CSRD in France: Timeline & Obligations for Auditors

How France transposed the CSRD before anyone else

Ordinance 2023-1142 of 6 December 2023 transposed the CSRD into French law. France published this before any other member state, replacing the old Déclaration de Performance Extra-Financière (DPEF) with the new sustainability report (rapport de durabilité) integrated into the management report.

The ordinance did more than copy the directive. It restructured the French Commercial Code (Code de commerce) to accommodate two categories of sustainability verifiers: the statutory auditor (commissaire aux comptes) and the independent third-party body (OTI). Both fall under the supervision of the H2A.

The H3C (Haut Conseil du Commissariat aux Comptes) became the H2A on 1 January 2024. The name change reflects the expanded mandate. Where the H3C supervised statutory auditors only, the H2A now supervises everyone who provides assurance on sustainability information. Its powers include inspections, disciplinary proceedings, registration of sustainability assurance practitioners, and the adoption of interim guidelines pending the European Commission’s limited assurance standard. The expanded college of the H2A includes members with specific sustainability expertise, a structural change from the H3C’s composition.

For audit firms, the practical consequence was immediate. If you held a commissaire aux comptes mandate for a Wave 1 entity (large public-interest entities with 500+ employees), you were expected to provide limited assurance over the 2024 sustainability report published in 2025. Planning for that engagement needed to start months before the report date. At firms like ours, engagement partners (EPs) who had never run a sustainability engagement were suddenly responsible for signing off on one.

The December 2023 ordinance also extended the audit committee’s role. Listed entities must now have their audit committee (or a dedicated sustainability committee) monitor the sustainability reporting process. This is not optional. Article L.821-67 of the Code de commerce requires it. If your client’s governance structure doesn’t include this monitoring function, that’s a compliance gap you need to flag before the engagement starts.

A separate decree (Décret 2024-152 of 28 February 2024) adjusted the size criteria for French companies and groups. The decree aligned the thresholds used for CSRD scoping with the updated criteria in Commission Delegated Directive (EU) 2023/2775. For Wave 2 classification, an entity must exceed at least two of the following: €25M balance sheet total, €50M net turnover, 250 employees.

In addition to transposing the directive, the ordinance harmonised and clarified existing ESG obligations scattered across the French Commercial Code. Various requirements that had accumulated over the years (duty of vigilance provisions, gender parity disclosures, and environmental reporting duties, among others) were consolidated. The Linklaters analysis of the transposition noted that this consolidation itself carries litigation risk: the new provisions in the Code de commerce create additional grounds for legal challenges relating to absent or incomplete sustainability information.

The phased reporting timeline

France’s original CSRD timeline followed the directive’s three-wave structure, anchored to the ordinance’s entry into force on 1 January 2024. Each wave brings a different segment of the corporate population into mandatory sustainability reporting.

Wave 1 (FY 2024, reports published 2025): Large public-interest entities already subject to the NFRD with more than 500 employees. This includes companies listed on EU regulated markets with either €40M+ turnover or €20M+ balance sheet total. These entities have already filed their first CSRD-compliant reports.

Wave 2 (FY 2025, reports published 2026): All other large companies exceeding two of the following: 250+ employees, €25M+ balance sheet, €50M+ turnover. This was the wave that would have brought the majority of mid-tier audit clients into scope.

Wave 3 (FY 2026, reports published 2027): Listed SMEs (excluding micro-enterprises) and small non-complex credit institutions. An opt-out of up to two years was available, pushing the latest possible start to FY 2028.

Wave 4 (FY 2028, reports published 2029): Non-EU companies generating €150M+ revenue within the EU with at least one large EU subsidiary or EU branch.

This timeline has been disrupted twice. First by the Stop-the-Clock Directive (adopted April 2025), which postponed Wave 2 and Wave 3 by two years. Then by Omnibus I (published in the Official Journal on 26 February 2026), which restructured the scope entirely.

The French Senate added its own complication. In March 2025, during the review of the DDADUE 5 bill (Dispositions Diverses d’Adaptation au Droit de l’Union Européenne), senators voted to postpone the sustainability reporting obligation by four years for Wave 2 companies. That exceeded the EU-level Stop-the-Clock delay of two years. After further negotiation, the final position aligned more closely with the EU timeline, but the episode illustrates the political pressure on CSRD implementation in France.

One detail specific to France: companies subject to non-financial reporting requirements under the previous NFRD regime, but not classified as public-interest entities, were still required to publish a report for FY 2024 under the old DPEF framework. This created an overlap period where some entities reported under the old regime while Wave 1 entities reported under the new CSRD. For audit firms serving both types of client simultaneously, this meant running two different reporting frameworks in parallel during 2025. Nobody enjoyed that.

For practitioners, the operational question is straightforward: which of your clients still need to report, and when? The worked example later in this post walks through the analysis.

What Omnibus I changed for French companies

The Omnibus I Directive (Directive 2026/470), published in the Official Journal on 26 February 2026, is now law. It enters into force on 18 March 2026. Member states have until 19 March 2027 to transpose the CSRD and Audit Directive changes into national law.

The scope change is the most significant amendment. CSRD reporting now applies only to EU companies exceeding both 1,000 employees and €450M net annual turnover. The old two-of-three test is gone. Listed SMEs are removed from scope entirely, and financial holding companies are also exempted.

For non-EU groups, the threshold is €450M net turnover generated in the EU (for each of two consecutive financial years) and an EU subsidiary or branch with €200M+ net turnover.

What this means for France specifically: Wave 1 companies that remain above the new thresholds continue reporting as before. Wave 1 companies that fall below the new thresholds can be exempted by member state action for FY 2025 and FY 2026. France has not yet confirmed whether it will exercise this option. Until the French government transposes the Omnibus I changes, the original CSRD scope technically remains in force under French law.

The revised ESRS are also coming. The Commission must adopt revised and simplified ESRS by 18 September 2026, based on the drafts EFRAG submitted on 30 November 2025. Those drafts reduced mandatory data points by 61% compared to the current Set 1. The new ESRS apply for FY 2027 onwards, with an option for early application from FY 2026. Even Wave 1 entities will be working with substantially different reporting requirements within two years. The timeline is genuinely aggressive for firms that haven’t started mapping the delta between Set 1 and the simplified ESRS.

The Omnibus I Directive also introduced the concept of “protected undertakings.” Companies with fewer than 1,000 employees in the value chain of a reporting entity have the right to refuse information requests that exceed the voluntary sustainability reporting standard (VSME). Contractual provisions requiring more than VSME-level information from protected undertakings are not binding. This directly limits the “trickle-down effect” that was the most frequent complaint from French business federations during the consultation period.

For French audit firms, the immediate practical impact is client reassessment. A company with 400 employees and €80M turnover that was squarely in Wave 2 under the original thresholds is now out of scope. The firm’s pipeline of CSRD assurance engagements may have contracted significantly. In our experience, the firms that repositioned quickly toward voluntary VSME-level engagements have held on to those client relationships; the ones that simply communicated the scope change and moved on lost the advisory work to ESG consultancies.

Voluntary reporting remains an option, and value chain pressure from larger clients will push many of these newly exempt companies to report anyway. The VSME standard (recommended by the European Commission in July 2025) gives them a lighter framework. The assurance market for voluntary sustainability information is unregulated, which means the commissaire aux comptes has no monopoly here.

Who provides assurance and under what rules

The French transposition created a dual-practitioner model. Either the commissaire aux comptes (the statutory auditor already appointed for the financial statements, or FS) or an OTI can provide limited assurance on the sustainability report. The entity chooses, and it can also appoint more than one practitioner.

In practice, most Wave 1 entities appointed their existing statutory auditor. This makes operational sense: the commissaire aux comptes already has access to the entity’s systems and understands its risk profile. The existing audit relationship reduces ramp-up time for the sustainability engagement. We’ve seen this on about half the Wave 1 engagements that have completed so far.

The assurance engagement is governed by Articles L.821-54 and L.822-24 of the Code de commerce (created by the transposition ordinance). The engagement covers four axes, which the H2A’s guidelines address in detail.

The first axis is verifying that the double materiality analysis complies with the ESRS and that the social and economic committee (comité social et économique, or CSE) was consulted where required. The second axis is verifying that the sustainability information published in the management report conforms to the ESRS. The third axis (not yet operational) will verify XBRL tagging once the European standard is published. The fourth axis verifies information published under the EU Taxonomy Regulation (Article 8).

The practitioner issues a certification report (rapport de certification) based on limited assurance. The conclusion is expressed in negative form: the practitioner states whether anything has come to their attention causing them to believe the sustainability information contains material misstatements or inconsistencies.

For non-French firms looking to enter this market: OTIs are subject to the same requirements as statutory auditors regarding independence and professional secrecy. The H2A’s registration requirements and inspection regime create a barrier to entry that favours established audit networks. Building a sustainability assurance practice in France requires H2A registration and full compliance with its ethical rules. You also need to be ready for its inspection programme from day one. This is not a market you can enter casually.

The H2A guidelines and what they require of practitioners

The H2A published its guidelines on 2 October 2024, updating the H3C’s June 2023 technical opinion to reflect developments that occurred after the original opinion: the ESRS (adopted 31 July 2023), the CSRD transposition ordinance (6 December 2023), and the CEAOB guidelines (adopted 30 September 2024).

These guidelines are transitional. The European Commission must adopt a harmonised limited assurance standard by 1 July 2027 (per the Omnibus I Directive, which extended the original October 2026 deadline). Until that standard is adopted, French practitioners follow the H2A guidelines. If the Commission has not adopted a standard by the deadline, practitioners must comply with standards adopted by the H2A and approved by order of the Minister of Justice.

The H2A guidelines draw heavily on ISAE 3000 (Revised), but they are not a copy. They include French-specific requirements on the verification of the CSE consultation process and the interaction between the sustainability assurance engagement and the statutory audit. They also specify the format of the assurance report and the practitioner’s obligation to consider EU Taxonomy disclosures alongside ESRS data. The two model reports published alongside the guidelines incorporate the CEAOB’s model report structure, ensuring consistency across European jurisdictions while respecting French legal terminology.

For practitioners, the guidelines set out a structured engagement approach. Planning starts with understanding the entity’s sustainability reporting process and assessing the double materiality analysis. From there, the practitioner identifies areas of higher risk of material misstatement in the sustainability information and designs procedures responsive to those risks. Fieldwork includes inquiries of management and analytical procedures over sustainability data, combined with limited testing of underlying data and processes. The guidelines explicitly reference EFRAG’s ESRS implementation guidance (published May 2024) as a resource for understanding the reporting requirements.

The guidelines also address the situation where the same practitioner performs both the FS audit and the sustainability assurance engagement. The two engagements are distinct. The practitioner must maintain separate documentation and issue separate reports (unless a combined format is appropriate). Findings in one engagement must be considered for their potential impact on the other. Inconsistencies between the FS and the sustainability report are a specific risk that the H2A expects practitioners to address. This is not ticking and bashing; you cannot run a standard FS audit programme with sustainability data points bolted on. The underlying data has fundamentally different characteristics.

One operational challenge: the guidelines were designed for Wave 1 engagements. Their scope is explicitly limited to the first sustainability audits conducted in 2025. Updated guidelines or a full standard will be needed for subsequent waves, particularly once the simplified ESRS take effect for FY 2027.

The IAASB’s work on ISSA 5000 (the proposed international standard for sustainability assurance) has also been factored into the H2A’s approach. Once ISSA 5000 is finalised and the Commission adopts the EU limited assurance standard, the French framework will need to be updated again. French practitioners are looking at two more transitions in about as many years.

For mid-tier firms, the competence question is the most pressing operational issue. Environmental data verification (particularly Scope 1 and Scope 2 emissions under ESRS E1) requires technical knowledge that most FS audit teams do not currently have. The H2A expects practitioners to either develop this expertise in-house or engage specialists under ISAE 3000’s provisions for using the work of an expert. Documenting the basis for relying on a specialist is an area the H2A is likely to scrutinise during early inspections. Firms that have not yet mapped their competence gaps against the ESRS disclosure requirements for their Wave 1 clients are running behind. If the EP cannot explain, in their own words, how the entity calculated its Scope 2 emissions, that is a problem the H2A will find.

Worked example: scoping a Wave 2 French client

The numbers below are illustrative, but the analysis follows the same structure we’ve seen EPs run on about half the Wave 2 scoping assessments completed since Omnibus I was published.

Client: Mercier Packaging S.A.S., Lyon

Annual revenue: €120M | Balance sheet total: €45M | Employees: 380 | Listed: No | Sector: Industrial packaging

Under the original CSRD scope (Wave 2):

1. Mercier exceeds all three Wave 2 thresholds: 380 employees (exceeds 250), €45M balance sheet (exceeds €25M), €120M turnover (exceeds €50M). Only two are required.

Documentation note: Record the threshold assessment in the engagement acceptance file. Cite the criteria from Article L.232-6-3 of the Code de commerce and the size thresholds from the transposed CSRD.

1. Mercier would report for FY 2025, with the sustainability report published in 2026. Stop-the-Clock delayed this to FY 2027 at the earliest.

Documentation note: Confirm the applicable reporting period. Cross-reference the entity’s financial year end with the Wave 2 effective date (originally 1 January 2025) and the Stop-the-Clock postponement to 1 January 2027.

1. The engagement team would plan a limited assurance engagement over the sustainability report, following the H2A’s October 2024 guidelines. ISAE 3000 (Revised) governs the engagement methodology.

Documentation note: Document the applicable assurance framework. Reference the H2A guidelines and ISAE 3000 (Revised).

After Omnibus I (revised scope, effective for FY 2027 onwards):

1. Mercier has 380 employees and €120M turnover. The new threshold requires exceeding both 1,000 employees and €450M net turnover. Mercier falls below both.

Documentation note: Update the scoping memorandum. Record the Omnibus I thresholds (Directive 2026/470, published 26 February 2026, entering into force 18 March 2026). Note that the entity is no longer in scope for mandatory CSRD reporting from FY 2027 onwards.

1. Since Mercier was a Wave 2 entity, Stop-the-Clock pushed its first mandatory reporting year to FY 2027. Omnibus I removes it from scope from FY 2027 onwards. The two legislative instruments interact to eliminate Mercier’s reporting obligation entirely.

Documentation note: Document the interaction between Stop-the-Clock (Directive 2025/794) and Omnibus I (Directive 2026/470). Record the conclusion that the entity is not subject to mandatory CSRD reporting. Note whether the entity intends to report voluntarily.

1. Mercier’s largest customer (a listed French industrial group with 4,500 employees and €2.1B revenue) will request sustainability data through its value chain procedures. Mercier qualifies as a “protected undertaking” under Omnibus I (fewer than 1,000 employees) and can limit its response to VSME-level information.

Documentation note: If Mercier chooses voluntary assurance on its sustainability information, document the basis of engagement (contractual, not statutory). The H2A guidelines do not govern voluntary engagements. ISAE 3000 (Revised) applies directly.

Practical checklist for audit firms with French CSRD engagements

1. Re-run the scope assessment for every French client against the Omnibus I thresholds (1,000+ employees and €450M+ net turnover). Update the acceptance file before the next reporting cycle.
2. For Wave 1 clients that remain in scope, confirm the H2A practitioner registration is current. Verify that the engagement team includes at least one member with documented ESRS training. The H2A’s CPD requirements for sustainability assurance are separate from the standard FS audit CPD, and inspectors will check.
3. Download the H2A’s two model assurance reports (published October 2024) and adapt them to the specific engagement. Do not use a generic ISAE 3000 report template. The H2A expects the French-specific format.
4. For clients that fall out of scope under Omnibus I, document the exit clearly. If the client intends to report voluntarily (likely under value chain pressure), re-engage under a contractual ISAE 3000 (Revised) engagement rather than a statutory mandate.
5. Monitor the French transposition of Omnibus I. The deadline is 19 March 2027, but France may legislate earlier given its track record as a first mover. The treatment of Wave 1 entities that fall below the new thresholds for FY 2025 and FY 2026 is still unconfirmed.
6. Check whether your client’s audit committee (or dedicated sustainability committee) has formally included sustainability reporting in its monitoring scope per Article L.821-67 of the Code de commerce. If not, flag it before the engagement begins.

Common mistakes in French CSRD assurance engagements

• Applying generic ISAE 3000 procedures without incorporating the H2A’s specific guidelines. The H2A expects practitioners to follow its October 2024 guidelines, which include requirements on double materiality verification and CSE consultation that go beyond the base ISAE 3000 framework. Treating sustainability assurance as a tick box exercise by repurposing your existing FS audit programme will not survive H2A inspection.
• Failing to reassess the entity’s scope after Omnibus I. The AMF drew attention in its October 2025 recommendations to the interaction between Stop-the-Clock and the Omnibus I scope changes. An entity that was in Wave 2 under the original thresholds may never be required to report if it falls below the 1,000 employees / €450M turnover line. Not documenting this reassessment is a file quality issue.
• Treating the sustainability report as a standalone document rather than a section of the management report. Under the French transposition, sustainability information must be published within a dedicated section of the rapport de gestion in xHTML format. A separate PDF or website publication does not satisfy the legal requirement.
• Assuming value chain data requests are someone else’s problem. If your client is a protected undertaking (fewer than 1,000 employees), you need to advise them on what they can and cannot be asked to provide. Getting this wrong creates friction with the client’s larger customers, which creates friction with you.

Related content

• CSRD glossary entry. Covers the directive’s structure and ESRS framework in plain language.
• CSRD/ESRS Double Materiality Assessment Tool. Interactive tool for conducting and documenting the IRO assessment required by ESRS 1.
• CSRD in Belgium: Requirements for Audit Firms. Companion post covering the Belgian transposition and IBR/IRE assurance rules.

Related ciferi content

CSRD guides:

Put audit concepts into practice with these free tools:

Frequently asked questions

Further reading and source references

• Ordinance 2023-1142 of 6 December 2023: the French CSRD transposition instrument.
• H2A October 2024 guidelines: transitional guidelines for limited assurance over sustainability information, including two model assurance reports.
• Directive (EU) 2026/470 (Omnibus I): the amending directive narrowing CSRD scope to 1,000+ employees and €450M+ turnover.
• Décret 2024-152 of 28 February 2024: adjusted French company size criteria for CSRD scoping.