The assurance-escalation timeline in 2026 CSRD reporting after the Omnibus directive

Here's the issue: compliance officers who built 2024 CSRD reporting workflows assumed limited assurance was a temporary phase, with reasonable assurance arriving in 2028 or 2029. The February 2026 Omnibus directive removed that escalation entirely. Limited assurance is now the indefinite standard for Corporate Sustainability Reporting Directive filings. For European reporters, this looks like relief, lower audit fees, fewer controls, simpler evidence chains. But the decision creates a cross-border assurance gap that exporters and multinational finance teams are only beginning to quantify.

However, CSRD reporting consists of two things: the assurance standard your EU subsidiary follows, and the assurance standard your US parent or California-registered entity must meet. The Omnibus directive applies only to the first.

The first on its own has no value. California Senate Bill 253, New York Climate Change Accountability Act, and the pending SEC rules (if reinstated) all retain the limited-to-reasonable assurance escalation. Starting with 2027 reports, US entities disclose Scope 1 and Scope 2 emissions under limited assurance, then move to reasonable assurance the following cycle. The timeline US compliance officers are building toward has not changed.

While the CSRD escalation disappeared, the US escalation remains on schedule. If your US parent files under California SB 253 for fiscal year 2026 (due 2027), limited assurance becomes reasonable assurance in the 2028 filing. The cost of building two evidence chains, one for each jurisdiction, now outpaces the Omnibus savings. A CFO may spend EUR 40,000 less on EU assurance but EUR 120,000 more on US controls if the systems diverge.

How do you solve this? I think the operators who will avoid the split-evidence penalty are those treating US reasonable assurance as the design standard for both jurisdictions, even if the CSRD filing only requires limited. The incremental cost of over-building the EU evidence chain is lower than retrofitting US controls after the fact. For now, the path of least resistance is a single set of process controls that satisfy the higher bar, then downgrade the EU filing if needed.

The shape of the argument, visualised below.

The pre-Omnibus assurance roadmap

The original CSRD framework, adopted in December 2022, included a two-phase assurance timeline. Companies in the first wave (fiscal year 2024 reports, due 2025) obtained limited assurance on their sustainability statements. The European Commission was obligated to assess the conditions for transitioning to reasonable assurance by 1 October 2028, with the expectation that reasonable assurance would apply starting with fiscal year 2028 or 2029 reports.^[1]

Limited assurance is a review-level engagement. The auditor performs analytical procedures and inquiries to determine whether anything has come to their attention indicating the information is materially misstated. Reasonable assurance approaches the rigor of a financial audit. The auditor obtains sufficient appropriate evidence to conclude, with positive assurance, that the information is free from material misstatement. Reasonable assurance typically costs two to four times more than limited, requires more granular controls, and demands reproducible evidence for every disclosed figure.^[2]

First-wave compliance teams built their 2024 reporting infrastructure with the escalation in mind. You invested in document-first evidence chains, deterministic calculation lineage, and auditor-ready data packs because you expected reasonable assurance by 2029. The cost profile looked steep, but the investment was forward-looking.

What the Omnibus directive removed

The Omnibus I Directive, formally Directive (EU) 2026/470, entered into force on 18 March 2026. Among its most significant changes: it removed the obligation on the European Commission to transition to reasonable assurance. The directive explicitly states that companies will obtain limited assurance indefinitely, with no automatic move to a higher standard.^[3]

Member states have until 19 March 2027 to transpose the revised CSRD into national law, with first mandatory application for financial years beginning on or after 1 January 2027. The European Commission must adopt limited assurance standards by 1 July 2027. The International Auditing and Assurance Standards Board's ISSA 5000, effective for periods beginning on or after 15 December 2026, is expected to serve as the technical baseline for the EU standard. ISSA 5000 itself supports both limited and reasonable assurance engagements, but the CSRD now mandates only the limited level.^[4]

"The Omnibus removed the obligation to transition to reasonable assurance. The European Commission will adopt limited assurance standards by 1 July 2027, and the directive confirms there will be no automatic move to reasonable assurance. In practice, CSRD reporting will stay at the limited assurance level indefinitely, unless a future review revisits the question."^[5]

For compliance officers, this sounded like a cost reprieve. If your 2024 limited assurance engagement cost EUR 60,000, you no longer need to budget EUR 150,000 to EUR 240,000 for reasonable assurance in 2029. You can design lighter controls, use more estimation, and accept higher uncertainty in Scope 3 category-level figures.

The US disclosure timeline that did not change

California Senate Bill 253, enacted in October 2023, requires entities with annual revenues exceeding USD 1 billion that do business in California to disclose Scope 1, Scope 2, and Scope 3 greenhouse gas emissions. The California Air Resources Board (CARB) published its implementing regulation in draft form on 26 July 2026. The final regulation is expected by the end of 2026, with first reports due in 2027 covering fiscal year 2026 emissions.^[6]

Under the draft CARB regulation, entities must obtain limited assurance for Scope 1 and Scope 2 disclosures starting with the 2027 reports. The regulation does not yet specify when reasonable assurance becomes mandatory, but stakeholder comments during the public consultation period referenced a transition to reasonable assurance for subsequent cycles, consistent with the original legislative intent.

New York's Climate Change Accountability Act, enacted in December 2024, follows a similar structure. Entities with global revenues exceeding USD 1 billion that conduct business in New York must disclose Scope 1, Scope 2, and Scope 3 emissions. The law requires limited assurance for Scope 1 and Scope 2 starting with fiscal year 2026 reports (due 2027), with reasonable assurance expected to follow in a later phase.

The SEC's climate disclosure rule, adopted in March 2024 and stayed in April 2024, included a phased assurance requirement for large accelerated filers. If the rule is reinstated, large accelerated filers would obtain limited assurance for Scope 1 and Scope 2 starting with fiscal year 2026 reports (due 2027), then reasonable assurance beginning with fiscal year 2029 reports (due 2030).^[7]

The cross-border evidence-chain gap

If your corporate structure includes both an EU subsidiary subject to CSRD and a US parent or California-registered entity subject to SB 253, you now face two assurance timelines with different escalation paths. The Omnibus directive removed the CSRD escalation. California, New York, and the SEC (if reinstated) retained theirs.

This creates four implementation scenarios:

1. Unified reasonable-assurance build: you design process controls and evidence chains to satisfy US reasonable assurance from the start, then downgrade the EU filing to limited assurance if needed. Incremental cost over limited-only: ~EUR 30,000 to EUR 50,000 per year, mostly in documentation and control design.

2. Split evidence chains: you maintain separate workflows for EU (limited) and US (reasonable), with divergent evidence standards. Incremental cost: ~EUR 80,000 to EUR 120,000 per year, driven by duplicate audit fees, control testing, and data reconciliation.

3. EU-only build, US retrofit: you design for CSRD limited assurance, then retrofit US controls when reasonable assurance arrives in 2028 or 2029. One-time retrofit cost: ~EUR 100,000 to EUR 180,000, plus annual incremental audit fees of EUR 60,000 to EUR 100,000.

4. Voluntary EU reasonable assurance: you elect to obtain reasonable assurance for your CSRD filing even though the directive only requires limited, aligning the evidence standard across jurisdictions. Incremental cost: ~EUR 40,000 to EUR 80,000 per year over mandatory limited.

The Omnibus directive created savings for EU-only reporters. For cross-border entities, the Omnibus created a divergence penalty. The CFO who budgeted EUR 40,000 in CSRD assurance savings may face EUR 120,000 in US retrofit costs if the systems split.

What compliance officers missed in the first read

The Omnibus directive removed the CSRD escalation, but it did not remove the option for companies to voluntarily obtain reasonable assurance. EFRAG's December 2025 technical advice on the simplified European Sustainability Reporting Standards noted that entities may choose to obtain reasonable assurance if they determine it serves their stakeholders or aligns with other regulatory obligations.^[8]

The key insight: reasonable assurance is no longer mandatory under CSRD, but it may be the lower-cost path for multinational entities that face escalation in other jurisdictions. If you are building US reasonable-assurance controls anyway, the incremental cost of applying those controls to your EU filing is smaller than the cost of maintaining two separate evidence chains.

Executive officer statements under California SB 253 carry personal liability. EU CSRD limited assurance does not impose the same officer-level accountability. If your US disclosure includes a signed executive officer statement, the evidence chain must be reproducible and deterministic. If you build that chain for the US filing, you already have the infrastructure for EU reasonable assurance.

The split-evidence scenario, where you design lighter controls for CSRD and heavier controls for California, creates a reconciliation burden. Your EU Scope 1 and Scope 2 totals are calculated under one evidence standard. Your US Scope 1 and Scope 2 totals are calculated under another. When the two totals differ (and they will, because the evidence standards differ), you must explain the variance to both auditors, adding hours and cost to each engagement.

What to start this week

1. Map your regulatory scope: list every entity in your corporate structure that is subject to CSRD, California SB 253, New York CCAA, or the SEC rule (if reinstated). Identify which entities share Scope 1 and Scope 2 emissions data.

2. Compare assurance timelines: build a table like the one above, with columns for each regime and rows for limited assurance, reasonable assurance, and Scope 3 disclosure. Identify where the timelines diverge.

3. Model the cost scenarios: work with your auditor to estimate the cost difference between unified reasonable-assurance build, split evidence chains, EU-only build with US retrofit, and voluntary EU reasonable assurance. Use the incremental cost estimates above as a starting point.

4. Choose the design standard: decide whether to design process controls and evidence chains for US reasonable assurance (the higher bar) or CSRD limited assurance (the lower bar). If you choose the lower bar, document the retrofit plan and budget for 2028 or 2029.

5. Document for future assurance: regardless of which path you choose, start building the evidence lineage now. Document methodologies, controls, and audit trails. The CSRD filing due in 2027 covers fiscal year 2026 emissions, which means the data collection and evidence chain must be in place before the end of 2026.

How Emission3 fits

Emission3 is designed for cross-border entities that face multiple assurance timelines. The platform ingests source documents (invoices, bills of materials, utility bills) and builds line-item evidence chains that satisfy both limited and reasonable assurance standards. Every disclosed figure is reproducible, with full lineage from source document to filing.

The core infrastructure is document-first. Emission3 does not rely on spreadsheets, estimation, or activity-based proxies. The deterministic large language model layer extracts structured data from unstructured documents, then routes it through a calculation engine that auditors can replay. The output is an evidence pack that includes document images, extraction logs, calculation lineage, and submission-oriented reports.

For clients building toward US reasonable assurance, Emission3 provides the evidence standard from the start. For clients with EU-only scope, the platform supports limited assurance with the option to upgrade. The incremental cost of over-building the evidence chain is lower than retrofitting controls after the fact.

All customers start with a CBAM and disclosure readiness call. We map your suppliers, identify gaps in your current evidence chain, and design an implementation plan that aligns with your assurance timeline. No anonymous self-serve onboarding, no generic SaaS trial. The conversation begins with scope, timelines, and audit readiness.

The retrofit penalty, quantified

If you design for CSRD limited assurance in 2026, then discover in 2028 that your US parent needs reasonable assurance, the retrofit includes:

• Control design and documentation: EUR 30,000 to EUR 50,000, one-time.
• Evidence-chain rebuild: EUR 40,000 to EUR 80,000, one-time, to backfill missing source documents and calculation lineage for prior periods.
• Audit fee step-up: EUR 60,000 to EUR 100,000 per year, ongoing, as the auditor moves from limited to reasonable assurance procedures.
• Reconciliation and variance analysis: EUR 20,000 to EUR 40,000 per year, ongoing, to explain differences between EU and US evidence chains.

Total retrofit cost over three years: EUR 250,000 to EUR 420,000.

The unified reasonable-assurance build, where you design for the higher bar from the start, costs EUR 30,000 to EUR 50,000 per year more than CSRD-only limited assurance. Over three years: EUR 90,000 to EUR 150,000. The savings: EUR 160,000 to EUR 270,000.

The math favours over-building. The Omnibus directive removed the CSRD escalation, but it did not remove the US escalation. If your corporate structure spans both jurisdictions, the lower-cost path is a single set of controls that satisfy both.

Closing

The Omnibus directive created relief for EU-only reporters, who no longer need to plan for reasonable assurance in 2028 or 2029. For cross-border entities, the Omnibus created a divergence penalty. US disclosure regimes retained the limited-to-reasonable escalation. The cost of maintaining split evidence chains now outpaces the CSRD savings.

The compliance officers who will avoid the retrofit penalty are those treating US reasonable assurance as the design standard from the start, even if the CSRD filing only requires limited. The incremental cost of over-building the EU evidence chain is lower than retrofitting US controls after the fact.

If you are building 2026 evidence chains now, map your regulatory scope, compare assurance timelines, and model the cost scenarios. Choose the design standard before the data collection begins. The CSRD filing due in 2027 covers fiscal year 2026 emissions, which means the evidence chain must be in place before the end of 2026.

Book a CBAM and disclosure readiness call to map your suppliers, identify gaps, and design an implementation plan that aligns with your assurance timeline.^[4]