For eighteen months, the message reaching boardrooms in New York, London, Zurich and Singapore has been reassuringly simple: the Omnibus package gutted CSRD, our European subsidiaries fell out of scope, file closed. For the EU entities, broadly true. What it missed is that the obligation did not disappear — it moved up the corporate structure, to the non-EU parent.
On 23 July 2026, EFRAG published the Exposure Draft of ESRS-40a — the sustainability reporting standard for certain non-EU undertakings — and opened a 100-day consultation running to 31 October 2026. It implements Article 40a of the Accounting Directive, and applies a test with nothing to do with how many people you employ in Europe. If your group sells enough into the EU, you report.
What ESRS-40a actually is
Articles 19a and 29a of the Accounting Directive catch EU companies and EU-parented groups. Article 40a is the extraterritorial arm: it catches groups headquartered outside the EU that do significant business inside it. ESRS-40a is the standard telling them what to disclose, and the logic is a level playing field — a US or Japanese group booking hundreds of millions in EU revenue competes with EU companies carrying a full ESRS burden.
The scope test: run it before you do anything else
The threshold is two-part, and both parts must be met. A third-country undertaking not listed on an EU regulated market is in scope if it meets:
- Turnover test. Net turnover in the Union above €450 million in each of the last two consecutive financial years; and
- Presence test. Either an EU branch with net turnover above €200 million in the preceding financial year, or it is the ultimate parent of EU subsidiaries with net turnover above €200 million in the preceding financial year.
These behave differently from the tests your European finance team has been applying: no employee headcount criterion, no balance-sheet criterion. It is a revenue test measured at group level on turnover booked in the Union — so a group with modest European operations and a lean legal footprint can still clear the bar on distribution revenue alone.
Who actually publishes the report
The parent is the reporting undertaking, but it does not file. The report is published on the parent’s behalf by an EU subsidiary that would itself fall within CSRD scope, or by a large EU branch. That puts a European entity — often one with no sustainability function of its own — on the hook for making a group-level disclosure public. Flag it early to your European legal and finance leads: the people who sign and file are rarely the people who produce the data.
What you report — and, importantly, what you don’t
ESRS-40a is deliberately lighter than a full ESRS sustainability statement. The Article 40a report focuses on impacts — the effects of the group’s activities on people and the environment. It generally excludes the risk-and-opportunity architecture Articles 19a and 29a demand: resilience analysis, dependencies, and the financial-materiality half of double materiality sit outside its content.
For teams that have watched EU peers build scenario analysis and transition plans, that is good news. But narrower is not easier — the hard part of ESRS-40a is not the disclosure list. It is the boundary.
The “mixed approach” is the fight that decides your cost
This is the detail that deserves attention during the consultation window. The draft requires a blend of EU-scoped and global-scoped information — some disclosures drawn from the group’s European activities, others from the group as a whole.
EFRAG’s own Sustainability Reporting Board did not approve this comfortably. It released the Exposure Draft while recording reservations about the mixed approach, and Chair Kerstin Lopatta published a letter setting out those concerns before launch, noting the approach reflects a request from the European Commission. The objection is practical as much as legal: separating EU-related impacts from global ones is difficult, and in places arbitrary.
For a reporting team, that is not standard-setting politics — it is the single biggest driver of your data-collection cost. A global-scope disclosure can usually be sourced from systems you already run. An EU-scope disclosure means carving European activity out of consolidated data — by site, by entity, by supplier — for metrics your systems were never designed to slice that way. Every requirement landing on the EU-scoped side adds a pipeline you do not have.
Which is why the consultation matters. Feedback closes 31 October 2026 and EFRAG’s technical advice goes to the Commission in January 2027. After that, the boundary question is settled and you are implementing someone else’s answer.
The timeline looks distant. It isn’t.
Reporting becomes mandatory for financial years beginning on or after 1 January 2028, with first reports published in 2029. Three years is comfortable — right up until you work backwards.
- 2029 — first report published.
- FY2028 — the reporting year. Data must be complete, consistent and evidenced across twelve months, from day one.
- FY2027 — the dry run: find the gaps in EU-scoped data and fix them. Anyone through a first ESRS cycle knows this year is not optional.
- 2026–2027 — scoping, system selection, and getting European entities collecting data in a form that consolidates.
That leaves roughly eighteen months of genuine slack, not three years — landing on organisations that spent the last year actively de-resourcing European sustainability compliance.
Why the scope cut makes this more exposing, not less
EFRAG has estimated that the Omnibus changes cut the number of non-EU companies in scope from roughly 10,000 to around 1,200 — a 90% reduction, reported as relief. Consider it from the other direction: the remaining population is small, large and identifiable. Any regulator, NGO or journalist can assemble a credible list of who should be reporting and check whether they did. In a group of 10,000, a thin disclosure is noise. In a group of 1,200, it is a story.
This is the same pattern we described when the SEC’s climate rollback failed to free US multinationals: deregulation in one jurisdiction rarely reduces total disclosure obligation for a global group. It relocates it.
What to do before 31 October
- Run the test properly. Get an accurate group-level figure for net turnover in the Union for the last two financial years. Not EU-entity revenue — turnover generated in the Union, which can include sales routed through non-EU entities.
- Identify the filer. Determine which EU subsidiary or branch would carry the publication obligation, and tell them now.
- Respond to the consultation. If you are in scope, the mixed approach will shape your cost base for a decade. This is the last practical window to influence it.
- Map EU-scoped data. Take a first pass at which impact metrics you could already report at EU boundary and which need new collection. That gap list is your 2027 project plan.
- Do not rebuild in a silo. Much of what ESRS-40a asks for overlaps with what you already produce for CDP, ISSB-aligned reporting, or an EU subsidiary’s own CSRD timeline. One data layer with multiple outputs beats a separate European reporting exercise.
One honest caveat: ESRS-40a is a draft, its content will change before the Commission’s delegated act, and the mixed approach may not survive in its current form. What will not change is the scope test and the FY2028 start date — those sit in the Directive, not the standard. You can wait on the detail. You cannot wait on knowing whether you are in.
If your group clears the €450 million test, the work starts with knowing what you can already produce at EU boundary. Horizon ESG helps multinational teams collect sustainability data once and report it against multiple frameworks — so a new obligation becomes a mapping exercise, not a new programme. Book a free demo.
Leave a Reply