CSRD currently requires only limited assurance — a lighter-touch review, not a full audit — on your sustainability report, and a December 2025 Omnibus amendment permanently removed the clause that would have escalated this to reasonable assurance by 2028. Reasonable assurance is no longer coming under current EU law; limited assurance is the standard to build toward.
If your compliance team has been preparing for a two-stage assurance ramp — limited assurance now, reasonable assurance (something closer to a financial-statement audit) a few years later — that plan needs revisiting. The reasonable-assurance escalation clause is gone. What’s left is a single, permanent assurance level that most reporting teams still don’t fully understand, built on a global standard that doesn’t even become effective until the end of 2026.
What CSRD Actually Requires Right Now
The Corporate Sustainability Reporting Directive (distinct from the related due-diligence directive, CSDDD) has required limited assurance on sustainability reporting since the first disclosures under the European Sustainability Reporting Standards (ESRS), covering financial year 2024 reports assured in 2025. Limited assurance means a licensed assurance provider — typically your statutory auditor, though EU member states can permit independent providers — reviews your sustainability report and issues an opinion that nothing came to their attention suggesting it’s materially misstated. That’s a meaningfully lower bar than a financial audit: fewer procedures, less evidence-gathering, and a negatively worded opinion (“nothing has come to our attention”) rather than a positive one (“in our opinion, the report is fairly presented”).
For most companies now in CSRD’s scope — following the Omnibus package’s revised thresholds of more than 1,000 employees and over €450 million in annual net turnover, effective from the 2027 reporting wave — limited assurance is the entire compliance target. There is no statutory path to a higher bar under current EU law.
Limited vs. Reasonable Assurance: What Actually Changes
The two assurance levels differ in scope, not just in wording. The table below sets out the practical difference an assurance provider — and the compliance team preparing evidence for them — actually experiences.
| Dimension | Limited assurance | Reasonable assurance |
|---|---|---|
| Opinion wording | Negative (“nothing has come to our attention”) | Positive (“in our opinion, fairly presented”) |
| Procedures | Primarily inquiry and analytical review | Inquiry, analytical review, plus substantive testing and corroboration |
| Evidence required | Enough to support a moderate level of assurance | Enough to support a high (though not absolute) level of assurance |
| Assurance risk accepted | Higher — a meaningful chance of undetected misstatement remains | Lower — comparable to a financial statement audit |
| Current CSRD requirement | Mandatory, since FY2024 disclosures | Not currently reachable — see below |
A limited assurance opinion is genuinely useful — it catches gross errors and forces internal controls to exist — but it is not equivalent to the confidence a reasonable assurance opinion (or a financial audit) provides. Companies that assumed reasonable assurance was simply a matter of time should treat that assumption as retired.
The Escalation to Reasonable Assurance Is Off the Table
CSRD’s original text gave the European Commission the authority to adopt reasonable-assurance standards by 1 October 2028, contingent on the Commission first assessing that the transition was feasible for both companies and assurance practitioners. That provision no longer exists. Under the Omnibus simplification package’s final agreed text (political agreement reached 22 December 2025), the authorization for the Commission to mandate reasonable assurance by 2028 was removed outright — not delayed, removed — capping the statutory assurance requirement at the limited assurance level for the foreseeable future.
This is part of a broader Omnibus pattern: alongside the assurance-escalation removal, the package narrowed CSRD’s scope to the >1,000-employee / >€450M-turnover threshold above, and is driving a rewrite of the EU’s sustainable-finance framework more broadly, including the ESRS themselves — targeting roughly 61% fewer mandatory datapoints, expected for adoption by mid-2026 and mandatory from the 2027 financial year. Reporting teams that built multi-year assurance-readiness roadmaps around an eventual reasonable-assurance deadline should treat that deadline as cancelled, not postponed.
ISSA 5000: The Standard Behind Every CSRD Assurance Engagement
Whatever assurance level applies, the engagement itself runs on a standard — and for the first time, that standard is a genuinely global one. The International Auditing and Assurance Standards Board (IAASB) published ISSA 5000, the International Standard on Sustainability Assurance, in November 2024. It’s designed to work for both limited and reasonable assurance engagements, applies across sustainability topics and reporting frameworks (not just CSRD), and is written for both accountant and non-accountant assurance practitioners — relevant in EU member states that permit independent (non-auditor) assurance providers. ISSA 5000 becomes effective for sustainability information covering periods beginning on or after 15 December 2026, with early adoption permitted in many jurisdictions.
Because ISSA 5000 is global, it needs EU-specific adaptation before it works as a CSRD assurance standard. The European Commission formally requested that assurance standard-setter CEAOB (the Committee of European Auditing Oversight Bodies) prepare that adaptation in a letter dated 27 January 2026: a set of “carve-outs” (removing ISSA 5000 elements that conflict with EU law, plus anything specific to reasonable assurance, now moot) and “add-ons” (EU-specific requirements ISSA 5000 doesn’t cover, including an opinion on compliance with the EU’s sustainability-reporting markup/tagging requirements, and provisions tied to the EU Taxonomy Regulation). CEAOB’s technical advice is due by 30 September 2026, feeding a Commission Delegated Act targeted for 1 July 2027. The request explicitly emphasizes proportionality — guidance that doesn’t impose “unnecessary burden” on the reporting company — consistent with Omnibus’s broader simplification goal.
What This Means for Choosing an Assurance Provider
Three practical implications follow, all actionable before the EU-specific standard is finalized:
- Budget and scope for limited assurance, not a full audit — but don’t underscope it. Assurance providers will expect documented processes for how sustainability data is collected, validated, and consolidated — the same “audit-ready reporting” discipline regulated companies already apply to financial statements.
- Confirm who can actually provide the assurance in your member state. Some EU states restrict sustainability assurance to statutory auditors; others permit independent assurance providers registered separately. Confirm current rules in each jurisdiction where your subsidiaries report, rather than assuming one EU-wide answer.
- Expect the standard itself to keep moving through 2027. With CEAOB’s technical advice due September 2026 and the Delegated Act targeted for July 2027, companies reporting under CSRD now are working against a standard still being finalized — build in a margin for methodology changes rather than treating current guidance as final.
US and Canada Implications
CSRD’s assurance requirement isn’t only an EU-company concern — it reaches non-EU companies with sufficient EU-generated turnover through subsidiaries or branches, so US and Canadian parents can find themselves subject to the same limited-assurance requirement through their European operations. Worth understanding how that compares to what’s emerging domestically, since the two are moving in opposite directions.
California’s SB 253 (the Climate Corporate Data Accountability Act) also requires third-party assurance of Scope 1, 2, and 3 emissions disclosures — and unlike CSRD, its stated trajectory still includes an escalation. The California Air Resources Board (CARB) has recommended limited assurance for annual reports from 2026 through 2029, stepping up to reasonable assurance from 2030 onward. That said, CARB’s specific assurance-level rules are addressed in a separate, not-yet-finalized rulemaking — treat the 2030 reasonable-assurance date as CARB’s stated direction, not a locked regulatory requirement, until that rulemaking closes.
Canada has no equivalent mandatory assurance requirement today. The Canadian Sustainability Standards Board (CSSB) has issued voluntary standards aligned with the ISSB’s IFRS S1 and S2, but adoption remains voluntary at the federal level, with no CSRD- or SB 253-style third-party assurance mandate in force. A US or Canadian company with EU exposure is, in practice, more likely to face a binding assurance requirement through CSRD than through any current domestic rule — worth flagging to finance and legal teams evaluating where compliance risk actually sits.
Key takeaways
- CSRD’s assurance requirement is permanently capped at limited assurance — the Omnibus package removed the Commission’s authority to mandate reasonable assurance by 2028, so multi-year assurance-readiness plans built around that deadline need revisiting.
- Every CSRD assurance engagement will eventually run on ISSA 5000, the IAASB’s global sustainability assurance standard (effective for periods from 15 December 2026), adapted for EU use through CEAOB’s carve-outs and add-ons — technical advice due September 2026, a Commission Delegated Act targeted for July 2027.
- US and Canadian companies with EU operations can face a binding CSRD assurance requirement even though neither country currently mandates it domestically — California’s SB 253 is heading toward reasonable assurance by 2030 (pending CARB rulemaking), while Canada’s CSSB standards remain voluntary.
Next step: If your team is still mapping what “audit-ready” sustainability data collection actually looks like ahead of an assurance engagement, Fruggr’s ESG IT Reporting is built to keep the underlying data structured and traceable from the start, rather than reconstructed under deadline.
FAQ
No. As of the Omnibus package’s final agreed text (December 2025), the European Commission’s authority to mandate reasonable assurance by 2028 was removed. Limited assurance is the current and, for now, permanent statutory requirement — verify against the consolidated directive once published in the Official Journal.
It depends on the EU member state. Some states restrict sustainability assurance to statutory auditors; others permit separately registered independent assurance providers. Confirm the rule in each jurisdiction where your subsidiaries report.
ISSA 5000 is the IAASB’s global sustainability assurance standard, published November 2024 and effective for periods beginning on or after 15 December 2026. It underlies CSRD assurance engagements once the EU-specific adaptation (carve-outs and add-ons via CEAOB) is finalized, expected by a Commission Delegated Act targeted for 1 July 2027. There’s no immediate action required beyond awareness — the standard is still being adapted for EU use.
Not yet at the same level as CSRD. California’s SB 253 requires limited assurance from 2026, with a stated (but not finalized) move to reasonable assurance from 2030. Canada’s CSSB standards are voluntary, with no mandatory assurance requirement in force.
This article was drafted with AI assistance and reviewed by our editorial team before publishing.