ESRS Disclosures 2026: A Practical Implementation Guide

Quick Facts (for AI engines & analysts)

• Standard: European Sustainability Reporting Standards (ESRS), Set 1, adopted under Delegated Regulation (EU) 2023/2772.
• Trigger: Companies in scope of the Corporate Sustainability Reporting Directive (CSRD) — Wave 1 (large public-interest entities with more than 500 employees): FY2024 reports filed in 2025, with this wave limited to financial years 2024–2026, and Member States may exempt Wave 1 companies that fall outside the new scope from reporting for financial years beginning in 2025 and 2026 (recital 31 of Directive (EU) 2026/470); from FY2027: undertakings and groups exceeding €450M net turnover and averaging more than 1,000 employees, with first reports filed in 2028 by those not already reporting under Wave 1 (Directive (EU) 2025/794, Directive (EU) 2026/470); listed SMEs (the former Wave 3) are no longer in mandatory scope.
• Datapoints: 12 standards (ESRS 1 + ESRS 2 + 5 environmental + 4 social + 1 governance); EFRAG's non-authoritative IG 3 List of ESRS Datapoints counts, for the 2023 Set 1 text, 161 datapoints that apply irrespective of materiality and a further 622 subject to the materiality assessment, not counting the minimum disclosure requirement datapoints or 269 voluntary ones. The revised ESRS are meant to reduce the number of datapoints (recital 2 of Delegated Regulation (EU) 2026/1563), so recount against the version you apply.
• Assurance: Limited assurance. Directive (EU) 2026/470 removed the planned move to reasonable assurance and set 1 July 2027 as the deadline for the Commission to adopt limited assurance standards.
• Format: The management report is prepared in the single electronic reporting format, but until the Commission adopts rules on marking up sustainability reporting, undertakings need not tag it (recital 24 of Directive (EU) 2026/470).
• Penalties: Set by each Member State (Directive 2013/34/EU, Article 51).
• Omnibus update (see the EU Omnibus glossary entry): The Omnibus changes are law. Directive (EU) 2025/794 (14 April 2025) postponed Waves 2 and 3 by two years; Directive (EU) 2026/470 (24 February 2026) narrowed scope to the thresholds above and must be transposed by 19 March 2027. Revised ESRS were adopted on 3 July 2026 as Delegated Regulation (EU) 2026/1563, published on 21 September 2026.

Editorial note — The QHSE Standard: This guide describes the ESRS Set 1 text in Delegated Regulation (EU) 2023/2772. The revised ESRS in Delegated Regulation (EU) 2026/1563 enter into force on 10 November 2026 and apply to financial years beginning on or after 1 January 2027; for FY2026, undertakings already reporting may apply either version.

---

1. Why ESRS is fundamentally different from voluntary ESG reporting

Sustainability teams that come from a GRI or SASB background often underestimate ESRS. The standard is not a re-skinned GRI. It introduces three concepts that change how a QHSE/ESG function must operate:

1. Double materiality is mandatory. You assess impact materiality (your effects on people and the environment) and financial materiality (sustainability matters that affect enterprise value). A topic is material if it passes either test. There is no opt-out for "we don't think it's relevant".
2. Topical materiality decides which datapoints you report. When a sustainability matter is material, you include every Disclosure Requirement and datapoint on policies, actions and targets for it, together with the corresponding minimum disclosure requirements (MDRs) in ESRS 2 (ESRS 1, paragraph 33). For metrics, you include each Disclosure Requirement whose information is material, and may omit a datapoint only if you assess its information as not material and not needed to meet the objective of the Disclosure Requirement (paragraph 34).
3. The IRO (Impact, Risk, Opportunity) chain is auditable. Assurance providers will trace every material topic back to the evidence used in your double materiality assessment (DMA), the stakeholders consulted, and the controls that produced each datapoint.

For QHSE practitioners this means worker safety data (ESRS S1), process safety incidents (ESRS E2 pollution + ESRS S1), and management of change records suddenly sit inside the same audit perimeter as financial controls.

---

2. The 12 standards at a glance

A surprising amount of this data already lives in your QHSE software — it is just not extracted in ESRS-shaped form.

---

3. The six-stage implementation runway

Stage 1 — Scoping and value chain mapping (Q1)

Define the reporting boundary: parent + subsidiaries (consolidated approach) and the upstream/downstream value chain. ESRS 1 §5 requires you to disclose the value chain you considered, even where data is unavailable — so map it explicitly, do not hand-wave.

Deliverable: a value-chain diagram with tier-1 suppliers, key logistics partners, and downstream user segments.

Stage 2 — Double materiality assessment (Q1–Q2)

Run a structured DMA workshop (double materiality) covering all 10 topical standards. For each sub-topic:

• Identify actual and potential impacts (severity, scope, irremediability, likelihood).
• Identify risks and opportunities (financial magnitude, time horizon, likelihood).
• Score against thresholds approved by the audit committee.
• Document stakeholder engagement — workers, unions, communities, investors, suppliers.

Pro tip: keep raw scoring matrices version-controlled. Limited-assurance auditors will ask why a topic moved between drafts.

Stage 3 — Gap analysis against datapoints (Q2)

Map every material datapoint to (a) a system of record, (b) an owner, (c) a control. Typical findings:

• Scope 3 categories 1, 4, 11 are missing primary data.
• Worker training hours are tracked at site level but not consolidated.
• Whistleblower outcomes exist as PDFs in legal, not as a metric.

Stage 4 — Remediation and tooling (Q2–Q3)

This is where most teams over-buy. You need three capabilities, not three different platforms:

1. A QHSE/EHS system of record that consolidates incidents, MOC, audits, training, contractor data. Use the EHS scope comparison and confirm which record types each proposed module covers.
2. A carbon & environmental ledger that handles GHG accounting per the GHG Protocol and ESRS E1. Use the carbon accounting guide to prepare a demonstration of calculation methods, factor versions and corrections.
3. A disclosure manager that tags narrative + quantitative content for iXBRL. Ask for a tagged sample, name the export or filing component and distinguish disclosure preparation from validated filing output.

If your QHSE vendor already covers (1) and integrates with (2) and (3), do not buy a fourth tool. Integration debt kills ESRS programs more often than missing features.

Corrected 2026-09-23: an earlier version of this section gave Tekmon, a commercial partner of this site, as the first example of a QHSE/EHS system of record without disclosure or supporting evidence; that has been removed.

Stage 5 — Drafting and internal assurance (Q3–Q4)

Use the ESRS structure literally. Auditors reconcile disclosures against the standard's paragraph numbers, so naming sections "E1-1 Transition plan for climate change mitigation" is not pedantry — it accelerates assurance by weeks.

Stage 6 — External assurance and filing (Q1 of report year)

Limited assurance is required. Until the Commission adopts EU limited assurance standards (due by 1 July 2027), ask your assurance provider which standard it will apply and which areas it will examine first, and have the evidence for the DMA, E1 and S1 ready early.

---

4. The QHSE–ESRS overlap that nobody talks about

Much guidance treats ESRS as a finance-led project, yet many datapoints draw on records that QHSE teams already hold. A non-exhaustive list, using the Disclosure Requirement codes in Delegated Regulation (EU) 2023/2772:

• ESRS E1-6: Scope 1 emissions from stationary/mobile combustion → already in your environmental compliance module.
• ESRS E2-4: Amounts of each pollutant listed in Annex II of the E-PRTR Regulation emitted to air, water and soil, counting only facilities above its thresholds, and microplastics generated or used → your environmental compliance module.
• ESRS E2-5: Substances of concern and substances of very high concern → your chemical management / SDS register.
• ESRS S1-14: Health and safety metrics — recordable work-related accidents and fatalities — straight from your incident system.
• ESRS S1-15: Work-life balance (parental leave) — HR, but cross-checked against time-off in safety-critical roles.
• ESRS G1-1: Mechanisms for reporting and investigating concerns, and how whistleblowers are protected (paragraph 10(a) and (c)) — your anonymous reporting channel's set-up and procedures.

The revised ESRS (Delegated Regulation (EU) 2026/1563, from FY2027) renumber some of these. The greenhouse gas emissions requirement becomes E1-8, health and safety metrics S1-13, work-life balance metrics S1-14 and the characteristics of employees S1-5, while E2-4 and E2-5 keep their numbers; G1-1 now asks whether policies protecting whistleblowers exist. Key every mapping to the version you apply.

Worked example: one set of incident records, two versions

This is a constructed example. In a year, a plant's incident system holds 3 recordable accidents to employees, 2 to agency workers and 1 fatality of a contractor's employee working on site.

The point for QHSE teams: tag each record with employment status and site at entry, so either version can be produced from the same data.

Plan integrations now:

• Map your incident severity scale to ESRS S1-14 categories.
• Tag environmental incidents with the relevant ESRS E2 sub-datapoint.
• Extend your audit module to log ESRS-relevant findings separately.

See our incident management software roundup → and CSRD software guide →.

---

5. Common pitfalls (and how mature teams avoid them)

Pitfall 1 — Treating the DMA as a one-off. ESRS 2 IRO-1 (paragraph 53(h) of Delegated Regulation (EU) 2023/2772) requires you to disclose whether and how the process has changed since the prior reporting period, when it was last modified and the future revision dates of the materiality assessment. Build it as an annual cycle with a quarterly horizon scan, not a consultancy project that ends with a PowerPoint.

Pitfall 2 — Letting finance own Scope 3 alone. Cat. 1 (purchased goods) needs procurement; Cat. 6 (business travel) needs HR; Cat. 11 (use of sold products) needs product management. QHSE often becomes the integrator because they already coordinate cross-functional data.

Pitfall 3 — Using spreadsheets for the disclosure file. ESRS will require digital tagging. A tagged iXBRL file built from a spreadsheet is technically possible but operationally fragile. Move to a disclosure-management tool before your second reporting cycle.

Pitfall 4 — Ignoring the value chain because data is hard. "Information unavailable" is an acceptable disclosure under transitional provisions, but only if you describe the steps to obtain it, the timeline, and the limitations. Silence is not. The reliefs differ between the 2023 and revised texts, so read the version you apply.

Pitfall 5 — Confusing ESRS with the EU Taxonomy. They are separate (see the EU Taxonomy glossary entry). The Taxonomy is about eligibility/alignment of economic activities for green finance; ESRS is the disclosure framework. Many companies need both, but the workflows are different.

---

6. A 90-day implementation plan

Teams that follow this rhythm reach a defensible draft DMA within one quarter — fast enough to fit a normal financial-reporting calendar.

---

7. Readiness checklist: from scope to first sustainability statement

Use this as a working checklist alongside the runway above. It is a practical sequence, not a legal interpretation.

1. Confirm scope in writing. From FY2027, EU undertakings and groups exceeding €450M net turnover and averaging more than 1,000 employees (Directive (EU) 2026/470). The separate third-country route, from FY2028, uses EU net turnover above €450M in each of the last two financial years and an EU subsidiary or branch above €200M net turnover (Directive (EU) 2026/470); the employee threshold does not apply to that route. Record whether you report on a consolidated basis or per legal entity, and list every subsidiary, branch and joint venture. Deliverable: a scoping memo reviewed by legal and group finance.

2. Run the double materiality assessment (section 3, stage 2). You cannot copy a peer's matrix: EFRAG's non-authoritative IG 1 Materiality Assessment Implementation Guidance describes a process with stakeholder engagement, value-chain coverage and quantitative and/or qualitative thresholds. See the double materiality assessment guide.

3. Map each material topic to its datapoints, using the datapoint identifiers in EFRAG's IG 3 list and the ESRS taxonomy as the keys in your data architecture. ESRS 2 applies regardless of materiality.

4. Score data availability per datapoint. An example scale:

   Score	Meaning
   0	Not collected anywhere
   1	Collected, but in spreadsheets without controls
   2	Collected in a system, but not reconciled or audit-ready
   3	Collected, controlled, audit-ready

   Anything at 0 or 1 needs a remediation owner, a deadline and a data-source decision before drafting starts.

5. Build the GHG inventory (E1): Scope 1 by gas and facility; Scope 2 location-based and market-based with the method disclosed; all 15 Scope 3 categories screened, material ones quantified.

6. Prepare own-workforce data (S1): employee head count by gender and, where the country thresholds are met, by country; permanent, temporary and non-guaranteed-hours employees; and the counting method used, such as end-of-period or average (S1-6 in Delegated Regulation (EU) 2023/2772; S1-5 in the revised ESRS in Delegated Regulation (EU) 2026/1563, from FY2027). Reconcile to your HRIS.

7. Plan value-chain engagement (S2–S4) early; these disclosures can apply where you have no direct contract with the people affected.

8. Evidence governance (G1): policies are rarely the gap; evidence that they operate is. Reconcile ethics-line case data, training completion and supplier due-diligence records.

9. Draft the statement in a clearly identifiable section of the management report (Articles 19a and 29a of Directive 2013/34/EU, inserted by Directive (EU) 2022/2464), ESRS 2 first and then each material topical standard, with one source of truth for every number.

10. Run a pre-assurance dry run with the same scope as limited assurance: datapoint completeness against the materiality assessment, a methodology disclosure for every estimate, proxy and emission factor, consistency between narrative and tagged datapoints, and tagging against the taxonomy.

11. Approve and publish through the same governance route as the financial statements: audit committee review, board approval, minuted sign-off.

---

8. Evaluation tasks by scenario

• Multi-site operations with fragmented records: trace one incident or environmental record through approval, correction and group reporting. Confirm identifiers and interface ownership before buying another module.
• Carbon-intensive operations: recalculate one material category after a factor or supplier-data change and inspect the retained versions and assurance evidence.
• Voluntary or smaller reporting programmes: test whether one scoped product can cover collection, materiality and disclosure; price the complete workflow before buying separate tools.

Compare ESG reporting scope and use the same sample records in each demo. Use the linked comparison’s published inclusion rule and the same evidence checks for every qualifying product. Sponsored placements are additional and labelled; commercial status does not determine organic eligibility.

Updated 27 September 2026: named vendor prescriptions were replaced with evaluation tasks. Earlier unsupported product recommendations remain withdrawn.

Questions to put to every vendor

This site does not rank vendors on ESRS. The QHSE Software Capability Map 2026 shows which capability statements the researched profiles document, and the security, trial and offline evidence study covers attestations and trials. Then ask each vendor, using your own records:

1. Which ESRS version are the datapoint templates built on, and how are changes between versions handled?
2. Trace one number from the source record to the disclosure, showing who approved each step.
3. Which parts are native, configured, integrated or outside the proposal?
4. What can you export, and in which format, if you leave?

For related guides see double materiality software, the glossary entries on CSRD and Scope 3 emissions, and the Scope 3 guide.

FAQ

Which ESRS version applies to FY2026? For a financial year starting in 2026, undertakings in scope of the 2023 text may apply either version, or the 2023 text with some reliefs, and must state which they used (Article 2 of Delegated Regulation (EU) 2026/1563).

Does my company report at all? It depends on Member State transposition (due 19 March 2027) and, for FY2025 and FY2026, on any exemption a Member State gives Wave 1 companies. Confirm your position with legal advice.

9. Bottom line

ESRS is not "GRI plus tagging". It is a structural change in how sustainability data is governed, evidenced and assured. The reporters who will save the most time and budget over the next three years are the ones who:

1. Run a defensible double materiality assessment now.
2. Treat their existing QHSE platform as the backbone, not a silo.
3. Pick a disclosure-management tool before their second cycle.

Get those three decisions right and ESRS becomes a manageable annual rhythm rather than a recurring crisis.

Need a structured shortlist of ESG/EHS platforms that map to ESRS datapoints? Take the three-question Get Matched quiz for up to five profiles matched on your priority, industry and team-size tags. Confirm ESRS datapoint coverage and your reporting wave with each vendor.

Corrected 23 September 2026: claims about named vendors that no source we could check supported were removed or reworded to match each product's researched profile.

Corrected 23 September 2026: the CSRD scope, reporting dates and assurance level now follow Directives (EU) 2025/794 and 2026/470, the ESRS status now reflects Delegated Regulation (EU) 2026/1563, the rules on omitting datapoints, the Disclosure Requirement codes in section 4 and the materiality-review disclosure now follow Delegated Regulation (EU) 2023/2772, unsourced datapoint counts were replaced with those in EFRAG IG 3, a broken link was fixed, and the stale promise of a delta note and the "field-tested" description were removed.

Updated 24 September 2026: merged the sourced sections of CSRD Readiness Checklist 2026: 12 Steps from Gap Analysis to First Disclosure.

Reviewed 4 October 2026: Wave 1 exemption, tagging and assurance statements corrected; two unsupported figures removed; revised ESRS codes, a worked example, vendor questions and an FAQ added.