CSRD, UK SRS and CBAM: what actually applies to a mid-sized business

In the last few months, we have witnessed the EU cutting back its reporting rules, the UK publishing its own standards, and carbon border charges moving from consultation into invoices. For a UK business with, say, 200 to 900 employees, the honest answer to "does this apply to us?" is usually "not directly, but it will reach you". This is general guidance, not legal advice, and several pieces are still moving.

The short version

CSRD: most mid-sized firms are now out of direct scope

The Omnibus I Directive, (EU) 2026/470, entered into force on 18 March 2026. It narrowed CSRD to EU undertakings with more than 1,000 employees and more than €450m net turnover. Listed SMEs were removed from mandatory scope. Non-EU groups are caught only if the ultimate parent has EU net turnover above €450m for two consecutive years and an in-scope EU subsidiary or branch above €200m. Member states have until 19 March 2027 to transpose the changes.

On timing, the earlier stop-the-clock directive had already pushed the second wave back by two years. Accountancy Europe's summary is that these companies will first report in 2028 on financial year 2027, and in-scope non-EU groups will report in 2029 on financial year 2028.

A UK business with an EU subsidiary of a few hundred people is very unlikely to report under CSRD itself. The exposure is as a supplier, and here the Omnibus helps. Companies with up to 1,000 employees are "protected undertakings": large reporters may not request information beyond what a voluntary standard covers. The Omnibus required the Commission to adopt that voluntary standard by delegated act by 19 July 2026, and reporters may rely on a supplier's self-declaration of its size.

Expect fewer, more standardised data requests from EU customers. Do not expect them to stop.

UK SRS: voluntary for most, with listed companies first

The Department for Business and Trade published the final UK Sustainability Reporting Standards, UK SRS S1 and S2, on 25 February 2026. They are voluntary until a regulator or legislation requires them.

The first such requirement has now arrived for listed companies. In September 2026 the FCA published PS26/19, requiring commercial companies with equity listings and some other listed issuers to report against UK SRS on a comply or explain basis for accounting periods beginning on or after 1 January 2027. Scope 3 emissions get a one-year transitional relief, and issuers can report on climate only for the first two years before addressing wider sustainability matters.

For private companies, nothing is mandatory yet under UK SRS. The government said in February 2026 that it would consider extending requirements to private companies through its corporate reporting reforms, with a consultation expected later in 2026. A listed customer that must now report Scope 3 on a comply or explain basis is also more likely to ask its suppliers for data.

CBAM: the one that already costs money

The EU's carbon border adjustment mechanism entered its definitive period on 1 January 2026. Importers of in-scope goods, including iron and steel, aluminium, cement and fertilisers, now need to be registered as CBAM authorised declarants and must surrender certificates for the embedded emissions.

The simplification regulation, (EU) 2025/2083, introduced a single de minimis threshold of 50 tonnes of in-scope goods per importer per calendar year, excluding electricity and hydrogen. The Commission will review it each year to keep around 99% of embedded emissions in scope. Certificate sales start in February 2027, covering 2026 imports, and the annual declaration and surrender deadline moves to 30 September of the following year.

For a UK exporter, the EU importer of record carries the obligation, but the cost and the data request will come back up the chain. Expect EU customers to ask for emissions data on what you ship, and to factor CBAM cost into their buying decisions.

Scope is also likely to widen. In December 2025 the Commission proposed extending CBAM to around 180 downstream steel and aluminium products. The Council and Parliament adopted different positions in 2026, the Parliament's covering far more products, and the first political trilogue was scheduled for 20 October 2026, with the aim of reaching agreement before the end of the year. Makers of metal-intensive finished goods should plan on the assumption that they may be caught.

The UK's own CBAM starts on 1 January 2027, covering aluminium, cement, fertiliser, hydrogen and iron and steel, for businesses importing £50,000 or more of those goods.

What to do this quarter

Map your exposure on one page: EU subsidiaries and their size, listed customers, EU customers in metal-intensive sectors, and the tonnes and value of CBAM goods you import into the EU and the UK.

If you import above the thresholds, confirm registration status, nominate an owner in finance or customs, and start collecting supplier emissions data now rather than when the first declaration is due.

If you are mainly a supplier, prepare one consistent dataset aligned to the EU voluntary standard and UK SRS S2. Answer customers from it rather than building a new response for every questionnaire.

Keep a watching brief on three things: the outcome of the CBAM downstream negotiations, the UK consultation on private company reporting, and whether the UK and EU reach any agreement that changes how CBAM applies between them.

Our free Sustainability Regulation Readiness Check turns this into a short screen of which rules apply to your own business, and when.