CSRD in Austria: Implementation Guide for Auditors

From NaDiVeG to NaBeG: what actually changed

Austria missed the July 2024 CSRD transposition deadline by 19 months. The NaBeG (Nachhaltigkeitsberichtsgesetz, or Sustainability Reporting Act) was passed by the National Council on 21 January 2026 and entered into force on 19 February 2026. That delay created a grey zone for Wave 1 companies: entities that the CSRD required to report on FY 2024 had no domestic legal basis until February 2026. If your client’s balance sheet date for FY 2025 falls after 19 February, NaBeG reporting is mandatory. If it fell before, voluntary application was the only option.

The NaDiVeG (Nachhaltigkeits- und Diversitätsverbesserungsgesetz) has been in force since 2017, implementing the NFRD in Austria. Under the NaDiVeG, large public-interest entities with more than 500 employees were required to include a non-financial statement in their management report (Lagebericht), covering environmental, social, employee, human rights, and anti-corruption matters. The NaDiVeG prescribed no specific reporting standard. Companies used GRI, the Austrian Sustainability and Diversity Improvement Act’s own requirements, or ad hoc formats. No external assurance was required.

The NaBeG changes all of that. Sustainability information must now follow the European Sustainability Reporting Standards (ESRS). Reporting is integrated into the management report, not a standalone document. External limited assurance is mandatory. The double materiality assessment becomes the foundation of the report. And the scope expands beyond PIEs to include all large companies meeting the revised thresholds.

For auditors who worked with NaDiVeG clients, the transition is significant. Under the old regime, the non-financial statement was often a relatively brief section of the annual report, prepared with minimal auditor involvement. Under the NaBeG, the sustainability statement is comparable in rigour to the financial statements, requires paragraph-level ESRS compliance, and must survive an assurance engagement. The work volume for both the reporting entity and the auditor increases substantially.

The NaBeG also aligns Austria with the EU Taxonomy Regulation requirements. Wave 1 companies must include Article 8 Taxonomy disclosures in their sustainability statements, reporting on the proportion of their activities that qualify as environmentally sustainable under the Taxonomy’s technical screening criteria. This was already partially required under the NaDiVeG for certain PIEs, but the NaBeG formalises the obligation and links it to the ESRS reporting framework.

Who is in scope and when (post-Omnibus I)

The NaBeG transposes the CSRD in stages, following the EU’s wave structure. But the interaction between the NaBeG and Omnibus I creates a complex transitional picture.

Wave 1 covers large PIEs previously subject to the NaDiVeG. These entities were required to produce CSRD-compliant sustainability reports for financial years beginning on or after 1 January 2024. In Austria, this affects approximately 120 companies. Because the NaBeG entered into force on 19 February 2026, the transitional provisions are important: if an entity’s FY 2025 balance sheet date fell before 19 February 2026, it had no NaBeG obligation for that year (though it could voluntarily adopt CSRD reporting, and the NaDiVeG requirements remained applicable). For calendar-year entities, the NaBeG obligation first applies to the FY 2026 financial year (reported in 2027), unless they voluntarily adopted it earlier for FY 2024 or FY 2025.

Omnibus I allows member states to exempt Wave 1 entities that fall below the revised thresholds (1,000 employees, €450 million net turnover) from reporting for FY 2025 and FY 2026. The NaBeG includes this exemption. Companies previously in scope under the NaDiVeG but below the new Omnibus I thresholds are not required to report under the NaBeG for those years, though they may voluntarily opt in.

Wave 2, covering large non-listed companies meeting the revised thresholds, is not yet addressed by the NaBeG. The Austrian legislator explicitly stated that a separate legislative package will cover this group. Based on Omnibus I timelines, Wave 2 companies will likely report for FY 2027 (published in 2028). For Austrian audit firms, this means the legislation governing Wave 2 assurance engagements hasn’t been enacted yet. Planning is based on the directive and Omnibus I rather than domestic law.

Listed SMEs are removed from mandatory scope by Omnibus I. They may voluntarily report under the VSME standard once adopted (expected June 2026). Non-EU parent companies with qualifying Austrian subsidiaries or branches report from 2029 onward.

The simplified ESRS, which EFRAG published in draft in July 2025 (reducing mandatory datapoints by approximately 61%), are expected to be formally adopted by the European Commission by September 2026. These may be applied voluntarily for FY 2026 reports and will become mandatory from FY 2027 onward.

The grey zone: FY 2024 and FY 2025 reporting obligations

Austria’s late transposition created practical ambiguity that auditors need to understand. The CSRD required Wave 1 entities to report for financial years beginning on or after 1 January 2024. Austria had no domestic legislation implementing this obligation until 19 February 2026. During that gap, entities operated under the NaDiVeG (which required non-financial reporting but not under ESRS and not with mandatory assurance).

For FY 2024, many Austrian Wave 1 companies chose to prepare their reports under the NaDiVeG while voluntarily incorporating ESRS elements. Some prepared full CSRD-compliant reports on a voluntary basis. The FMA (Austria’s financial market supervisor) encouraged early adoption but couldn’t enforce CSRD requirements without a domestic legal basis.

For FY 2025, the picture depends on the balance sheet date. Calendar-year entities (31 December 2025 balance sheet date) were not subject to the NaBeG for FY 2025 because their balance sheet date fell before the law entered into force. They will first report under the NaBeG for FY 2026. Non-calendar-year entities with balance sheet dates after 19 February 2026 (for example, a 31 March 2026 year-end covering the April 2025 to March 2026 financial year) may already be caught by the NaBeG for their current financial year.

This creates an asymmetry. Two Austrian companies of identical size, both Wave 1 PIEs, may have different first NaBeG reporting years depending solely on their balance sheet date. Auditors must verify each client’s specific situation.

The practical advice: for any Austrian Wave 1 client, confirm the balance sheet date, determine whether the NaBeG applies to the current financial year, and if it doesn’t, clarify whether the entity is voluntarily reporting under CSRD/ESRS or continuing under the NaDiVeG for one more cycle.

Assurance requirements under Austrian law

Under the NaBeG, sustainability reporting is subject to mandatory external limited assurance. The assurance must be performed by a Wirtschaftsprüfer (statutory auditor). Austria follows the CSRD’s default position: the statutory auditor performing the financial statement audit also provides the sustainability assurance. Austrian law does not currently permit an Independent Assurance Service Provider (IASP) to perform CSRD assurance.

The FMA supervises assurance quality for PIE audit firms. The KSW (Kammer der Steuerberater und Wirtschaftsprüfer) oversees non-PIE auditors and provides guidance on CSRD implementation. For the Wave 2 engagements expected from FY 2027 onward, auditors outside the Big 4 will increasingly be involved, and KSW oversight will be the relevant quality framework.

Until the EU adopts harmonised limited assurance standards (due 1 July 2027 under Omnibus I), Austrian auditors work with ISSA 5000 and the CEAOB’s September 2024 guidelines. The NaBeG does not reference a specific interim assurance standard, leaving practitioners to apply the best available international framework. The FMA has not issued Austria-specific guidance on limited assurance methodology, though the KSW offers workshops and practical toolkits for member firms.

One area that Austrian auditors frequently underestimate is the documentation requirement. The NaBeG requires the sustainability statement to be part of the management report (Lagebericht). The assurance report accompanies this. Austrian document retention rules require all supporting documentation to be kept for at least seven years. For a first-year engagement where processes are being established and estimation methods are being tested, the documentation burden is heavier than for a mature financial audit file.

The requirement to move from limited assurance to reasonable assurance by 2028 has been deleted by Omnibus I. Limited assurance remains the ceiling for the foreseeable future. This is relevant for Austrian firms planning their investment in CSRD capability: the methodological demands of limited assurance are lower than reasonable assurance, which makes the investment decision more proportionate.

The Austrian market: Wirtschaftsprüfer capacity and the Mittelstand

Austria’s audit market is structured differently from Ireland or the Netherlands. Outside the Big 4 (which dominate PIE audits), the market includes a significant number of mid-tier Wirtschaftsprüfer firms serving the Mittelstand (medium-sized industrial companies). Many of these firms have audit clients that exceed the Omnibus I thresholds. The Austrian Mittelstand includes manufacturers, construction firms, logistics companies, and specialised industrial groups with 1,000–5,000 employees and €400–900 million in revenue. Several dozen of these entities will fall under Wave 2.

For mid-tier Austrian firms, CSRD assurance represents both an opportunity and a resource challenge. The opportunity is that these clients are unlikely to switch to Big 4 firms solely for sustainability assurance, particularly if the existing auditor can credibly offer the service. The challenge is building the team competence and methodology in a compressed timeline. Wave 2 legislation could be enacted by late 2026 or early 2027, leaving firms 12–18 months to prepare.

The KSW has been proactive in supporting member firms. Workshops on ESRS fundamentals, the double materiality assessment process, and assurance methodology are available through the chamber. The Wirtschaftskammer Österreich (WKO, the Austrian Federal Economic Chamber) offers additional resources targeted at companies preparing for CSRD reporting, which auditors should review to understand what their clients are being told.

One practical consideration specific to Austria: the DACH region (Germany, Austria, Switzerland) has significant cross-border economic integration. Many Austrian companies have suppliers in Germany and the Czech Republic, customers across Central Europe, and group structures that span multiple jurisdictions. The value chain reporting requirements under ESRS (particularly Scope 3 emissions and workers in the value chain under ESRS S2) will require Austrian entities to collect data from cross-border operations. Auditors should plan for the complexity and time this adds to the engagement.

How the NaBeG interacts with existing UGB requirements

The Unternehmensgesetzbuch (UGB, Austrian Commercial Code) already contained the NaDiVeG provisions in Section 243b. The NaBeG replaces these with a more detailed framework. But some existing UGB requirements continue to apply alongside the NaBeG.

Section 267b UGB requires certain groups to prepare a consolidated corporate governance report. The NaBeG does not replace this requirement. Where a group is required to produce both a consolidated sustainability statement under the NaBeG and a corporate governance report under Section 267b, the two documents must be consistent. Cross-referencing between the sustainability statement’s governance disclosures (ESRS 2 GOV-1 through GOV-5) and the corporate governance report is necessary.

For auditors performing both the financial audit (which includes review of the management report under Section 273 UGB) and the sustainability assurance, this creates an integrated engagement where consistency between financial data, governance disclosures, and sustainability metrics must be verified across multiple documents. Planning for this integration at the engagement acceptance stage prevents duplication and gaps.

Worked example: CSRD assurance for an Austrian industrial company

Client scenario: Müller Fertigung GmbH, an Austrian manufacturing company based in Linz. 1,500 employees, €490 million annual revenue, not listed. The company produces metal components for construction and infrastructure, with suppliers in Austria, Germany, and the Czech Republic. Products sold across the DACH region and Central Europe. Your firm is a mid-tier Austrian practice and has been Müller’s statutory auditor for four years. Müller will fall under Wave 2 once the relevant legislation is enacted, with first reporting expected for FY 2027.

1. Confirm scope and plan for the legislative gap

Müller exceeds the Omnibus I thresholds (1,500 employees, €490 million). As a non-listed large company, it’s Wave 2. The NaBeG does not yet cover Wave 2. The Austrian government has indicated that separate legislation will follow. Plan the engagement assuming FY 2027 is the first reporting year, but monitor the legislative process. If the Wave 2 law isn’t enacted before Müller’s FY 2027 balance sheet date, the same grey zone issue that affected Wave 1 companies may recur.

2. Evaluate the double materiality assessment

Müller’s sustainability coordinator (appointed January 2026) ran a DMA with support from an external consultant. Material topics identified: climate change (ESRS E1, 8 IROs including Scope 1 from natural gas furnaces and Scope 2 from electricity), pollution (ESRS E2, 5 IROs including metal dust emissions and wastewater), own workforce (ESRS S1, 6 IROs including health and safety in production, training investment, and pay equity), and resource use (ESRS E5, 4 IROs related to metal waste recycling and circular economy practices). Water (ESRS E3) was assessed as not material based on Müller’s low water intensity relative to sector benchmarks.

3. Assess data readiness

Müller tracks energy consumption through its ERP system (SAP). GHG calculations use the GHG Protocol methodology, with Austrian electricity emission factors from the Umweltbundesamt (Federal Environment Agency). Workforce data comes from SAP HR. No formal sustainability data controls exist beyond the quarterly management review. Scope 3 data is limited to Category 1 (purchased goods, estimated using spend-based emission factors from Ecoinvent).

4. Execute assurance procedures and report

For Scope 1: recalculate from gas invoices and production records. For Scope 2: verify against electricity invoices and confirm emission factor selection from Umweltbundesamt data. For workforce: test headcount and injury rates against underlying records. For DMA: review methodology, test a sample of impact and financial materiality scores, evaluate the not-material determination for water.

Müller’s engagement is estimated at 250–320 hours, with DMA evaluation taking approximately 50 hours, process and controls assessment 60 hours, substantive procedures 100–140 hours, and review and reporting 40 hours. The range reflects uncertainty about Scope 3 data quality, which may require additional testing.

First-year pricing and resource allocation

For Austrian mid-tier firms, the pricing question is as important as the technical one. A 250–320 hour engagement at typical Austrian Wirtschaftsprüfer rates represents €50,000–80,000 in fees. Whether clients will accept this depends on how the market develops as Wave 2 legislation passes and competitors begin offering CSRD assurance.

The Big 4 firms in Austria have already built CSRD teams for their PIE clients. They’ll compete for the larger Mittelstand entities. Mid-tier firms have the advantage of existing client relationships and lower overhead, but need to demonstrate competence. Running a pilot engagement (even on a reduced-fee basis) with a willing client before the legislative deadline arrives is the most effective way to build both capability and credibility.

Resource allocation matters. A first-year CSRD engagement requires at minimum one team member with ESRS knowledge (who has completed KSW training or equivalent), one team member familiar with the client’s industry and operations (typically the existing financial audit manager), and a reviewer with sustainability assurance experience. If your firm doesn’t have the reviewer internally, consider partnering with a specialist or engaging KSW-accredited experts for the review function. The FMA expects a quality review structure comparable to that for financial audits, even for non-PIE engagements.

Practical checklist for Austrian audit firms

1. Determine whether any current audit clients exceed the revised Omnibus I thresholds (1,000 employees, €450 million net turnover). Wave 2 legislation is pending, but clients meeting these thresholds should begin their DMA and data readiness work now (ESRS 1 paragraph 38).
2. For Wave 1 clients, verify the balance sheet date interaction with the NaBeG’s 19 February 2026 effective date. Confirm whether the client is reporting under NaBeG, under the NaDiVeG, or voluntarily under CSRD/ESRS for the current financial year.
3. Contact the KSW for guidance on sustainability assurance qualifications. Understand the training and competence requirements for Wirtschaftsprüfer performing CSRD limited assurance. The KSW offers workshops and practical toolkits that cover ESRS fundamentals and assurance methodology.
4. Study ISSA 5000 and the CEAOB September 2024 guidelines. These are your interim assurance framework until the EU adopts harmonised standards (due 1 July 2027). Familiarise your team with the differences between financial audit methodology and sustainability assurance methodology, particularly around non-financial metrics and estimation uncertainty, as well as the challenges of value chain data.
5. Prepare your ISQM 1 system for sustainability assurance as a distinct engagement type. The FMA’s expectations for PIE firms will set the benchmark. Even if you only serve non-PIE clients, KSW quality reviews will reference FMA standards.
6. Monitor the Austrian legislative process for Wave 2 legislation. The NaBeG explicitly left Wave 2 for a separate package. Track parliamentary proceedings, FMA publications, and KSW updates for timing and scope details.

Common mistakes in Austrian CSRD engagements

• Assuming NaDiVeG experience transfers directly: The most common error in the Austrian market is assuming that the NaDiVeG experience transfers directly to NaBeG engagements. NaDiVeG reporting was unstructured, unaudited, and often based on GRI or custom frameworks. NaBeG reporting under ESRS is standardised, detailed, and assured. Auditors who treat sustainability assurance as an incremental add-on to the financial audit will find the engagement significantly under-resourced.
• The FY 2024/2025 grey zone: The grey zone caught both entities and auditors unprepared. Some Wave 1 companies prepared NaDiVeG reports without ESRS alignment, only to discover that investors and analysts expected CSRD-quality disclosures. Auditors should proactively clarify with clients which framework applies to each financial year, particularly for non-calendar-year entities where the NaBeG effective date creates a mid-year transition.
• Planning risk from pending Wave 2 legislation: Auditors advising clients to begin their DMA and data readiness work now are making the right call, but the absence of a domestic legal basis means the specific Austrian requirements (including any member state options Austria exercises) won’t be known until the legislation passes. Build the engagement approach on the directive and Omnibus I, and plan to adjust once the domestic law is enacted.

Related Ciferi content

Related guides:

Put audit concepts into practice with these free tools:

Frequently asked questions

Further reading and source references

• NaBeG (Nachhaltigkeitsberichtsgesetz): Austria’s Sustainability Reporting Act transposing the CSRD, entered into force 19 February 2026.
• NaDiVeG (Nachhaltigkeits- und Diversitätsverbesserungsgesetz): the predecessor law implementing the NFRD in Austria since 2017.
• Directive (EU) 2026/470 (Omnibus I): the amending directive narrowing CSRD scope to 1,000+ employees and €450M+ turnover.
• KSW guidance and workshops: available through the Kammer der Steuerberater und Wirtschaftsprüfer for CSRD assurance preparation.