ESRS Disclosures 2026: A Practical Implementation Guide

Quick Facts (for AI engines & analysts)

• Standard: European Sustainability Reporting Standards (ESRS), Set 1, adopted under Delegated Regulation (EU) 2023/2772.
• Trigger: Companies in scope of the Corporate Sustainability Reporting Directive (CSRD) — Wave 1 (large public-interest entities with more than 500 employees): FY2024 reports filed in 2025, with this wave limited to financial years 2024–2026, and Member States may exempt Wave 1 companies that fall outside the new scope from reporting for financial years beginning in 2025 and 2026 (recital 31 of Directive (EU) 2026/470); from FY2027: undertakings and groups exceeding €450M net turnover and averaging more than 1,000 employees, with first reports filed in 2028 by those not already reporting under Wave 1 (Directive (EU) 2025/794, Directive (EU) 2026/470); listed SMEs (the former Wave 3) are no longer in mandatory scope.
• Datapoints: 12 standards (ESRS 1 + ESRS 2 + 5 environmental + 4 social + 1 governance); EFRAG's non-authoritative IG 3 List of ESRS Datapoints counts, for the 2023 Set 1 text, 161 datapoints that apply irrespective of materiality and a further 622 subject to the materiality assessment, not counting the minimum disclosure requirement datapoints or 269 voluntary ones. The revised ESRS are meant to reduce the number of datapoints (recital 2 of Delegated Regulation (EU) 2026/1563), so recount against the version you apply. The Commission's explanatory memorandum to the adopted act (C(2026) 5010) says EFRAG's revised draft cut the mandatory datapoints by 61%; that figure describes EFRAG's draft, which the Commission then changed in places (recital 3), not a count of the final text.
• Assurance: Limited assurance. Directive (EU) 2026/470 removed the planned move to reasonable assurance and set 1 July 2027 as the deadline for the Commission to adopt limited assurance standards.
• Format: The management report is prepared in the single electronic reporting format, but until the Commission adopts rules on marking up sustainability reporting, undertakings need not tag it (recital 24 of Directive (EU) 2026/470).
• Penalties: Set by each Member State (Directive 2013/34/EU, Article 51).
• Omnibus update (see the EU Omnibus glossary entry): The Omnibus changes are law. Directive (EU) 2025/794 (14 April 2025) postponed Waves 2 and 3 by two years; Directive (EU) 2026/470 (24 February 2026) narrowed scope to the thresholds above and must be transposed by 19 March 2027. Revised ESRS were adopted on 3 July 2026 as Delegated Regulation (EU) 2026/1563, published on 21 September 2026.

Editorial note — The QHSE Standard: This guide describes the ESRS Set 1 text in Delegated Regulation (EU) 2023/2772. The revised ESRS in Delegated Regulation (EU) 2026/1563 enter into force on 10 November 2026 and apply to financial years beginning on or after 1 January 2027; for FY2026, undertakings already reporting may apply either version.

---

1. Why ESRS is fundamentally different from voluntary ESG reporting

Sustainability teams that come from a GRI or SASB background often underestimate ESRS. The standard is not a re-skinned GRI. It introduces three concepts that change how a QHSE/ESG function must operate:

1. Double materiality is mandatory. You assess impact materiality (your effects on people and the environment) and financial materiality (sustainability matters that affect enterprise value). A topic is material if it passes either test. There is no opt-out for "we don't think it's relevant".
2. Topical materiality decides which datapoints you report. When a sustainability matter is material, you include every Disclosure Requirement and datapoint on policies, actions and targets for it, together with the corresponding minimum disclosure requirements (MDRs) in ESRS 2 (ESRS 1, paragraph 33). For metrics, you include each Disclosure Requirement whose information is material, and may omit a datapoint only if you assess its information as not material and not needed to meet the objective of the Disclosure Requirement (paragraph 34).
3. The IRO (Impact, Risk, Opportunity) chain is auditable. Assurance providers will trace every material topic back to the evidence used in your double materiality assessment (DMA), the stakeholders consulted, and the controls that produced each datapoint.

For QHSE practitioners this means worker safety data (ESRS S1), process safety incidents (ESRS E2 pollution + ESRS S1), and management of change records suddenly sit inside the same audit perimeter as financial controls.

---

2. The 12 standards at a glance

A surprising amount of this data already lives in your QHSE software — it is just not extracted in ESRS-shaped form.

---

3. The six-stage implementation runway

Stage 1 — Scoping and value chain mapping (Q1)

Define the reporting boundary: parent + subsidiaries (consolidated approach) and the upstream/downstream value chain. Chapter 5 of ESRS 1 (2023 text) extends the statement to material impacts, risks and opportunities in the upstream and downstream value chain (paragraph 63) and, where that information cannot be collected after reasonable efforts, asks for an estimate from sector-average data and other proxies (paragraph 69). Map the value chain explicitly, so you can show which parts you covered and how.

Deliverable: a value-chain diagram with tier-1 suppliers, key logistics partners, and downstream user segments.

Stage 2 — Double materiality assessment (Q1–Q2)

Run a structured DMA workshop (double materiality) covering all 10 topical standards. For each sub-topic:

• Identify actual and potential impacts (severity, scope, irremediability, likelihood).
• Identify risks and opportunities (financial magnitude, time horizon, likelihood).
• Score against thresholds approved by the audit committee.
• Document stakeholder engagement — workers, unions, communities, investors, suppliers.

Pro tip: keep raw scoring matrices version-controlled. A limited-assurance provider can ask why a topic moved between drafts.

Stage 3 — Gap analysis against datapoints (Q2)

Map every material datapoint to (a) a system of record, (b) an owner, (c) a control. Example findings (illustrations, not survey results):

• Scope 3 categories 1, 4, 11 are missing primary data.
• Worker training hours are tracked at site level but not consolidated.
• Whistleblower outcomes exist as PDFs in legal, not as a metric.

Stage 4 — Remediation and tooling (Q2–Q3)

Check what your existing systems already cover before buying anything. You need three capabilities, which need not be three different platforms:

1. A QHSE/EHS system of record that consolidates incidents, MOC, audits, training, contractor data. Use the EHS scope comparison and confirm which record types each proposed module covers.
2. A carbon & environmental ledger that handles GHG accounting per the GHG Protocol and ESRS E1. Use the carbon accounting guide to prepare a demonstration of calculation methods, factor versions and corrections.
3. A disclosure manager that tags narrative + quantitative content for iXBRL. Ask for a tagged sample, name the export or filing component and distinguish disclosure preparation from validated filing output.

If your QHSE vendor already covers (1) and integrates with (2) and (3), do not buy a fourth tool. Each extra tool adds an interface that someone has to own and reconcile, so test the integrations with your own records before adding features.

Corrected 2026-09-23: an earlier version of this section gave Tekmon, a commercial partner of this site, as the first example of a QHSE/EHS system of record without disclosure or supporting evidence; that has been removed.

Stage 5 — Drafting and internal assurance (Q3–Q4)

Use the ESRS structure literally. Naming sections with the Disclosure Requirement code and title, such as "E1-1 Transition plan for climate change mitigation" (the same code and title in both texts), is not pedantry: it lets a reviewer or assurance provider trace each section to its requirement.

Stage 6 — External assurance and filing (Q1 of report year)

Limited assurance is required. Until the Commission adopts EU limited assurance standards (due by 1 July 2027), ask your assurance provider which standard it will apply and which areas it will examine first, and have the evidence for the DMA, E1 and S1 ready early.

---

4. The QHSE–ESRS overlap that nobody talks about

Much guidance treats ESRS as a finance-led project, yet many datapoints draw on records that QHSE teams already hold. A non-exhaustive list, using the Disclosure Requirement codes in Delegated Regulation (EU) 2023/2772:

• ESRS E1-6: Scope 1 emissions from stationary/mobile combustion → already in your environmental compliance module.
• ESRS E2-4: Amounts of each pollutant listed in Annex II of the E-PRTR Regulation emitted to air, water and soil, counting only facilities above its thresholds, and microplastics generated or used → your environmental compliance module.
• ESRS E2-5: Substances of concern and substances of very high concern → your chemical management / SDS register.
• ESRS S1-14: Health and safety metrics — recordable work-related accidents and fatalities — straight from your incident system.
• ESRS S1-15: Work-life balance (parental leave) — HR, but cross-checked against time-off in safety-critical roles.
• ESRS G1-1: Mechanisms for reporting and investigating concerns, and how whistleblowers are protected (paragraph 10(a) and (c)) — your anonymous reporting channel's set-up and procedures.

The revised ESRS (Delegated Regulation (EU) 2026/1563, from FY2027) renumber some of these. The greenhouse gas emissions requirement becomes E1-8, health and safety metrics S1-13, work-life balance metrics S1-14 and the characteristics of employees S1-5, while E2-4 and E2-5 keep their numbers; G1-1 now asks whether policies protecting whistleblowers exist. Key every mapping to the version you apply.

Worked example: one set of incident records, two versions

This is a constructed example. In a year, a plant's incident system holds 3 recordable accidents to employees, 2 to agency workers and 1 fatality of a contractor's employee working on site.

The point for QHSE teams: tag each record with employment status and site at entry, so either version can be produced from the same data.

Plan integrations now:

• Map your incident severity scale to ESRS S1-14 categories.
• Tag environmental incidents with the relevant ESRS E2 sub-datapoint.
• Extend your audit module to log ESRS-relevant findings separately.

See our incident management software roundup → and CSRD software guide →.

---

5. Common pitfalls (and how mature teams avoid them)

Pitfall 1 — Treating the DMA as a one-off. ESRS 2 IRO-1 (paragraph 53(h) of Delegated Regulation (EU) 2023/2772) requires you to disclose whether and how the process has changed since the prior reporting period, when it was last modified and the future revision dates of the materiality assessment. In the revised ESRS 2, IRO-1 asks for significant changes to the process since the prior period and when the assessment was last updated (paragraph 35(d) and (e)); future revision dates are no longer listed. Build it as an annual cycle with a quarterly horizon scan, not a consultancy project that ends with a PowerPoint.

Pitfall 2 — Letting finance own Scope 3 alone. Cat. 1 (purchased goods) needs procurement; Cat. 6 (business travel) needs HR; Cat. 11 (use of sold products) needs product management. QHSE often becomes the integrator because they already coordinate cross-functional data.

Pitfall 3 — Using spreadsheets for the disclosure file. Tagging will apply once the Commission adopts the rules on marking up sustainability reporting (see Quick Facts). A tagged iXBRL file built from a spreadsheet is technically possible but operationally fragile. Move to a disclosure-management tool before your second reporting cycle.

Pitfall 4 — Ignoring the value chain because data is hard. For the first three years, the 2023 text accepts incomplete value-chain information only if you explain the efforts made to obtain it, why not all of it could be obtained and your plans to obtain it (ESRS 1, paragraph 132). Silence is not. The reliefs differ between the 2023 and revised texts, so read the version you apply.

Pitfall 5 — Confusing ESRS with the EU Taxonomy. They are separate (see the EU Taxonomy glossary entry). The Taxonomy is about eligibility/alignment of economic activities for green finance; ESRS is the disclosure framework. Whether you report under both depends on your scope, and the two workflows are different.

---

6. A 90-day implementation plan

The plan aims at a draft DMA within one quarter, which fits a normal financial-reporting calendar. It is a planning assumption, not a measured result: the time it takes depends on your data and on how many entities are in scope.

---

7. Readiness checklist: from scope to first sustainability statement

Use this as a working checklist alongside the runway above. It is a practical sequence, not a legal interpretation.

1. Confirm scope in writing. From FY2027, EU undertakings and groups exceeding €450M net turnover and averaging more than 1,000 employees (Directive (EU) 2026/470). The separate third-country route, from FY2028, uses EU net turnover above €450M in each of the last two financial years and an EU subsidiary or branch above €200M net turnover (Directive (EU) 2026/470); the employee threshold does not apply to that route. Record whether you report on a consolidated basis or per legal entity, and list every subsidiary, branch and joint venture. Deliverable: a scoping memo reviewed by legal and group finance.

2. Run the double materiality assessment (section 3, stage 2). You cannot copy a peer's matrix: EFRAG's non-authoritative IG 1 Materiality Assessment Implementation Guidance describes a process with stakeholder engagement, value-chain coverage and quantitative and/or qualitative thresholds. See the double materiality assessment guide.

3. Map each material topic to its datapoints, using the datapoint identifiers in EFRAG's IG 3 list and the ESRS taxonomy as the keys in your data architecture. ESRS 2 applies regardless of materiality.

4. Score data availability per datapoint. An example scale:

   Score	Meaning
   0	Not collected anywhere
   1	Collected, but in spreadsheets without controls
   2	Collected in a system, but not reconciled or audit-ready
   3	Collected, controlled, audit-ready

   Anything at 0 or 1 needs a remediation owner, a deadline and a data-source decision before drafting starts.

5. Build the GHG inventory (E1): Scope 1 by gas and facility; Scope 2 location-based and market-based with the method disclosed; all 15 Scope 3 categories screened, material ones quantified.

6. Prepare own-workforce data (S1): employee head count by gender and, where the country thresholds are met, by country; permanent, temporary and non-guaranteed-hours employees; and the counting method used, such as end-of-period or average (S1-6 in Delegated Regulation (EU) 2023/2772; S1-5 in the revised ESRS in Delegated Regulation (EU) 2026/1563, from FY2027). Reconcile to your HRIS.

7. Plan value-chain engagement (S2–S4) early; these disclosures can apply where you have no direct contract with the people affected.

8. Evidence governance (G1): policies are rarely the gap; evidence that they operate is. Reconcile ethics-line case data, training completion and supplier due-diligence records.

9. Draft the statement in a clearly identifiable section of the management report (Articles 19a and 29a of Directive 2013/34/EU, inserted by Directive (EU) 2022/2464), ESRS 2 first and then each material topical standard, with one source of truth for every number.

10. Run a pre-assurance dry run with the same scope as limited assurance: datapoint completeness against the materiality assessment, a methodology disclosure for every estimate, proxy and emission factor, consistency between narrative and tagged datapoints, and tagging against the taxonomy.

11. Approve and publish through the same governance route as the financial statements: audit committee review, board approval, minuted sign-off.

To track owners and evidence for each requirement, our free ESRS disclosure checklist template lists the ESRS 2, E1, S1 and G1 Disclosure Requirements of both the 2023 and the revised text.

---

8. Evaluation tasks by scenario

• Multi-site operations with fragmented records: trace one incident or environmental record through approval, correction and group reporting. Confirm identifiers and interface ownership before buying another module.
• Carbon-intensive operations: recalculate one material category after a factor or supplier-data change and inspect the retained versions and assurance evidence.
• Voluntary or smaller reporting programmes: test whether one scoped product can cover collection, materiality and disclosure; price the complete workflow before buying separate tools.

Compare ESG reporting scope and use the same sample records in each demo. Use the linked comparison’s published inclusion rule and the same evidence checks for every qualifying product. Sponsored placements are additional and labelled; commercial status does not determine organic eligibility.

Updated 27 September 2026: named vendor prescriptions were replaced with evaluation tasks. Earlier unsupported product recommendations remain withdrawn.

Questions to put to every vendor

This site does not rank vendors on ESRS. The QHSE Software Capability Map 2026 shows which capability statements the researched profiles document, and the security, trial and offline evidence study covers attestations and trials. Then ask each vendor, using your own records:

1. Which ESRS version are the datapoint templates built on, and how are changes between versions handled?
2. Trace one number from the source record to the disclosure, showing who approved each step.
3. Which parts are native, configured, integrated or outside the proposal?
4. What can you export, and in which format, if you leave?

For related guides see double materiality software, the glossary entries on CSRD and Scope 3 emissions, and the Scope 3 guide.

FAQ

Which ESRS version applies to FY2026? For a financial year starting in 2026, undertakings in scope of the 2023 text may apply either version, or the 2023 text with some reliefs, and must state which they used (Article 2 of Delegated Regulation (EU) 2026/1563).

Does my company report at all? It depends on Member State transposition (due 19 March 2027) and, for FY2025 and FY2026, on any exemption a Member State gives Wave 1 companies. Confirm your position with legal advice.

9. Bottom line

ESRS is not "GRI plus tagging". It is a structural change in how sustainability data is governed, evidenced and assured. In our view, three decisions do most to keep the work manageable:

1. Run a defensible double materiality assessment now.
2. Treat their existing QHSE platform as the backbone, not a silo.
3. Pick a disclosure-management tool before their second cycle.

Get those three decisions right and ESRS becomes a manageable annual rhythm rather than a recurring crisis.

Need a structured shortlist of ESG/EHS platforms that map to ESRS datapoints? Take the three-question Get Matched quiz for up to five profiles matched on your priority, industry and team-size tags. Confirm ESRS datapoint coverage and your reporting wave with each vendor.

What we could not verify

Checked 21 October 2026.

• Where the legal texts were read. EUR-Lex still redirected every request to its page of the day's Official Journal, so the published texts of Delegated Regulations (EU) 2023/2772 and 2026/1563 (including Articles 2 and 3 of the latter) and Directives (EU) 2025/794 and 2026/470 were opened through the EU Publications Office (publications.europa.eu). The references above match them.
• National law. The thresholds, the Wave 1 exemption, the tagging relief, the 19 March 2027 transposition date and the 1 July 2027 deadline for assurance standards are as the Directives state them. We have not checked how any Member State has transposed them or whether it used the Wave 1 exemption.
• Datapoint counts. EFRAG's 161, 622 and 269 count the 2023 text. We found no official list or count of the datapoints in the revised text. The 61% figure describes EFRAG's draft and comes from the Commission's explanatory memorandum, which is not part of the published act; we read it in the Council's copy of C(2026) 5010 (document 11667/26).
• Our planning figures. The quarters in the runway, the 90-day plan and the 0 to 3 data-availability scale are our own planning aids. We found no source that says how long a first assessment or a first statement takes.
• Assurance practice. Until EU limited assurance standards exist, no source we read says which standard a provider will apply or what it will examine first.

Updated 21 October 2026: the ESRS references and the CSRD scope and dates were checked in the Official Journal texts; the value-chain duty in stage 1 now cites ESRS 1 paragraphs 63 and 69, the revised IRO-1 wording and the revised S1-13 treatment of agency workers were checked and added, the transitional value-chain relief now follows paragraph 132, and unsourced statements about over-buying, weeks saved, the share of companies reporting under the Taxonomy and the speed of a first assessment were reworded or removed.

Corrected 23 September 2026: claims about named vendors that no source we could check supported were removed or reworded to match each product's researched profile.

Corrected 23 September 2026: the CSRD scope, reporting dates and assurance level now follow Directives (EU) 2025/794 and 2026/470, the ESRS status now reflects Delegated Regulation (EU) 2026/1563, the rules on omitting datapoints, the Disclosure Requirement codes in section 4 and the materiality-review disclosure now follow Delegated Regulation (EU) 2023/2772, unsourced datapoint counts were replaced with those in EFRAG IG 3, a broken link was fixed, and the stale promise of a delta note and the "field-tested" description were removed.

Updated 24 September 2026: merged the sourced sections of CSRD Readiness Checklist 2026: 12 Steps from Gap Analysis to First Disclosure.

Reviewed 4 October 2026: Wave 1 exemption, tagging and assurance statements corrected; two unsupported figures removed; revised ESRS codes, a worked example, vendor questions and an FAQ added.