Robert Bosch GmbH is privately held. A foundation controls 94% of its shares. It also employs roughly 413,000 people and generated EUR 91 billion in sales last year. If you believe the EU’s Corporate Sustainability Reporting Directive only targets publicly listed companies, Bosch’s profile should end that assumption fast.
The short answer to whether the CSRD applies to private companies: yes, it can. The directive tests size, not listing status. A privately held GmbH, a family-controlled conglomerate, a PE-backed industrial group: if the numbers exceed the thresholds, the reporting obligation follows. Private ownership is an ownership fact, not a regulatory shield.
But the more useful answer goes further. Even private companies well below the mandatory thresholds are feeling CSRD’s weight through supply chains, bank questionnaires, and customer procurement scoring. Here is how the whole picture looks in 2026, after the Omnibus I package rewrote the rules.
Legal Form Is Irrelevant. Size Is the Only Gate.
The amended directive applies to undertakings regardless of legal form when they cross two simultaneous thresholds:
- More than 1,000 average employees
- More than EUR 450 million in net turnover
Both must be met. A private company with 3,000 employees but EUR 200 million in revenue does not trigger mandatory reporting under this primary test. A company with 800 employees and EUR 600 million in turnover does not either. The conjunction matters, and older guides that reference different numbers are citing the pre-Omnibus framework.
This is a significant narrowing. The European Parliament originally estimated nearly 50,000 EU companies in scope, up from about 11,000 under the predecessor Non-Financial Reporting Directive. The original test used a two-of-three approach: EUR 50 million turnover, EUR 25 million balance sheet, 250 employees. Listed SMEs were included.
None of that is the current rule. The Omnibus I process unfolded in two stages. The 2025 stop-the-clock directive postponed later reporting waves by two years while leaving first-wave companies (former NFRD reporters) on schedule. Then the 2026 amendment changed the substantive scope, raising thresholds, removing the listed-SME pathway, and producing the current population.
Accountancy Europe estimated the reduction could reach 80%, warning that some member states might have fewer than ten companies in mandatory scope. The political trade-off was deliberate: fewer reporters, but those remaining face a regime with assurance requirements, double materiality, and quantitative evidence expectations.
Where Private Companies Fall in the Current Framework
| Company Situation | Current Practical Answer |
|---|---|
| Large private EU company exceeding both thresholds | Mandatory CSRD/ESRS reporting |
| Private company below one or both thresholds | Generally outside mandatory scope; consider VSME |
| EU subsidiary of a reporting parent | May qualify for group exemption if conditions are met |
| Non-EU private group with significant EU operations | Potentially covered through third-country rules |
On timing: the current implementation summary from CSSF places the first revised reports under the narrowed scope in 2028, covering financial year 2027. Companies that were already reporting under the old NFRD were not delayed and continue on their original schedule.
The reporting itself is also lighter than what was originally designed. The European Commission’s July 2026 ESRS revision cut mandatory data points by more than 60%, total data points by more than 70%, and projected reporting costs down by over 30%. The Council’s official text makes these revised standards mandatory from financial year 2027, with optional early adoption for 2026.
Fewer data points does not mean easy. It means a smaller set of quantitative, controlled, material metrics that must survive assurance. For a private company that has never reported sustainability data, the controls infrastructure is the real project.
Non-EU Private Companies: The Third-Country Trigger
Headquarters outside the EU does not automatically place a private company beyond reach. The amended directive captures non-EU groups when two conditions are met simultaneously:
- The group generates more than EUR 450 million of net turnover within the EU
- The group has an EU subsidiary or branch exceeding EUR 200 million in turnover
A privately held U.S. industrial group with a large European distribution arm. A family-owned Asian conglomerate with significant European retail. A Middle Eastern logistics holding with a major EU subsidiary. All could trip these thresholds without a single share trading on any exchange.
The analysis must cover the whole group’s EU footprint, not just an individual legal entity. If your private group operates across multiple EU jurisdictions, aggregate the numbers before concluding you are outside scope.
Below the Threshold? Your Customers Still Find You.
This is the part most CSRD guides underexplain, and it is the part that will affect the largest number of private companies.
A private manufacturer with 150 employees and EUR 40 million in revenue will never appear on a mandatory CSRD list. But when its largest customer (a company that does report under CSRD) needs Scope 3 emissions data, supply chain labor practices, or environmental risk assessments for its own filing, a questionnaire arrives. That questionnaire lands on the desk of someone who has never compiled sustainability data in a structured format.
The amended directive actually places a cap on what in-scope companies may request from smaller value-chain partners specifically for CSRD reporting. That protection is real but narrow. It does not prevent other requests driven by:
- Bank lending criteria and sustainable finance requirements
- Customer procurement scoring that includes ESG metrics
- Investor due diligence on portfolio companies
- Separate supply-chain due-diligence regulations
None of these are bound by the CSRD value-chain cap. A private company can be fully outside mandatory scope and still face mounting pressure to produce credible sustainability data.
This is where EFRAG’s Voluntary Sustainability Reporting Standard for SMEs (VSME) becomes a strategic tool. The VSME is designed for non-listed micro, small, and medium undertakings outside mandatory CSRD scope, with Basic and Comprehensive modules. It gives smaller companies a standardized, proportionate response to recurring requests from banks, investors, and larger customers.
VSME is not a legal obligation. It is a market positioning tool. In logistics, MRO, aerospace supply chains, and industrial procurement, ESG scoring is already embedded in vendor evaluations. Companies that produce structured sustainability data will win contracts over companies that respond with “we are not covered by CSRD.” The legal exemption does not translate to commercial exemption.
A Six-Step Scope Analysis for Any Private Company
Whether you run a family-owned parts manufacturer or a PE-backed logistics group, this process produces a defensible answer:
- Identify the reporting entity and perimeter. Standalone company, subsidiary, branch, or consolidated group? Legal form is a starting fact, not an exemption.
- Apply the current size test. Calculate average employees and net turnover. Both must exceed 1,000 employees and EUR 450 million, respectively.
- Check third-country triggers. If the parent is non-EU, calculate EU-wide group turnover and test whether any EU subsidiary or branch crosses EUR 200 million.
- Test consolidation exemptions. A subsidiary may be exempt if included in a qualifying parent report. But CSSF guidance warns that subsidiaries and subgroups can remain relevant even when a group exemption exists. Check language, publication, and assurance requirements.
- Map the reporting year. First-wave companies were not delayed. Later waves were postponed by two years. The narrowed-scope reporting starts in 2028 for financial year 2027.
- Choose the proportionate response if outside scope. Select between VSME (Basic or Comprehensive), a bespoke customer data pack, or maintaining baseline source data for future readiness.
Document every step. When a regulator, auditor, lender, or customer asks whether CSRD applies to your company, a written scope assessment is worth more than a verbal assumption.
What It Actually Costs and Takes
CSRD reporting is not a PDF of good intentions. It requires double materiality assessments, ESRS-aligned data collection, controlled evidence trails, and external limited assurance.
Groupe Bruxelles Lambert spent more than EUR 2 million in 2024 preparing for CSRD, excluding employee time. GBL had prior experience with GRI, SASB, TCFD, and CDP. It still found the process demanding: mismatches between the holding-company perimeter and portfolio-company reality, limited sector-specific ESRS guidance, disclosure complexity, and what it described as a “highly demanding audit approach.” GBL’s private portfolio companies accelerated their own reporting progress as a result.
PwC’s 2024 survey of 547 companies across 30+ territories found that data availability was an obstacle for 59% of respondents, value-chain data for 57%, and staff capacity for 50%. More than 90% used or planned to use spreadsheets, and fewer than 60% had involved IT. That combination (spreadsheets, no IT ownership, assurance requirements) is a control breakdown in slow motion.
PwC’s 2025 survey of 496 executives across 40 countries found more encouraging signs: 36% had already published under CSRD or ISSB, 41% were planning CSRD reporting, and more than two-thirds said sustainability reporting had generated moderate or significant value. AI adoption in reporting workflows rose to 28% from 11% the prior year.
For private companies approaching the threshold or facing value-chain pressure, the practical message is: start with data governance, not with a reporting platform. Identify what data you already collect operationally (energy consumption, emissions per shipment, waste volumes, environmental conditions, asset movements) and map it to what ESRS or VSME would require. The gap is almost never “we have no data.” The gap is “we have data in twelve systems and no one owns it.”
Companies already running IoT-enabled supply chains, environmental monitoring, or asset tracking infrastructure have a structural advantage. The same sensors tracking temperature compliance in a cold chain or monitoring container cycles across a logistics network produce data that feeds sustainability metrics. The operational layer and the reporting layer are closer than most companies realize. The missing piece is usually governance, not hardware.
If your operational data infrastructure already tracks what moves, where, and under what conditions, the path to defensible sustainability reporting is shorter than you think. If that layer does not exist yet, building it solves two problems at once: operational visibility and reporting readiness. That is a conversation we have regularly with logistics operators, MRO teams, and supply chain managers. Reach out if it is relevant to where you are headed.
For maritime logistics specifically, learn more about how real-time vessel tracking feeds both operational and sustainability reporting needs.
Frequently Asked Questions
Does being private automatically exempt a company from CSRD?
No. The directive applies regardless of legal form. A private company exceeding both 1,000 average employees and EUR 450 million in net turnover falls within mandatory scope. Private status describes ownership structure, not reporting obligations.
What if my private company meets only one of the two thresholds?
Under the current principal test, both conditions must be met simultaneously. A company with 2,000 employees but EUR 300 million in turnover does not trigger mandatory reporting on this basis alone. Third-country rules and subsidiary triggers should still be evaluated.
Can a private subsidiary avoid reporting if its parent already files?
Potentially. A qualifying consolidated sustainability report from the parent can support a group exemption. However, conditions around language, publication, and assurance apply, and subsidiaries may still be relevant under national implementation.
What should a below-threshold private company do when customers ask for sustainability data?
Adopt EFRAG’s VSME standard as a structured response. Its Basic and Comprehensive modules give smaller companies a proportionate, reusable way to answer recurring questions from banks, investors, and procurement teams without undertaking a full CSRD filing.
Does a non-EU private company need to worry about CSRD?
Yes, if it generates more than EUR 450 million of EU turnover and has an EU subsidiary or branch exceeding EUR 200 million. The scope analysis should cover the whole group’s European footprint, not just individual local entities.
When would a newly covered private company first report?
Under the current timetable, the first revised reports under the narrowed Omnibus scope are expected in 2028, covering financial year 2027. First-wave companies (former NFRD reporters) were not delayed and continue their existing schedule.
+1 508 292 2210
3 Responses