CSRD in France: Timeline & Obligations for Auditors

How France transposed the CSRD before anyone else

France was the first EU member state to transpose the CSRD into national law. That was December 2023. Most other member states missed the July 2024 deadline entirely, and the European Commission opened infringement proceedings against 17 of them in September 2024. If you’re providing assurance to French clients or competing for sustainability engagements in the French market, you’re already behind the firms that started preparing in early 2024. The rules are live and the first reports have been filed.

Ordinance 2023-1142 of 6 December 2023 transposed the CSRD into French law. France published this before any other member state, replacing the old Déclaration de Performance Extra-Financière (DPEF) with the new sustainability report (rapport de durabilité) integrated into the management report.

The ordinance restructured the French Commercial Code (Code de commerce) to accommodate two categories of sustainability verifiers: the statutory auditor (commissaire aux comptes) and the independent third-party body (OTI). Both fall under the supervision of the H2A.

The H3C (Haut Conseil du Commissariat aux Comptes) became the H2A on 1 January 2024. The name change reflects the expanded mandate. Where the H3C supervised statutory auditors only, the H2A now supervises everyone who provides assurance on sustainability information. Its powers include inspections, disciplinary proceedings, the adoption of interim guidelines pending the European Commission’s limited assurance standard, and the registration of sustainability assurance practitioners.

The December 2023 ordinance also extended the audit committee’s role. Listed entities must now have their audit committee (or a dedicated sustainability committee) monitor the sustainability reporting process. This is not optional. Article L.821-67 of the Code de commerce requires it. If your client’s governance structure doesn’t include this monitoring function, that’s a compliance gap you need to flag before the engagement starts.

A separate decree (Décret 2024-152 of 28 February 2024) adjusted the size criteria for French companies and groups. The decree aligned the thresholds used for CSRD scoping with the updated criteria in Commission Delegated Directive (EU) 2023/2775. For Wave 2 classification, an entity must exceed at least two of the following: €25M balance sheet total, €50M net turnover, 250 employees.

In addition to transposing the directive, the ordinance harmonised and clarified existing ESG obligations scattered across the French Commercial Code. Various requirements that had accumulated over the years (duty of vigilance provisions, gender parity disclosures, CSR-related board obligations) were consolidated. The Linklaters analysis of the transposition noted that this consolidation itself carries litigation risk: the new provisions in the Code de commerce create additional grounds for legal challenges relating to absent or incomplete sustainability information.

The phased reporting timeline (pre-Omnibus and post-Omnibus)

France’s original CSRD timeline followed the directive’s three-wave structure, anchored to the ordinance’s entry into force on 1 January 2024.

Wave 1 (FY 2024, reports published 2025): Large public-interest entities already subject to the NFRD with more than 500 employees. These entities have already filed their first CSRD-compliant reports. France is one of the few member states where Wave 1 reporting based on FY 2024 data is live.

Wave 2 (FY 2025, reports published 2026): All other large companies exceeding two of: 250+ employees, €25M+ balance sheet, €50M+ turnover. This is the wave that brings the majority of non-Big 4 audit clients into scope.

Wave 3 (FY 2026, reports published 2027): Listed SMEs (excluding micro-enterprises), small and non-complex credit institutions, and captive insurance undertakings. An opt-out of up to two years was available.

Wave 4 (FY 2028, reports published 2029): Non-EU companies generating €150M+ revenue within the EU with at least one large EU subsidiary or branch.

This timeline has been disrupted twice. First by the Stop-the-Clock Directive (adopted April 2025), which postponed Wave 2 and Wave 3 by two years. Then by Omnibus I (published 26 February 2026), which restructured the scope entirely.

The French Senate added its own complication. In March 2025, during the review of the DDADUE 5 bill, senators voted to postpone the sustainability reporting obligation by four years for Wave 2 companies. That exceeded the EU-level Stop-the-Clock delay of two years. After further negotiation, the final position aligned more closely with the EU timeline, but the episode illustrates the political pressure on CSRD implementation in France.

One detail specific to France: companies subject to non-financial reporting requirements under the previous NFRD regime, but not classified as public-interest entities, were still required to publish a report for FY 2024 under the old DPEF framework. This created an overlap period where some entities reported under the old regime while Wave 1 entities reported under the new CSRD. For audit firms serving both types of client simultaneously, this meant running two different reporting frameworks in parallel during 2025.

What Omnibus I changed for French companies

The Omnibus I Directive (Directive 2026/470), published 26 February 2026, enters into force on 18 March 2026. Member states have until 19 March 2027 to transpose the CSRD and Audit Directive changes into national law.

The scope change is the most significant amendment. CSRD reporting now applies only to EU companies exceeding both 1,000 employees and €450M net annual turnover. The old two-of-three test is gone. Listed SMEs are removed from scope entirely. Financial holding companies are also exempted.

For non-EU groups, the threshold is €450M net turnover generated in the EU (for each of two consecutive financial years) and an EU subsidiary or branch with €200M+ net turnover.

Wave 1 companies that remain above the new thresholds continue reporting as before. Wave 1 companies that fall below the new thresholds can be exempted by member state action for FY 2025 and FY 2026. France has not yet confirmed whether it will exercise this option.

The revised ESRS are also coming. The Commission must adopt revised and simplified ESRS by 18 September 2026, based on the drafts EFRAG submitted on 30 November 2025. Those drafts reduced mandatory data points by 61% compared to the current Set 1. The new ESRS apply for FY 2027 onwards, with an option for early application from FY 2026.

The Omnibus I Directive also introduced the concept of “protected undertakings.” Companies with fewer than 1,000 employees in the value chain of a reporting entity have the right to refuse information requests that exceed the voluntary sustainability reporting standard (VSME). Contractual provisions requiring more than VSME-level information from protected undertakings are not binding. This directly limits the so-called “trickle-down effect” that was the most frequent complaint from French business federations during the consultation period.

For French audit firms, the immediate practical impact is client reassessment. A company with 400 employees and €80M turnover that was squarely in Wave 2 under the original thresholds is now out of scope. The firm’s pipeline of CSRD assurance engagements may have contracted significantly.

But voluntary reporting remains an option. Value chain pressure from larger clients will push many of these newly exempt companies to report anyway. The VSME standard gives them a lighter framework. The assurance market for voluntary sustainability information is unregulated.

Who provides assurance and under what rules

The French transposition created a dual-practitioner model. Either the commissaire aux comptes (the statutory auditor already appointed for the financial statements) or an OTI can provide limited assurance on the sustainability report. The entity chooses. It can also appoint more than one practitioner.

In practice, most Wave 1 entities appointed their existing statutory auditor. This makes operational sense: the commissaire aux comptes already has access to the entity’s systems and understands its risk profile.

The assurance engagement is governed by Articles L.821-54 and L.822-24 of the Code de commerce. The engagement covers four axes, which the H2A’s guidelines address in detail.

The first axis is verifying that the double materiality analysis complies with the ESRS and that the social and economic committee (comité social et économique, or CSE) was consulted where required. The second axis is verifying that the sustainability information published in the management report conforms to the ESRS. The third axis (not yet operational) will verify XBRL tagging once the European standard is published. The fourth axis verifies information published under the EU Taxonomy Regulation (Article 8).

The practitioner issues a certification report (rapport de certification) based on limited assurance. The conclusion is expressed in negative form: the practitioner states whether anything has come to their attention causing them to believe the sustainability information contains material misstatements or inconsistencies.

An important detail for non-French firms: OTIs are subject to the same requirements as statutory auditors regarding independence and professional secrecy. The H2A’s registration requirements and inspection regime create a barrier to entry that favours established audit networks. Building a sustainability assurance practice in France requires H2A registration and compliance with its ethical rules.

The H2A guidelines and what they require of practitioners

The H2A published its guidelines on 2 October 2024, updating the H3C’s June 2023 technical opinion to reflect developments that occurred after the original opinion: the ESRS (adopted 31 July 2023), the CSRD transposition ordinance (6 December 2023), the implementing decrees, and the CEAOB guidelines (adopted 30 September 2024).

These guidelines are transitional. The European Commission must adopt a harmonised limited assurance standard by 1 July 2027 (per the Omnibus I Directive). Until that standard is adopted, French practitioners follow the H2A guidelines. If the Commission has not adopted a standard by the deadline, practitioners must comply with standards adopted by the H2A and approved by order of the Minister of Justice.

The H2A guidelines draw heavily on ISAE 3000 (Revised), but they are not a copy. They include French-specific requirements on the verification of the CSE consultation process and the interaction between the sustainability assurance engagement and the statutory audit. They also specify the format of the assurance report and the practitioner’s obligation to consider EU Taxonomy disclosures alongside ESRS data. The two model reports published alongside the guidelines incorporate the CEAOB’s model report structure, ensuring consistency across European jurisdictions while respecting French legal terminology.

For practitioners, the guidelines set out a structured engagement approach. Planning starts with understanding the entity’s sustainability reporting process and assessing the double materiality analysis. From there, the practitioner identifies areas of higher risk of material misstatement in the sustainability information and designs procedures responsive to those risks. Fieldwork includes inquiries of management and analytical procedures over sustainability data, combined with limited testing of underlying data and processes.

The guidelines also address the situation where the same practitioner performs both the financial audit and the sustainability assurance engagement. The two engagements are distinct. The practitioner must maintain separate documentation, issue separate reports (unless a combined format is appropriate), and ensure that findings in one engagement are considered for their potential impact on the other. Inconsistencies between the financial statements and the sustainability report are a specific risk that the H2A expects practitioners to address.

One operational challenge: the guidelines were designed for Wave 1 engagements. Their scope is explicitly limited to the first sustainability audits conducted in 2025. Updated guidelines or a full standard will be needed for subsequent waves, particularly once the simplified ESRS take effect for FY 2027.

For non-Big 4 firms, the competence question is the most pressing operational issue. Environmental data verification (particularly Scope 1 and Scope 2 emissions under ESRS E1) requires technical knowledge that most financial audit teams do not currently have. The H2A expects practitioners to either develop this expertise in-house or engage specialists under ISAE 3000’s provisions for using the work of an expert. Documenting the basis for relying on a specialist is an area the H2A is likely to scrutinise during early inspections.

Worked example: scoping a Wave 2 French client

Client: Mercier Packaging S.A.S., Lyon. Annual revenue: €120M | Balance sheet total: €45M | Employees: 380 | Listed: No | Sector: Industrial packaging

Under the original CSRD scope (Wave 2)

Mercier exceeds all three Wave 2 thresholds: 380 employees (exceeds 250), €45M balance sheet (exceeds €25M), €120M turnover (exceeds €50M). Only two are required.

Mercier would report for FY 2025, with the sustainability report published in 2026. Stop-the-Clock delayed this to FY 2027 at the earliest. The engagement team would plan a limited assurance engagement over the sustainability report, following the H2A’s October 2024 guidelines. ISAE 3000 (Revised) governs the engagement methodology.

After Omnibus I (revised scope, effective for FY 2027 onwards)

Mercier has 380 employees and €120M turnover. The new threshold requires exceeding both 1,000 employees and €450M net turnover. Mercier falls below both.

Since Mercier was a Wave 2 entity, Stop-the-Clock pushed its first mandatory reporting year to FY 2027. Omnibus I removes it from scope from FY 2027 onwards. The two legislative instruments interact to eliminate Mercier’s reporting obligation entirely.

Mercier’s largest customer (a listed French industrial group with 4,500 employees and €2.1B revenue) will request sustainability data through its value chain procedures. Mercier qualifies as a “protected undertaking” under Omnibus I (fewer than 1,000 employees) and can limit its response to VSME-level information.

The reviewer sees a file that tracks the regulatory evolution across multiple legislative instruments, documents the scoping conclusion at each stage, records the entity’s commercial decision about voluntary reporting, and identifies the applicable assurance framework for whichever path the entity takes.

Practical checklist for audit firms with French CSRD engagements

1. Re-run the scope assessment for every French client against the Omnibus I thresholds (1,000+ employees and €450M+ net turnover). Update the acceptance file before the next reporting cycle.
2. For Wave 1 clients that remain in scope, confirm the H2A practitioner registration is current. Verify that the engagement team includes at least one member with documented ESRS training. The H2A’s CPD requirements for sustainability assurance are separate from the standard audit CPD.
3. Download the H2A’s two model assurance reports (published October 2024) and adapt them to the specific engagement. Do not use a generic ISAE 3000 report template. The H2A expects the French-specific format.
4. For clients that fall out of scope under Omnibus I, document the exit clearly. If the client intends to report voluntarily (likely under value chain pressure), re-engage under a contractual ISAE 3000 (Revised) engagement rather than a statutory mandate.
5. Monitor the French transposition of Omnibus I. The deadline is 19 March 2027, but France may legislate earlier given its track record as a first mover. The treatment of Wave 1 entities that fall below the new thresholds for FY 2025 and FY 2026 is still unconfirmed.
6. Check whether your client’s audit committee (or dedicated sustainability committee) has formally included sustainability reporting in its monitoring scope per Article L.821-67 of the Code de commerce. If not, flag it before the engagement begins.

Common mistakes in French CSRD assurance engagements

• Applying generic ISAE 3000 procedures without the H2A overlay: The H2A expects practitioners to follow its October 2024 guidelines, which include requirements on double materiality verification and CSE consultation that go beyond the base ISAE 3000 framework. The H2A has indicated it will inspect compliance with these guidelines.
• Failing to reassess entity scope after Omnibus I: The AMF drew attention in its October 2025 recommendations to the interaction between Stop-the-Clock and the Omnibus I scope changes. An entity that was in Wave 2 under the original thresholds may never be required to report if it falls below the 1,000 employees / €450M turnover line. Not documenting this reassessment is a file quality issue.
• Treating the sustainability report as a standalone document: Under the French transposition, sustainability information must be published within a dedicated section of the rapport de gestion in xHTML format. A separate PDF or website publication does not satisfy the legal requirement.

Related Ciferi content

Related guides:

Put audit concepts into practice with these free tools:

Frequently asked questions

Further reading and source references

• Ordinance 2023-1142 of 6 December 2023: the French CSRD transposition instrument.
• H2A October 2024 guidelines: transitional guidelines for limited assurance over sustainability information, including two model assurance reports.
• Directive (EU) 2026/470 (Omnibus I): the amending directive narrowing CSRD scope to 1,000+ employees and €450M+ turnover.
• Décret 2024-152 of 28 February 2024: adjusted French company size criteria for CSRD scoping.