CSRD in Spain: Requirements & Timeline

Where does Spain’s CSRD transposition stand?

Spain’s CSRD transposition bill, the LEIS, was submitted to parliament on 15 November 2024. It was fast-tracked under an urgent procedure, but the legislative process was not completed before the end of 2024. As of March 2026, the bill remains in parliamentary debate. The European Commission opened infringement proceedings against Spain (along with seven other member states) for failing to notify national transposition measures by the 6 July 2024 deadline.

The LEIS replaces the existing sustainability reporting framework under Law 11/2018, which transposed the Non-Financial Reporting Directive (NFRD) into Spanish law. Law 11/2018 required companies with more than 250 employees and either €20 million in assets or €40 million in turnover (for two consecutive years) to file a non-financial information statement (estado de información no financiera). That obligation continues to apply until the LEIS enters into force.

Spain’s approach to transposition avoids significant gold-plating. The LEIS largely mirrors the CSRD’s requirements, though several member state options have been exercised. The bill requires sustainability reports to be available in Spanish (or a co-official language), published on the company’s website for five years, and approved by the general shareholders’ meeting. Companies can withhold commercially sensitive information, subject to disclosure of the fact and rationale for the omission.

One notable feature: the LEIS exercises the member state option allowing independent assurance services providers (IASPs) to perform sustainability assurance alongside statutory auditors. This opens the market to non-auditor providers, a decision that several other EU member states (including Germany, the Netherlands, and Italy) have declined to take.

The bill needs to be updated to reflect the Stop-the-Clock Directive (adopted April 2025) and the Omnibus I provisional agreement (December 2025) before it can be finalised. Whether Spain transposes the CSRD and its amendments in a single legislative act or through a sequence of amendments remains to be seen.

What the CNMV and ICAC expect before the LEIS enters into force

The CNMV (Comisión Nacional del Mercado de Valores) and the ICAC (Instituto de Contabilidad y Auditoría de Cuentas) have issued joint statements addressing the gap between the CSRD’s effective date and Spain’s pending transposition.

The first statement came on 27 November 2024. It recommended that companies falling within the CSRD’s scope prepare their sustainability reports for FY2024 using the ESRS, even though the LEIS had not been enacted. The CNMV and ICAC confirmed that ESRS-compliant reporting would be considered acceptable under Spanish law, provided the report also includes certain additional disclosures required by Law 11/2018 that the ESRS does not expressly cover (specifically, tax information, certain employment-related breakdowns, and transitional provisions).

A second statement followed on 19 November 2025, updating the guidance in light of the Stop-the-Clock Directive and the Omnibus I reform process. For Wave 1 companies (large PIEs with 500+ employees), the recommendation was to publish FY2025 sustainability information with reference to the ESRS, applying the flexibilities introduced by the EU’s “Quick Fix” delegated regulation. For Wave 2 companies (other large undertakings), the recommendation was softer: assess the suitability of applying ESRS or, where appropriate, the voluntary SME standard (VSME).

For auditors, the CNMV and ICAC pointed to the ICAC’s technical assurance standard (published in draft in December 2024 but not yet formally approved), the CEAOB guidelines, and the IAASB’s ISSA 5000 as reference frameworks. Until the ICAC standard is approved, practitioners should use these instruments collectively as their basis for performing sustainability assurance.

This is a pragmatic approach. But it creates a challenge for smaller audit firms that lack the resources to synthesise guidance from four separate sources into a coherent engagement methodology. Firms working with the CSRD/ESRS compliance checker can map their client’s disclosure requirements against the simplified ESRS to identify which data points need assurance coverage.

The November 2025 statement also addressed Wave 2 companies that are voluntarily preparing for CSRD reporting before their mandatory start date. The CNMV and ICAC recommended these companies assess whether ESRS or the Voluntary Standard for SMEs (VSME) is more appropriate to their size and complexity. Companies adopting ESRS voluntarily benefit from a dry run before mandatory reporting kicks in for FY2027, but they should be aware that the simplified ESRS (expected to be adopted by the European Commission in 2026) will significantly reduce the number of mandatory data points compared to the original set. Early adopters who built their reporting processes around the original ESRS may need to recalibrate.

How Royal Decree 214/2025 interacts with CSRD

Royal Decree 214/2025, adopted in March 2025 and in force from June 2025, makes carbon footprint reporting mandatory for large companies and certain public entities in Spain. This is a separate obligation from the CSRD, but the overlap is significant.

Companies already subject to Law 11/2018 (the NFRD transposition) must calculate their Scope 1 and Scope 2 emissions annually, publish a five-year greenhouse gas reduction plan with quantified targets, and report this information starting in 2026 (for the 2025 reporting year). Scope 3 reporting remains voluntary for private companies but becomes mandatory for public authorities from 2028.

The decree explicitly acknowledges that its provisions “may be modified, supplemented or replaced by the provisions enacted in Spain for the transposition of the CSRD.” In other words, once the LEIS enters into force, the CSRD framework takes precedence. But until then, companies face two concurrent obligations: the Royal Decree for carbon footprint data, and Law 11/2018 for broader non-financial reporting. Companies that align their carbon reporting with ESRS E1 (Climate change) now will be better positioned when the CSRD obligation kicks in.

In total, approximately 4,000 public and private entities fall within the combined scope of the Royal Decree and Law 11/2018. SMEs are not directly included, though they may face indirect obligations through supply chain information requests from larger customers. The Royal Decree also introduces a carbon footprint registry for events with more than 1,500 participants, and companies that voluntarily register their carbon footprint with the Ministry for Ecological Transition can receive an official stamp recognising their sustainability efforts. This stamp can provide an advantage in public procurement, where authorities are now permitted to include carbon footprint considerations as environmental criteria in tender procedures.

For audit planning, the key question is whether the carbon footprint data reported under Royal Decree 214/2025 will be subject to assurance under the CSRD. The answer depends on the double materiality assessment: if climate change is a material topic for the entity (which it will be for most industrial and energy-intensive companies), the ESRS E1 disclosures overlap substantially with the Royal Decree requirements. Auditors should plan for this overlap from the start rather than treating the two regimes as separate workstreams.

The revised CSRD timeline for Spanish companies

The Stop-the-Clock Directive entered into force on 17 April 2025, and Spain was required to transpose it by 31 December 2025. The revised timeline for Spanish companies, incorporating Stop-the-Clock and the Omnibus I provisional agreement, follows the same EU-wide structure.

Wave 1 (large PIEs, 500+ employees under the original CSRD): Required to report for FY2024. Not affected by Stop-the-Clock. Under Omnibus I, Wave 1 companies with 501 to 1,000 employees can be exempted by member state option for FY2025 and FY2026. Companies remaining in scope must continue reporting.

Wave 2 (other large companies meeting two of the three criteria: 250+ employees, €50M+ turnover, or €25M+ balance sheet): Originally FY2025, now postponed to FY2027 (first reports due 2028). This wave captures the bulk of large Spanish companies not already reporting under the NFRD.

Wave 3 (listed SMEs, small non-complex credit institutions, captive insurers): Originally FY2026, now FY2028. Under Omnibus I, listed SMEs are removed from scope entirely.

Wave 4 (non-EU companies with substantial Spanish/EU activity): Unchanged. FY2028.

For the Spanish market, the timing interaction between the LEIS and the Stop-the-Clock Directive matters. If Spain transposes the CSRD (including the Stop-the-Clock amendments) in a single act, Wave 2 companies will have their first reporting obligation for FY2027. If the LEIS passes before the Omnibus I directive is formally adopted and transposed, a second amendment will be needed to update scope thresholds. Spanish companies should plan on FY2027 as the operative date for Wave 2, but monitor the legislative timeline closely.

What the Omnibus I agreement changes for scope

The December 2025 Omnibus I provisional agreement rewrites the CSRD’s scope. The original two-out-of-three test (250+ employees, €50M turnover, €25M balance sheet) is replaced by a dual cumulative threshold: both 1,000+ employees and €450 million+ net turnover. Listed SMEs are removed entirely. Financial holding companies are excluded.

For Spain, this scope reduction is substantial. Many mid-sized Spanish companies that expected mandatory CSRD reporting will fall out of scope. A manufacturing group with 600 employees and €200 million turnover was firmly in scope under the original criteria. Under the revised thresholds, it’s out.

The “protected undertaking” concept applies in Spain as elsewhere: companies with 1,000 or fewer employees in the value chain of a CSRD-reporting entity can refuse information requests beyond voluntary reporting standards. Given Spain’s economic structure (with a significant proportion of mid-sized family-owned businesses acting as suppliers to larger groups), this provision will be relevant for many entities that receive data requests from their larger customers.

EFRAG’s simplified ESRS, submitted in December 2025, reduce mandatory data points by approximately 70%. The European Commission is expected to adopt the revised standards in time for FY2027 reporting. Reasonable assurance has been permanently removed; only limited assurance is required.

The Omnibus I directive was published in the EU Official Journal on 26 February 2026, and member states have until 19 March 2027 to transpose the CSRD and Audit Directive amendments. Spain will need to incorporate these changes into its national framework, either through the LEIS (if still pending) or through a subsequent amending act.

Another structural change from Omnibus I: the future obligation to transition to reasonable assurance has been removed. Limited assurance is permanent. And sector-specific ESRS have been abolished, replaced by non-binding guidelines. Spanish companies in sectors like construction, energy, and agriculture that anticipated sector-specific disclosure requirements should plan on the general simplified ESRS only.

Assurance requirements: who can audit the sustainability report?

Spain’s LEIS exercises the CSRD’s member state option to allow independent assurance services providers (IASPs) to provide sustainability assurance alongside statutory auditors. This distinguishes Spain from Germany, the Netherlands, and Italy, all of which have restricted sustainability assurance to statutory auditors only.

In practice, this means that environmental verifiers and other accredited professionals may be permitted to issue assurance opinions on sustainability reports in Spain, provided they meet the equivalent professional, ethical, and quality requirements set out in the legislation. The ICAC is developing a technical assurance standard that will govern how this assurance is performed, but the standard was still in draft as of March 2026.

Until the ICAC standard is formally approved, practitioners should follow the CNMV and ICAC’s November 2025 recommendations: use the draft ICAC standard, the CEAOB guidelines, the COESA (Comité de Auditoría de Entidades de Interés Público) guidance of September 2024, and the IAASB’s ISSA 5000 as reference frameworks. The multiplicity of guidance sources reflects the fact that no single authoritative EU assurance standard exists yet. The European Commission is required to adopt harmonised limited assurance standards by 1 July 2027.

Spain’s relatively open approach (allowing IASPs) may increase market capacity, but it also creates coordination challenges. If a non-auditor IASP provides sustainability assurance on a Spanish subsidiary’s report, and the parent company’s group auditor is a statutory auditor in another EU member state, the group auditor will need to assess whether the IASP’s work meets equivalent quality and independence standards. Engagement teams on cross-border groups should address this in the planning phase.

The fee structure mirrors the EU-wide position. Article 4(2), subparagraph 2 of the amended EU Audit Regulation exempts sustainability report assurance fees from the statutory audit fee cap, effective from FY2024 onwards. Advisory and consulting fees related to CSRD implementation are not exempt.

A specific point for Spanish practice: the ICAC is the body responsible for approving the technical assurance standard and for overseeing audit quality in Spain. The ICAC’s dual role (as both standard-setter for sustainability assurance and supervisor) creates a direct line of accountability. Auditors who deviate from the ICAC’s eventual standard will need to document and justify any departures.

For audit firms planning capacity, Spain’s decision to allow IASPs is a double-edged proposition. It increases the supply of assurance providers, which helps with market capacity. But it also introduces competitive pressure from non-auditor providers who may offer lower fees. Statutory auditors have an advantage in existing client relationships and in their familiarity with the entity’s financial data (much of which overlaps with ESRS disclosures). Whether that advantage offsets the price pressure depends on the firm’s positioning and the client’s priorities.

Worked example: assessing CSRD applicability for a Spanish entity

Client scenario: Fernández Construcciones S.A. is a non-listed Spanish construction company headquartered in Madrid. It has 750 employees, €420 million net turnover, €180 million in total assets, and is a wholly owned subsidiary of Grupo Fernández S.A., which is listed on the BME (Bolsas y Mercados Españoles).

Step 1: Determine the original CSRD wave

Fernández Construcciones S.A. is non-listed and meets two of the three original CSRD size criteria (750 employees exceeds 250; €420 million turnover exceeds €50 million). Under the original scope, it falls into Wave 2 (other large companies).

Step 2: Apply the Stop-the-Clock Directive

Wave 2 reporting is postponed from FY2025 to FY2027 under the Stop-the-Clock Directive. Fernández Construcciones’ first potential CSRD reporting obligation is FY2027 (report due 2028).

Step 3: Apply the Omnibus I scope revision

Under Omnibus I, CSRD scope requires both 1,000+ employees and €450 million+ net turnover. Fernández Construcciones has 750 employees (below 1,000) and €420 million turnover (below €450 million). It misses both thresholds. The company falls out of scope under the revised CSRD.

Step 4: Assess the parent company’s reporting and subsidiary exemption

Grupo Fernández S.A. is listed and may itself be required to report under CSRD. If the parent prepares a consolidated CSRD sustainability report that includes Fernández Construcciones, the subsidiary could have been exempt even under the original scope. Now that the subsidiary falls out of scope entirely under Omnibus I, the parent’s reporting is the more relevant question. Confirm whether Grupo Fernández meets the revised 1,000-employee and €450 million turnover thresholds at group level.

Step 5: Assess Royal Decree 214/2025 obligations

Regardless of CSRD scope, Fernández Construcciones is likely subject to Royal Decree 214/2025 as a large company under Law 11/2018. Confirm whether it must calculate and publish Scope 1 and Scope 2 emissions for 2025, with a five-year GHG reduction plan published in 2026. This obligation exists independently of the CSRD.

Conclusion: Fernández Construcciones S.A. falls out of mandatory CSRD scope under the Omnibus I thresholds. But it remains subject to the carbon footprint reporting obligation under Royal Decree 214/2025 and the non-financial reporting requirement under Law 11/2018 until the LEIS enters into force.

Practical checklist for Spanish CSRD engagements

1. Confirm the entity’s CSRD wave using the original scope criteria. For Spanish companies, also check whether the entity was already reporting under Law 11/2018 (NFRD transposition), as this determines Wave 1 eligibility.
2. Apply the revised Omnibus I thresholds: both 1,000+ employees and €450 million+ net turnover. If the entity misses either threshold, document the scope exit. If the entity was preparing for CSRD, advise on whether to continue reporting voluntarily under the VSME or scaled ESRS.
3. Track the LEIS legislative timeline. The bill was submitted in November 2024 and remains in parliamentary debate. Monitor the BOE (Boletín Oficial del Estado) for publication of the final act.
4. For Wave 1 clients reporting on FY2024 or FY2025, follow the CNMV and ICAC joint statements. Use the ESRS as the reporting framework, but also include the supplementary disclosures required by Law 11/2018 (tax information, employment breakdowns, transitional provisions).
5. Determine whether Royal Decree 214/2025 applies. If the client is a large company under Law 11/2018, it must calculate Scope 1 and Scope 2 emissions for 2025 and publish a GHG reduction plan in 2026. Align this data with ESRS E1 to avoid duplication if CSRD reporting applies later.
6. For assurance, note that Spain’s LEIS permits IASPs alongside statutory auditors. Until the ICAC technical standard is approved, follow the combined guidance from the ICAC draft, CEAOB, COESA, and ISSA 5000. Structure the engagement letter to specify the assurance standard used and the level of assurance (limited).

Common mistakes on Spanish CSRD engagements

• Confusing Royal Decree 214/2025 obligations with CSRD obligations. The Royal Decree on carbon footprints is a separate Spanish national requirement that applies now, from the 2025 reporting year. The CSRD has not been transposed into Spanish law yet. Companies subject to Law 11/2018 face the Royal Decree obligation regardless of whether they fall within the CSRD’s scope.
• Assuming that the CNMV and ICAC’s recommendation to use ESRS creates a binding legal obligation. It does not. The recommendation is that companies may use the ESRS, and the CNMV and ICAC will consider ESRS-compliant reporting acceptable. Until the LEIS enters into force, the legal reporting obligation derives from Law 11/2018. Audit teams should document the legal basis clearly in the engagement file to avoid confusion between voluntary ESRS adoption and mandatory CSRD compliance.

Related Ciferi content

Related guides:

Put audit concepts into practice with these free tools:

Frequently asked questions

Further reading and source references

• CSRD (Directive 2022/2464): the Corporate Sustainability Reporting Directive, as amended by the Stop-the-Clock Directive and Omnibus I.
• LEIS (Ley de Información Empresarial sobre Sostenibilidad): Spain’s pending CSRD transposition bill, submitted November 2024.
• Royal Decree 214/2025: mandatory carbon footprint reporting for large Spanish companies, in force from June 2025.
• Omnibus I (Directive (EU) 2026/470, published 26 February 2026): revised CSRD scope thresholds, removal of reasonable assurance, and simplified ESRS.