EU sustainability regulation in 2026: an overview of what is now in force

This article is for informational purposes only and does not constitute legal advice. Consult a qualified legal professional for advice specific to your situation.

Why this matters if you are not based in the EU

The most common misconception about EU sustainability regulation is that it applies only to EU companies. It does not.

A manufacturer in Indonesia supplying palm oil to a European food company now needs to prove that the land used to produce that commodity was not deforested after December 2020. A steel manufacturer in Turkey exporting to EU buyers faces carbon pricing obligations that did not exist two years ago. A Vietnamese textile supplier whose EU customer is subject to the Corporate Sustainability Reporting Directive will receive questionnaires about its environmental and social practices because that customer is legally required to report on its supply chain.

The EU’s sustainability regulations reach beyond EU borders through three mechanisms: import requirements that apply at the EU customs border, supply chain due diligence obligations that flow from EU buyers to their non-EU suppliers, and disclosure requirements that include data about non-EU operations and supply chains.

If your business touches EU markets in any way, at least one of the regulations described in this article is likely to affect you. This article maps the landscape, explains what each framework requires, and identifies the key deadlines.

The regulatory frameworks

CSRD: Corporate Sustainability Reporting Directive

What it is: The CSRD (Directive (EU) 2022/2464) requires companies to report on their environmental, social, and governance impacts in a standardised way. The detailed reporting requirements are set out in the European Sustainability Reporting Standards (ESRS), developed by the European Financial Reporting Advisory Group (EFRAG) and adopted by the Commission.

Who it affects: The CSRD has a phased rollout by company size.

Large EU public-interest entities with more than 500 employees were already reporting under the predecessor Non-Financial Reporting Directive and began CSRD reporting for their 2024 financial year. Large EU companies (those meeting two of three criteria: more than 250 employees, more than €40 million turnover, more than €20 million balance sheet) begin reporting for their 2025 financial year, with first reports due in 2026. Listed SMEs begin reporting for their 2026 financial year, with first reports due in 2027, though they may opt out until 2028.

Non-EU companies are in scope if they have significant EU operations: specifically, companies with net turnover above €150 million generated in the EU for two consecutive years, with at least one EU subsidiary or branch meeting certain thresholds.

Why it matters beyond the directly in-scope companies: The ESRS requires in-scope companies to report on their entire value chain, including upstream suppliers. A company subject to CSRD must disclose material sustainability impacts in its supply chain, which in practice means collecting data from suppliers who are not themselves subject to CSRD. Non-EU suppliers will receive requests for this data from their EU buyers. Those requests are not optional if the buyer needs the information to meet its own legal obligations.

Key deadlines: First reports for large companies with 500+ employees were due in 2025 (covering the 2024 year). First reports for other large companies are due in 2026 (covering the 2025 year).

ESRS: European Sustainability Reporting Standards

What they are: The ESRS are the detailed reporting standards that specify exactly what must be disclosed under CSRD. They cover twelve topical standards across environmental, social, and governance categories, plus two cross-cutting standards on general requirements and general disclosures.

The environmental standards cover climate change (ESRS E1), pollution (E2), water and marine resources (E3), biodiversity (E4), and resource use and circular economy (E5). The social standards cover the company’s own workforce (S1), workers in the value chain (S2), affected communities (S3), and consumers and end-users (S4). The governance standard covers business conduct (G1).

How they work in practice: Not all standards apply to all companies with the same intensity. The ESRS uses a double materiality assessment to determine which disclosures are required: a company must report on topics that are material either because they affect the company’s financial performance (financial materiality) or because the company has significant impacts on people or the environment (impact materiality). A company with a long agricultural supply chain has different materiality outcomes from one that is purely digital.

The double materiality assessment is itself a disclosure requirement, not just an internal exercise. Companies must disclose the process they used and the conclusions they reached.

EUDR: EU Deforestation Regulation

What it is: The EU Deforestation Regulation (Regulation (EU) 2023/1115) prohibits the placing on the EU market, or export from the EU, of specific commodities and products if they are associated with deforestation or forest degradation that occurred after 31 December 2020.

Which commodities are in scope: Cattle, cocoa, coffee, palm oil, soya, wood, and rubber, plus a range of derived products (leather goods, chocolate, furniture, tyres, and others). The regulation covers any product made from or containing these commodities.

Who it affects: EU operators (companies that place products on the EU market for the first time or export them) and EU traders (companies that make products available on the market in the course of a commercial activity) are the directly regulated parties. However, they can only comply if their non-EU suppliers provide the necessary documentation: geolocation data for the land where commodities were produced, evidence that production occurred before December 2020 if relevant, and a due diligence statement confirming the operator has assessed and mitigated deforestation risk.

Non-EU suppliers who cannot provide this documentation will find their EU customers unable to place their products on the EU market. The commercial consequence is loss of EU market access.

The due diligence statement: Before placing a product on the EU market, an operator must submit a due diligence statement via the EU’s TRACES NT system. The statement confirms that the operator has collected the required information, carried out a risk assessment, and taken risk mitigation measures where needed. The underlying documentation must be kept for five years.

Key deadlines: The regulation entered into force in June 2023. After a delay to the original timeline, large operators and traders face obligations from 30 December 2025. SME operators and traders have until 30 June 2026. The benchmarking system that classifies countries by deforestation risk is expected to be operational ahead of these dates and will affect how much documentation is required depending on the country of origin.

CBAM: Carbon Border Adjustment Mechanism

What it is: CBAM (Regulation (EU) 2023/956) puts a carbon price on imports of certain goods into the EU, equivalent to the price that EU producers pay under the EU Emissions Trading System (ETS). Its purpose is to prevent carbon leakage, where EU production moves to countries with weaker emissions rules, and to level the playing field between EU and non-EU producers.

Which sectors are in scope: Steel and iron, cement, aluminium, fertilisers, electricity, and hydrogen. These are the sectors identified as most exposed to carbon leakage risk under the current EU ETS framework.

How it works: During the transitional period (which ran from October 2023 to December 2025), EU importers were required to register and submit quarterly reports on the embedded carbon content of their imports. No financial payment was required during this phase. From January 2026, the definitive phase begins: importers must purchase CBAM certificates corresponding to the carbon price that would have been paid had the goods been produced in the EU. The number of certificates required is based on the embedded carbon in the goods and the carbon price already paid in the country of production.

What non-EU exporters need to do: To avoid overpaying for CBAM certificates, non-EU producers should be able to document the actual embedded carbon in their production processes. If the carbon intensity is lower than EU benchmarks, the importer pays less. If carbon pricing is already applied in the country of production, that can be deducted from the CBAM obligation. This creates a direct incentive for non-EU manufacturers to measure and disclose their emissions data.

Key deadlines: Transitional reporting ended December 2025. The definitive phase with certificate purchase obligations began January 2026.

CSDDD: Corporate Sustainability Due Diligence Directive

What it is: The CSDDD (Directive (EU) 2024/1760) requires large EU companies to identify, prevent, mitigate, and account for actual and potential adverse human rights and environmental impacts in their own operations and those of their upstream business partners.

Who it affects directly: The directive applies in phases based on company size. Companies with more than 5,000 employees and €1.5 billion worldwide turnover must comply from 2027. Companies with more than 1,000 employees and €450 million turnover must comply from 2028. A third phase covering smaller companies may be introduced later.

Why it matters for non-EU suppliers: Due diligence under CSDDD means EU companies must map their supply chains, identify risk hotspots, conduct risk assessments, take preventive and corrective actions, and establish a complaints procedure. In practice, this means large EU buyers will require their suppliers to provide information about their human rights and environmental practices, and may require suppliers to implement specific measures as a condition of the commercial relationship.

A non-EU supplier that cannot demonstrate adequate practices risks being dropped from the supply chain of a CSDDD-obligated EU buyer, regardless of the quality or price of their product.

The difference from CSRD: CSRD is primarily a reporting obligation. CSDDD is an operational due diligence obligation. Companies subject to CSDDD must actually conduct due diligence, not merely report on it. The distinction matters practically: CSRD requires disclosure of what a company does; CSDDD requires that a company does specific things.

Key deadlines: Member states must transpose the directive into national law by July 2026. Application begins in 2027 for the largest companies.

SFDR: Sustainable Finance Disclosure Regulation

What it is: SFDR (Regulation (EU) 2019/2088) requires fund managers and other financial market participants to classify their financial products by sustainability characteristics and disclose how those characteristics are achieved.

Who it affects: Asset managers, investment firms, banks offering investment products, and insurance companies operating in or marketing to EU investors. Non-EU fund managers accessing EU capital markets are also in scope.

The classification system: Financial products are classified as Article 6 (no sustainability focus), Article 8 (promoting environmental or social characteristics), or Article 9 (sustainable investment as the objective). Each classification carries specific pre-contractual, website, and periodic disclosure obligations.

The incoming revision: The Commission published a proposal to overhaul SFDR in November 2025. The current Article 6, 8, and 9 classification system would be replaced by three new categories: Transition, Sustainable, and ESG Basics. The revised framework is expected to apply from approximately 2028. Current obligations remain fully in force in the meantime.

A detailed guide to SFDR obligations, classification criteria, and the proposed revision is available here: SFDR explained: sustainable finance disclosure for fund managers.

EU Taxonomy

What it is: The EU Taxonomy Regulation (Regulation (EU) 2020/852) establishes a classification system for environmentally sustainable economic activities. It defines what counts as a sustainable investment for the purposes of disclosure under SFDR and CSRD, and creates a common language for sustainable finance across the EU.

How it works: An economic activity is Taxonomy-aligned if it makes a substantial contribution to at least one of six environmental objectives (climate change mitigation, climate change adaptation, sustainable use of water, circular economy, pollution prevention, and protection of biodiversity), does no significant harm to any of the other five objectives, and meets minimum social safeguards.

Who it affects: Financial market participants subject to SFDR must disclose the extent to which their products invest in Taxonomy-aligned activities. Companies subject to CSRD must disclose what proportion of their revenue, capital expenditure, and operating expenditure is Taxonomy-aligned. Non-financial companies are increasingly asked about Taxonomy alignment by their EU investors and lenders, even if they are not directly subject to CSRD.

The practical challenge: Taxonomy alignment requires detailed data about the environmental performance of economic activities. The delegated acts specifying the technical screening criteria for each objective and each sector are extensive and technically demanding. For most companies, determining Taxonomy alignment requires significant analytical work, and in some sectors the criteria are still being developed or revised.

How the regulations interact

These frameworks are not independent. They interact in ways that create compound obligations for companies caught by more than one.

A large EU manufacturing company is likely subject to both CSRD and CSDDD. CSRD requires it to report on value chain impacts; CSDDD requires it to conduct due diligence on those impacts and take action. The reporting and the action must be consistent.

A fund manager investing in EU companies is subject to SFDR for product classification and CSRD for entity-level disclosures if it meets the size threshold. Its investee companies may be subject to CSRD themselves, which in theory should improve the quality of sustainability data available for SFDR reporting, but only as CSRD reporting matures over time.

EUDR and CSDDD overlap for companies dealing in commodities associated with deforestation risk. EUDR sets specific documentary requirements for those commodities. CSDDD requires broader human rights and environmental due diligence across the supply chain. A company subject to both must satisfy both sets of requirements, which may require separate data collection and documentation processes.

The EU Taxonomy underlies both SFDR and CSRD: what counts as a sustainable investment or a sustainable economic activity is defined by the Taxonomy, which means Taxonomy alignment assessment is a shared requirement across multiple frameworks.

What to do with this information

The first step is determining which regulations apply to your situation: where your company is based, what it produces or sells, whether it touches EU markets or EU buyers, its size, and the nature of its financial products or financing arrangements.

Some regulations apply directly. Others apply to your EU customers and flow to you through the commercial relationship as data requests, contractual requirements, or conditions of continued supply. Both require action, but different kinds.

If you are directly regulated: understand the specific requirements, assess your current position, and address the gaps. If you are in the supply chain of a regulated EU buyer: understand what they will be required to ask you for, and be in a position to provide it.

The deadlines are not hypothetical. EUDR has enforcement consequences from December 2025. CBAM certificate obligations began January 2026. CSRD reports are being filed now by large companies, which means supply chain data requests are already arriving at non-EU suppliers.

The articles in this series cover each regulation in detail. Start with the one most immediately relevant to your situation.

This is the hub article for the Verdandi EU sustainability regulation series. Individual regulation guides will be added to this series as they are published.