CSRD Penalties and Enforcement: Who Actually Checks Your Sustainability Statement - and What Happens If It's Wrong

There is no such thing as a CSRD fine.

That sounds like good news, and it is the first thing people are told when they ask about enforcement. It is also the single most misleading fact about the regime. The Directive creates a harmonised reporting obligation and a completely unharmonised set of consequences. Brussels wrote the requirement. Twenty-seven national legislatures wrote the punishment, and they did not coordinate.

Most compliance programmes are calibrated to the Directive. The thing that will actually be applied to you is a national statute, enforced by a national authority, with a penalty ceiling and a liability model that nobody in your project team has read.

The mental model: CSRD inherited someone else's enforcement machinery

The most useful thing to understand about CSRD enforcement is that very little of it was built new.

CSRD operates by amending the Accounting Directive and the Transparency Directive. The sustainability statement is not a free-standing document with its own supervisory regime; it sits inside the management report. So in most member states, sustainability reporting inherited the enforcement apparatus that already existed for financial reporting: the same regulator, the same filing-default procedures, the same publicity sanctions, the same escalation paths.

This explains a fact that otherwise looks arbitrary. Why is the supervisor different depending on the company? Because financial reporting supervision was already split that way. Listed issuers typically fall to the securities regulator, which was already reviewing their annual financial reports. Unlisted companies typically fall to whichever body handles commercial register filings and filing defaults. CSRD did not invent a new split; it walked into an existing one.

The practical consequence for a group is that different entities in your structure may answer to different authorities under different national laws, and the group has probably never mapped this.

The escalation ladder

Across member states, the instruments available to an authority form a rough sequence. Not every jurisdiction has all of them, and the labels differ, but the shape is consistent.

Assurance-level friction. Before any regulator is involved, the assurance provider can modify or qualify its conclusion. This is not a penalty, but it is the first public signal that something is wrong, and it is the trigger that draws regulatory attention.

Supervisory review and information requests. The authority examines the statement and asks questions. Most enforcement never gets past this stage, and this is where good documentation pays for itself.

Public statements. Several regimes allow the regulator to publish a finding. For many companies this is the sanction that actually bites, well before any monetary amount.

Orders to correct and republish. A requirement to restate and refile. Expensive, disruptive, and highly visible.

Administrative fines. Either fixed-amount or turnover-linked. Several member states have set turnover-linked ceilings for the most serious breaches, meaning persistent failure to report or material misstatement. Reported figures suggest ceilings in the region of EUR 10 million or 2% of group turnover in Germany, with securities-regulator supervision for listed companies, and administrative fines with separate individual-level exposure in France. Treat those numbers as indicative reporting rather than settled law, and verify the current position in each jurisdiction, because several regimes are still being finalised.

Personal liability and disqualification. Some regimes attach consequences to directors individually, not only to the company.

Criminal exposure. In a minority of jurisdictions, knowingly false statements can attract criminal liability under pre-existing accounting-fraud provisions.

The Directive's own requirement is only that penalties be effective, proportionate and dissuasive. Everything above is national choice.

The three failure modes, and why you are probably defending the wrong one

Nearly all sustainability reporting effort goes into getting the numbers right. That defends against the third failure mode and does almost nothing for the first two, which are more likely to be detected and more mechanically penalised.

Failure mode one: not filing, or filing late. This is trivially detectable. It requires no expertise, no review, and no judgement from the regulator, just a calendar. In the inherited financial-reporting machinery, filing defaults are the most routinely and automatically sanctioned category of all. A perfect statement filed after the deadline is in worse shape than an imperfect one filed on time.

Failure mode two: incompleteness. A disclosure requirement omitted, or a topic left out without adequate justification. Because ESRS permits omission of topics screened out by double materiality, the question a regulator asks is not "why is this missing" but "show me why you concluded it was not material". If the answer is a spreadsheet nobody can explain, the omission looks like a gap rather than a judgement.

Failure mode three: misstatement. A number or narrative that is wrong. This is the one everyone worries about, and it is the hardest for a regulator to establish.

The allocation of effort in most programmes is roughly the inverse of the risk.

Your double materiality assessment is the audit trail

This follows directly from failure mode two, and it deserves stating plainly.

The ESRS architecture is permissive by design: you disclose what is material and you may omit what is not. That permissiveness is only defensible if the assessment behind it is documented. The DMA record, meaning the process followed, thresholds applied, stakeholder input gathered, evidence considered and sign-off obtained, is the primary evidence that every omission in your statement was a reasoned conclusion.

Companies tend to treat the DMA as a project deliverable that produces a topic list, then archive the working papers. The topic list is the output. The working papers are the defence.

Limited assurance and regulatory review do different jobs

Assurance under CSRD is permanently at the limited level following the Omnibus. Limited assurance produces a conclusion in negative form: nothing came to the practitioner's attention suggesting the statement is materially misstated. The procedures are narrower than reasonable assurance, and they are designed to be.

It follows that a regulator reviewing your statement is applying a different filter from the one your assurance provider applied. A clean limited assurance conclusion is not a finding that the statement is correct, and it does not foreclose regulatory challenge. Teams that treat sign-off as the end of exposure have misread what they bought.

The transposition gap, with Germany as the worked example

Several member states have not completed transposition. Germany is the instructive case: it missed the original July 2024 deadline, the Commission opened infringement proceedings, a public hearing on the implementing legislation took place on 10 April 2026, and entry into force is expected during 2026.

This produces the question companies actually ask: what is my exposure while my member state has not transposed?

The general principle is that a directive does not, by itself, impose obligations on private parties. Where the national implementing law does not yet exist, the administrative-penalty route is generally not available against a company, because there is no national provision to breach. That is not the same as no exposure. In the interim, the live risks are contractual, where credit agreements or sustainability-linked instruments contain reporting representations; assurance-related, where a provider will not sign; and reputational. There is also the possibility of retroactive application to prior financial years depending on how the national law is drafted.

This is a point on which to take national legal advice rather than a general rule, and it is worth asking specifically what the implementing law says about which financial year it first applies to.

Timing: where enforcement actually is

Wave 1 companies filed FY2024 sustainability statements during 2025, and national regulators have been reviewing them. First formal enforcement actions were anticipated during 2026. As of mid-2026, no EU-level CSRD penalty had been imposed, and sanctions remained entirely national.

Resist the temptation to read that as quiet. Regulatory review cycles for annual reporting run long, findings are often resolved privately, and the first public actions in a new regime typically arrive well after the reviews that produced them.

The exposure nobody budgets for

The administrative fine is frequently not the largest number in the room.

Securities-law liability. For listed issuers, where the sustainability statement forms part of regulated information, the general prospectus and market-abuse liability framework may attach to statements in it.

Consumer and unfair-competition claims. Where statements from the sustainability report are repeated in marketing, they become subject to consumer law. This exposure increases materially from 27 September 2026, when the Empowering Consumers for the Green Transition Directive begins to apply.

Contractual representations. Credit agreements, sustainability-linked bonds and loans, and large customer contracts increasingly contain reporting covenants and ESG representations. Breach consequences here can be faster and more expensive than any regulator.

NGO and competitor litigation. A published, assured, machine-readable sustainability statement is an unusually good evidentiary starting point for a claimant.

None of this is a reason for alarm, but it does explain why "what is the maximum fine" is the wrong framing question.

What actually reduces exposure

Map the jurisdictions. For each reporting entity in the group: which national law applies, which authority supervises, what the filing deadline is, and what the penalty framework looks like. Most groups have not done this exercise, and it is the highest-value thing on the list.

File on time, even if imperfect. The most predictably penalised failure is the easiest one to avoid.

Document the double materiality assessment as a defence file, not a deliverable.

Maintain internal controls over sustainability reporting so that every number is reproducible from source. Reproducibility is what turns a challenge into a conversation.

Align external communications with the statement. Marketing, investor decks and the website should not assert anything the sustainability statement does not support. Inconsistency is how most problems are discovered.

Keep a restatement policy. Errors will happen. A pre-agreed process for correcting them turns a crisis into a procedure, and regulators respond very differently to a company that self-corrects.

---

This article is general information for reporting, legal and compliance teams. It is not legal advice. CSRD penalty regimes are national, several member states had not completed transposition at the time of writing, and figures cited from secondary sources should be verified against the applicable national law. Confirm the position for each jurisdiction in which a group entity files.