legally enforceable, third-party certified financial-grade data for optional, estimated sustainability criteria. While there isn't a single, universal "GRC score," CSRD directly modifies external ESG ratings, third-party vendor scores, and internal GRC risk evaluations in a number of quantifiable ways.
CSRD is EU law that makes large firms publish sustainability data. It does not add a new line to your GRC Score. It does test the same things the score measures. Weak oversight, loose controls and poor supplier checks show up in both. The rules also changed a lot in 2026. Fewer firms must report now. The standards are shorter too.
You will find the new scope, the dates and the UK view below. You will also see how each duty maps to the six domains of the GRC Index. Do you know where your own governance stands today? A free self-check takes about nine minutes.
What Changed in CSRD Between 2024 and 2026?
The EU passed the Corporate Sustainability Reporting Directive in 2022. The first wave of firms reported for 2024. Then the EU cut the load. The Commission offered a simpler package in February 2025. A two-year delay for later firms followed in April 2025. Directive (EU) 2026/470 became law in March 2026. The Commission adopted the revised standards in July 2026.
The key results are easy to list.
- The size test rose to more than 1,000 employees and more than €450 million in net turnover.
- Mandatory data points fell by about 61%.
- Reasonable assurance was dropped. Limited assurance stays.
Does CSRD Still Apply to You?
Yes, the CSRD is still in operation, but it has had its scope significantly reduced by the Omnibus I Directive (Directive (EU) 2026/470), which came into force in early 2026. Many firms dropped out in 2026. You should check the table below against your own numbers. An EU firm must pass both tests.
Some firms that reported for 2024 may skip 2025 and 2026. Each EU country decides. National law is due by 19 March 2027. So you should check your local rules too.
What Does the UK Require Instead?
The UK has its own path. The government published UK SRS S1 and S2 on 25 February 2026. Firms may use them now. Use is voluntary for the moment. Then the FCA issued final rules for listed firms on 30 September 2026. Mandatory use is expected to start from 1 January 2027.
Boards of listed firms also face Provision 29 of the UK Corporate Governance Code. But don't worry, you can read our guide to Provision 29, which explains the duty in plain words.
Where Does Governance Sit in the ESRS?
The ESRS holds twelve standards. Two are general. Five cover the environment. Four cover social topics. One covers governance.
The governance standard is ESRS G1. It deals with business conduct. Topics include bribery, corruption and supplier behaviour. The general standard, ESRS 2, also holds governance duties. They ask who oversees sustainability and how the board gets its facts.
Your board should be able to ask you three things.
- Who owns each sustainability topic
- Which papers the board reads
- How the board checks the data
How Does Each CSRD Duty Map to the Six GRC Index Domains?
The GRC Index scores six domains. CSRD touches all six. This table shows our reading of how each duty lines up with a domain. It is a guide and not legal advice.
A low mark in one domain rarely stays there. Weak supplier checks, for example, also weaken your data. The GRC maturity model shows how to move up one level at a time.
Which Controls and Evidence Will an Assurer Ask For?
At that time, CSRD will require limited assurance only. The plan to move to reasonable assurance was dropped. The Commission must adopt limited assurance standards by 1 July 2027. Until then, assurers use current standards such as ISAE 3000.
An assurer tests the data and the controls behind it. You should prepare for some questions on four points.
- Who collects each data point
- How the team checks the data before use
- Who signs it off
- How the team logs changes
You can read our detailed guide on ISAE 3402, which shows how auditors similarly test controls.
What If You Supply a CSRD Company?
Small firms still get data requests from large clients. The EU now limits those requests. A new value chain cap protects firms with fewer than 1,000 employees. The cap covers CSRD requests only. But clients can still ask for other facts in normal deals.
Is Your Governance Ready for CSRD?
You should give yourself one point for each yes.
- Does a named person own the sustainability data?
- Does the board see sustainability papers each quarter?
- Do you hold a written record of your materiality check?
- Can you show who signed off last year's numbers?
- Do you know which suppliers send you data?
- Do you know your scope under EU and UK rules?
Five or six points means you are in good shape. Three or four points means you have gaps. Two points or fewer means you should act now. Do you want a fuller view? The free GRC assessment scores all six domains in about nine minutes.
How Do You Start Your Free GRC Assessment?
The GRC Index lists more than 1,300+ organisations. Each one holds a score from 0 to 50+. You can get your own first score in just nine minutes. A self-check is not independent proof. An evidence review gives a verified result.
You can begin with the free assessment. Then you can see how other firms score in the index. If you have any questions? Write to info@grci.net or call +44 203 1264430.
FAQ’s
Does CSRD change my GRC Score directly?
Your Governance, Risk, and Compliance (GRC) score will not be directly affected by the Corporate Sustainability Reporting Directive (CSRD), contrary to popular belief.
Who must report under CSRD now?
The scope of the (CSRD) has been drastically restricted as a result of the acceptance of the Omnibus I modifications by the Council of the European Union and the European Commission after the implementation of these adjustments.
Is a CSRD report audited?
Yes. An assurer gives limited assurance. The move to reasonable assurance was dropped.
Do UK firms need to follow CSRD?
UK firms are not legally obliged to comply with the EU’s Corporate Sustainability Reporting Directive (CSRD) since they are UK-based. But UK corporations with substantial activities, subsidiaries, or listed securities in the (EU) European Union may find themselves under its scope.
How long does a GRC assessment take?
The time for (Governance, Risk, and Compliance) assessment is totaly depends on whether you want to apply for a UK Gender Recognition Certificate (GRC) or do a corporate/IT GRC review. Usually, the GRC Index takes 9 minutes on the GRCI Index platform.
