CSRD is a directive — it sets requirements for member states to implement mandatory sustainability reporting, but penalties for non-compliance are set at national level. The directive requires penalties to be "effective, proportionate, and dissuasive." In practice this means financial penalties, but the amounts and enforcement mechanisms vary significantly by member state.
How CSRD Enforcement Works
CSRD requires each EU member state to:
- Appoint a competent authority to supervise compliance with sustainability reporting requirements
- Set effective, proportionate, and dissuasive penalties for non-compliance
- Ensure these penalties are published where appropriate
The competent authority is typically the national securities regulator or financial market authority (e.g., AMF in France, BaFin in Germany, CONSOB in Italy, Central Bank of Ireland). Some member states delegate enforcement to national accounting regulators.
Who faces enforcement:
- The company as a legal entity
- In some member states, directors or management board members personally
Types of Non-Compliance
Failure to Report
Companies within CSRD scope that do not publish a sustainability report by the required deadline. This is the most straightforward enforcement scenario — the omission is clear.
Inadequate or Incomplete Report
Companies that publish a sustainability report but omit required disclosures, apply incorrect methodology, or fail to include required ESEF tagging. This is harder to detect but enforcement authorities are building review capacity.
False or Misleading Disclosures
Publishing sustainability information that is materially inaccurate — greenwashing in a regulatory report. This is the most serious category and may engage criminal liability in some jurisdictions.
Failure to Obtain Assurance
CSRD requires limited assurance for sustainability reports. Publishing an unassured report (or a report with deficient assurance) is a distinct compliance gap.
Penalty Ranges by Member State
Member states are implementing CSRD penalties as part of national transposition. The following are indicative based on transposition legislation:
Germany: Under the HGB (Commercial Code) amendments for CSRD, failure to prepare or publish a required report: up to €50,000 per violation, with escalation for repeated violations. Directors personally liable in cases of intentional non-compliance.
France: AMF enforcement powers include financial penalties of up to €100M or 5% of annual turnover for material sustainability disclosure violations (higher threshold from securities law). For CSRD specifically, penalties under transposing legislation are being calibrated.
Netherlands: AFM (Authority for Financial Markets) can impose fines of up to €5M for reporting violations or order publication of corrective information. Board members can be held personally liable for deliberate violations.
Ireland: CBI (Central Bank of Ireland) enforcement powers include financial penalties and public statements. Irish Companies Act penalties for non-filing can reach tens of thousands of euros; CSRD-specific penalties are being set through transposing legislation.
EU minimum floor: The directive itself requires penalties to be dissuasive. Regulatory guidance indicates this means fines that are not trivially small relative to company size — similar to the approach taken with GDPR, where penalties are calibrated to company turnover.
Director Liability
A notable feature of CSRD enforcement is the potential for board-level personal liability. Several member states impose personal liability on directors for:
- Deliberate failure to produce required sustainability reports
- Knowingly approving materially false sustainability disclosures
- Failure to implement adequate processes to produce accurate sustainability data
This mirrors the NIS2 Article 20 approach to board liability for cybersecurity obligations — regulators are increasingly willing to impose personal consequences on directors for deliberate non-compliance with reporting obligations.
Reputational Consequences
Beyond financial penalties, non-compliant companies face:
Public enforcement register: Enforcement actions are typically published. A listing on a national securities regulator's enforcement register for sustainability reporting failures creates reputational damage with investors, customers, and ESG-focused partners.
Investment access: ESG-oriented investors and funds — which represent a growing share of institutional capital — may exclude companies with sustainability reporting violations from their investment universe.
Procurement disqualification: Large companies subject to CSRD conducting procurement will include sustainability reporting compliance in supplier qualification. Being non-compliant may disqualify from preferred supplier status.
Assurance refusal: Repeated or material failures to maintain adequate sustainability data records may result in the assurance provider refusing to provide assurance — creating a compliance gap that compounds over time.
Greenwashing Risk
The most significant penalty risk is not technical reporting failures but greenwashing enforcement. Sustainability claims made in marketing, investor communications, or public statements that are not supported by the underlying CSRD report data create liability:
- EU's Green Claims Directive (adopted alongside CSRD) creates enforcement for unsubstantiated environmental claims
- ESMA and national securities regulators are increasingly investigating greenwashing in investment-related sustainability disclosures
- Consumer protection authorities are investigating sustainability claims in B2C marketing
Companies that prepare a robust, accurate CSRD report and align their marketing claims with it are protected. Companies that use sustainability claims without underlying data are exposed.
What to Do to Avoid Penalties
- Determine your Wave — when your first report is due
- Complete the double materiality assessment — this is the foundation for all reporting
- Implement data collection systems — before the reporting year begins
- Engage an assurance provider early — assurance provider capacity is limited
- Build board-level governance — board oversight of sustainability reporting reduces personal liability exposure
- Align marketing claims with report — do not make sustainability claims beyond what your report supports