Limited assurance
The level the Directive requires for the opinion.
Art 34(1)(aa).EU reporting · assurance
CSRD assurance: limited only, and what the opinion covers
CSRD assurance is limited assurance: an assurance provider gives an opinion on the sustainability statement, the process behind it and the Taxonomy disclosures.
Omnibus I deleted the path to reasonable assurance and moved the deadline for EU limited assurance standards to 1 July 2027.
In the UK, assurance of UK SRS reporting is not required; listed companies only say whether they obtained it.
What is assured
The opinion covers the statement, the process and the Taxonomy
The assurance opinion is set by Article 34(1) of the Accounting Directive, as amended by the CSRD.
It reaches further than the published numbers: the process that decided what to report is inside it.
Read Article 34(1)(aa)
The provider must “express an opinion based on a limited assurance engagement as regards the compliance of the sustainability reporting” with the requirements, “including the compliance … with the sustainability reporting standards adopted pursuant to Article 29b, the process carried out by the undertaking to identify the information reported”, and with the reporting requirements of Article 8 of the Taxonomy Regulation.
The process is the double materiality assessment, which is why the double materiality assessment has to leave an evidence trail.
Taxonomy Article 8 disclosures sit inside the perimeter, as the green taxonomy guide explains.
Inside the opinionExplore
Module 01 / 04
The ESRS
Compliance of the sustainability reporting with the standards adopted under Article 29b.
Module 03 / 04
The Taxonomy
Compliance with Article 8 of Regulation (EU) 2020/852.
Limited, not reasonable
Why there is no reasonable-assurance date
The CSRD as adopted in 2022 empowered the Commission to adopt reasonable assurance standards by 1 October 2028.
Omnibus I removed that power, so no move from limited to reasonable assurance is legislated.
Read recital (5)
Recital (5) of Directive (EU) 2026/470: “To avoid an increase in the costs of assurance for undertakings, the requirement to adopt reasonable assurance standards should be removed.”
The replacement Article 26a(3) of the Audit Directive contains no reasonable-assurance subparagraph.
A company may still choose reasonable assurance; nothing in the Directive requires it.
The level of assurance
Reasonable assurance
The 2022 power to adopt standards by 1 October 2028 was removed.
Omnibus I recital (5).Assurance standards
EU standards by 1 July 2027, and where ISSA 5000 fits
Article 1(3) of Omnibus I requires the Commission to adopt limited assurance standards no later than 1 July 2027.
The IAASB’s ISSA 5000 is an international standard, and the Directive does not name it.
Read what each standard is
ISSA 5000 was published on 12 November 2024 and is effective for periods beginning on or after 15 December 2026; its ¶9 says it “deals with both reasonable and limited assurance engagements”, which is not a requirement for either.
The FRC issued ISSA (UK) 5000 on 12 November 2025, effective for the same periods, and its news release describes it as intended for voluntary use.
This page does not state which standard an assurer must use before the EU standards are adopted; that depends on national law.
The standardsExplore
Module 03 / 04
ISSA 5000
IAASB, published 12 November 2024; covers limited and reasonable.
Who can assure
Three tiers of provider, and a 27-way answer
The statutory auditor of the financial statements is the default provider.
The other two routes are Member State options, so the answer differs country by country.
Read the options in detail
| Route | Who | Provision |
|---|---|---|
| Default | The statutory auditor of the financial statements | Art 34(1) |
| Member State option | A different statutory auditor or audit firm | Art 34(3) |
| Member State option | An independent assurance services provider, on requirements equivalent to those for auditors | Art 34(4) |
Article 34(4) couples the options: a Member State that opens the door to independent assurance services providers must also allow a different statutory auditor.
So “can a non-audit firm assure my CSRD report?” has to be answered for the Member State whose law applies.
Provider optionsExplore
Module 02 / 04
Another auditor
Member States may allow a different statutory auditor or audit firm.
Module 03 / 04
IASP
Member States may allow an independent assurance services provider on equivalent requirements.
Module 04 / 04
Accreditation
An IASP is a conformity assessment body accredited under Regulation (EC) No 765/2008.
The value-chain cap
The assurer must respect a supplier’s right to decline
New Article 34(2a) requires the assurance opinion to be prepared in a manner that fully respects the right of protected value-chain undertakings to decline.
So an assurer cannot push a reporter to collect what its suppliers may lawfully refuse.
Read how the cap works
The cap applies only to requests made for CSRD reporting, as the Commission’s note of 6 May 2026 confirms, and covers only the datapoints in Annex II to Delegated Regulation (EU) 2026/1560.
Undertakings that apply that voluntary standard are not obliged to seek assurance for what they report.
What a supplier can be asked for is on the VSME guide.
Cap and assuranceExplore
Module 01 / 04
Protected undertaking
An average of 1,000 employees or fewer in the preceding financial year.
Module 02 / 04
Right to decline
Information beyond the voluntary standard’s capped datapoints.
Module 03 / 04
Deemed compliance
A reporter that does not take over-cap data is deemed to have complied.
Assuring the process
What the materiality process needs to survive assurance
Because the process is inside the opinion, the evidence behind each materiality conclusion matters as much as the conclusion.
ESRS 2 IRO-1 sets out what the statement must say about that process, which is a usable checklist for the evidence file.
Read what an evidence file should hold
A top-down conclusion under revised ESRS 1 ¶27 needs the strategy and business-model analysis behind it on file.
Thresholds, whether qualitative or quantitative, should be recorded and applied consistently, because ¶35(a) of IRO-1 asks for them.
ESRS 2’s own application requirement AR 24 warns against boilerplate that merely recites the standard.
The method itself is on the double materiality assessment, and the wider idea of material information on materiality explained.
What IRO-1 asksExplore
Module 01 / 04
Steps and methods
Decision-making steps, value-chain coverage, methodologies, inputs, assumptions, thresholds.
Module 02 / 04
Prioritisation
How impacts were assessed on severity and likelihood.
Module 03 / 04
Due diligence
Whether it informs the assessment, and how stakeholder consultation does.
Module 04 / 04
Change and date
Significant changes, and when the assessment was last updated.
How CSRD assurance changed
CSRD assurance, 2022 to 2028
The assurance rules have moved twice since the CSRD was adopted.
Each date below is from the instrument named under it.
- 16 December 202201
CSRD published
Limited assurance, with a power to adopt reasonable assurance standards by 1 October 2028. - 12 November 202402
ISSA 5000 published
The IAASB’s international standard, covering limited and reasonable assurance. - 12 November 202503
- 26 February 202604
Omnibus I published
Reasonable-assurance power removed; limited standards moved to 1 July 2027. - 18 March 202605
- 15 December 202606
- 1 July 202707
- 202808
The UK position
UK SRS assurance is not required
The FCA’s PS26/19 does not require listed companies to obtain assurance of their UK SRS disclosures.
It requires them to state whether they did, and if so the provider, the scope and level, the standards used and where the report can be found.
Read the UK rules and the oversight regime
In response to Question 10 the FCA said: “We are not requiring explanations in the absence of assurance being sought.”
On standards it said it would “retain the proposal to simply disclose the sustainability assurance standards used”, rather than require ISSA (UK) 5000.
The consultation, CP26/5, had already proposed no mandatory assurance and reserved the question for later.
The government’s response of 30 January 2026 set out a voluntary, opt-in oversight regime, with the FRC tasked to set up an interim register by mid-2026; on the latest record held here, 14 July 2026, it had not opened.
The UK assurance landscape is on sustainability assurance, and the two regimes side by side on the CSRD and UK SRS compared.
UK assuranceExplore
Module 01 / 04
Statement
Listed companies say whether they obtained third-party assurance.
Module 03 / 04
No named standard
The FCA asks which standards were used, without naming one.
Module 04 / 04
Oversight
A voluntary, opt-in regime; register not open on the latest record, 14 July 2026.
Getting ready
An illustrative path to a first assured statement
This sequence is an illustration of one way to prepare, not a requirement of any standard.
It assumes a financial year 2027 reporter.
- 01 / Scope01
- 02 / Provider02
Check the provider options
Statutory auditor by default; other routes only where the Member State allows. - 03 / Process03
- 04 / Value chain04
- 05 / Taxonomy05
- 06 / Dry run06
What goes wrong
Seven CSRD assurance mistakes
“Reasonable assurance from 2028.”
The power was deleted by Omnibus I.
“Standards due 1 October 2026.”
Moved to 1 July 2027.
Assuring only the numbers
The process to identify information is inside the opinion.
Forgetting the Taxonomy
Article 8 disclosures are assured too.
“Any consultancy can assure it.”
Only where the Member State allows independent providers.
“The FCA requires ISSA (UK) 5000.”
It deliberately names no standard.
“UK companies must explain no assurance.”
They need not.
Every date in the CSRD, including the assurance ones, is in the CSRD timeline.
What the opinion rests onExplore
Frequently asked
Questions people ask
What level of assurance does the CSRD require?
Limited assurance.
The opinion under Article 34(1) of the Accounting Directive is based on a limited assurance engagement, and Omnibus I removed the empowerment that would have led to reasonable assurance.
Will CSRD assurance become reasonable assurance in 2028?
No. The CSRD as adopted in 2022 empowered the Commission to adopt reasonable assurance standards by 1 October 2028.
Omnibus I, Directive (EU) 2026/470, says that requirement should be removed, and the replacement Article 26a(3) contains no such power.
When are the EU limited assurance standards due?
The Commission must adopt delegated acts providing for limited assurance standards no later than 1 July 2027.
The earlier deadline was 1 October 2026.
What does the CSRD assurance opinion cover?
Compliance of the sustainability reporting with the requirements, including the ESRS; the process the undertaking carried out to identify the information reported; and compliance with the reporting requirements of Article 8 of the Taxonomy Regulation.
Is the double materiality assessment assured?
Yes, in effect.
The opinion covers “the process carried out by the undertaking to identify the information reported”, which is the double materiality assessment, so the method and its evidence have to stand up, not only the result.
Who can provide CSRD assurance?
By default the statutory auditor of the financial statements.
Member States may allow a different statutory auditor or audit firm, and may allow an independent assurance services provider subject to equivalent requirements, defined as a conformity assessment body accredited under Regulation (EC) No 765/2008.
The answer depends on the Member State.
Can a non-audit firm assure a CSRD report?
Only where the Member State has used the option in Article 34(4) to allow independent assurance services providers.
A Member State that does so must also allow a different statutory auditor.
Does the value-chain cap affect the assurer?
Yes.
New Article 34(2a) requires the assurance opinion to be prepared in a manner that fully respects the right of protected value-chain undertakings to decline information beyond the cap.
Which assurance standard applies to CSRD reports today?
The EU limited assurance standards are due by 1 July 2027.
ISSA 5000, published by the IAASB on 12 November 2024, is effective for periods beginning on or after 15 December 2026 and covers both limited and reasonable assurance; the Directive does not name it, and which standard applies before the EU standards is a matter this page does not state.
Is assurance of UK SRS reporting required?
No. Under the FCA’s PS26/19, listed companies state whether they obtained third-party assurance and, if so, from whom, over what, to what level, under which standards and where the report is.
They need not explain an absence of assurance.
Does the FCA require ISSA (UK) 5000?
No. PS26/19 deliberately retains the proposal to disclose the standards used rather than name one.
The FRC issued ISSA (UK) 5000 on 12 November 2025 for voluntary use; it is effective for periods beginning on or after 15 December 2026.
Is there a UK register of sustainability assurance providers?
The government has decided on a voluntary, opt-in oversight regime run by the FRC.
On the latest record held here, 14 July 2026, the register had not opened, and the government’s mid-2026 target had passed.
Do companies using the voluntary standard need assurance?
No. Recital (5) of Delegated Regulation (EU) 2026/1560 says undertakings applying the standard for voluntary use are not obliged to seek assurance for what they report.
When is the first assured statement under the single scope test?
For financial year 2027, published in 2028, for undertakings exceeding both €450 million of net turnover and 1,000 employees.
Sources
Primary sources
Every figure, date and status on this page traces to the instrument’s owner.
Secondary commentary is never the source for a number.
Checked against 14 sources fromEUR-LexEuropean CommissionIAASBFinancial Reporting CouncilFinancial Conduct AuthorityDepartment for Business and Trade
- EUR-LexDirective (EU) 2026/470 (Omnibus I) — recitals (4) and (5), Article 1(3)
Limited assurance standards by 1 July 2027; the reasonable-assurance empowerment removed.
- EUR-LexDirective 2013/34/EU, consolidated 18 March 2026 — Art 34(1), (2a), (3), (4)
What the opinion covers, who may give it, and the value-chain protection.
- EUR-LexDirective 2013/34/EU — Art 19a(1) and 19a(3)
The scope test from FY2027 and the value-chain cap.
- EUR-LexDirective (EU) 2022/2464 (the CSRD)
The 2022 directive that introduced sustainability assurance.
- EUR-LexRegulation (EU) 2020/852 — Article 8
Taxonomy disclosures, which sit inside the assurance perimeter.
- EUR-LexCommission Delegated Regulation (EU) 2026/1563 — revised ESRS 2, IRO-1
What a statement must say about the materiality process the opinion covers.
- EUR-LexCommission Delegated Regulation (EU) 2026/1560 — the voluntary standard
Undertakings applying it are not obliged to seek assurance.
- European CommissionFeedback on the value chain cap, 6 May 2026
The cap applies only to CSRD-purpose requests.
- IAASBISSA 5000 General Requirements for Sustainability Assurance Engagements
Published 12 November 2024; effective for periods beginning on or after 15 December 2026; covers both limited and reasonable assurance.
- Financial Reporting CouncilISSA (UK) 5000 ¶15
Issued 12 November 2025; effective for periods beginning on or after 15 December 2026.
- Financial Reporting CouncilFRC takes steps to support the assurance of sustainability reporting, November 2025
Describes ISSA (UK) 5000 as intended for voluntary use.
- Financial Conduct AuthorityPS26/19 — ¶¶2.47–2.59 and Appendix 1, UKLR 6.6.6R(8)(d)
A statement of whether assurance was obtained; no explanation where none was sought.
- Financial Conduct AuthorityCP26/5 — Chapter 7
The consultation that proposed no mandatory assurance.
- Department for Business and TradeGovernment response on an oversight regime for sustainability assurance, 30 January 2026
A voluntary, opt-in UK oversight regime.
Continue reading