Sustainability reporting frameworks: how CSRD, ISSB, TCFD, SECR and ESOS work, who must comply and where the rules differ

One UK business with an EU subsidiary can sit under several sustainability reporting rules at once, each with its own regulator, threshold and deadline. Several of those rules changed in 2026, and older guidance still in circulation quotes figures that no longer apply. Sorting the acronyms by who writes the rule, who must follow it and when it starts shows what a business owes.

What are sustainability reporting frameworks?

A sustainability reporting framework is a set of rules or recommendations that tells an organization which environmental and social information to disclose, how to measure it and where to publish it.

Directive (EU) 2026/470 sets out the core idea for large EU companies, which must “include in their management report information necessary to understand the undertaking’s impacts on sustainability matters, and information necessary to understand how sustainability matters affect the undertaking’s development, performance and position.”

In everyday terms, a framework answers a practical question. A manufacturer asks where its energy use and carbon emissions belong in the annual report. A listed company asks which climate risks investors expect to see. A large business asks how often it must audit its energy use.

Frameworks differ by author and legal force. The EU and UK governments write CSRD, SECR and ESOS as law. The IFRS Foundation writes the ISSB Standards, which apply only where a jurisdiction or company adopts them. The TCFD has disbanded, but its recommendations sit inside the ISSB Standards.

Why these rules matter for duplicate work, legal duties and investor questions

• Thresholds decide whether a report is mandatory, so checking size and listing status first tells a business whether it must collect the data at all.
• IFRS S2 integrates the TCFD recommendations, so TCFD-aligned reporting gives a team a base to build on when it moves to ISSB Standards.
• SECR and ESOS both draw on energy consumption data, so systems built for one can support the other.

Five frameworks with five different triggers

Framework	Legal status	Who it applies to
CSRD	EU law, amended by Directive (EU) 2026/470	EU undertakings with more than 1,000 average employees and net turnover above €450 million. Non-EU groups with EU net turnover above €450 million and an EU subsidiary or branch above €200 million.
ISSB	International standards, not law until adopted	Entities and jurisdictions that adopt or use IFRS S1 and IFRS S2.
TCFD	Recommendations, task force disbanded October 2023	Companies that still follow it, including UK listed companies under current FCA rules.
SECR	UK law (SI 2018/1155)	UK quoted companies, large unquoted companies and large LLPs, with a 40 MWh exemption.
ESOS	UK law (Regulations 2014, amended 2026)	UK undertakings with 250 or more employees, or turnover above £44 million and a balance sheet total above £38 million.

What is CSRD?

The Corporate Sustainability Reporting Directive (CSRD) is EU law, Directive (EU) 2022/2464, that requires in-scope undertakings to report sustainability information in their management report using the European Sustainability Reporting Standards (ESRS). The 2026 amendments mean far fewer companies must report. An EU manufacturer with 1,200 employees and €500 million net turnover is in scope, while one with 800 employees is out of scope whatever its turnover.

What is ISSB?

The International Sustainability Standards Board (ISSB) is the standard setter within the IFRS Foundation that issued IFRS S1 and IFRS S2 in June 2023. The IFRS Foundation describes the objective of IFRS S1 as “to require an entity to disclose information about its sustainability-related risks and opportunities that is useful to users of general purpose financial reports in making decisions relating to providing resources to the entity.” A company applying IFRS S1 describes who oversees sustainability risks, how they affect strategy, how it monitors them and its progress against targets, while IFRS S2 adds the climate-specific disclosures.

What is TCFD?

The Task Force on Climate-related Financial Disclosures (TCFD) was a Financial Stability Board task force whose recommendations cover governance, strategy, risk management and metrics and targets, supported by 11 recommended disclosures. It published its final status report on October 12, 2023 and disbanded that month because IFRS S2 integrates its recommendations. The IFRS Foundation’s 2024 review of 3,814 public companies found that 82% disclosed in line with at least one of the 11 recommended disclosures for fiscal year 2023.

How SECR puts energy use and carbon emissions into UK annual reports

Streamlined Energy and Carbon Reporting (SECR) is the UK requirement for companies and LLPs to report energy use, greenhouse gas emissions and energy efficiency action in their annual reports. It applies to financial years starting on or after April 1, 2019 under the 2018 Regulations. A large unquoted UK manufacturer, for example, reports its gas, electricity and transport fuel use and the emissions they produce, using the government guidance.

How ESOS requires large UK organizations to audit their energy use every four years

The Energy Savings Opportunity Scheme (ESOS) is a mandatory UK scheme that requires qualifying organizations to audit the energy used by their buildings, industrial processes and transport every four years. An organization that qualified in phase 3 must submit its second progress update by December 5, 2026, and phase 4 qualification is tested on December 31, 2026.

CSRD vs ISSB vs TCFD vs SECR vs ESOS: how do they differ?

Framework	Purpose	Owner	Timing
CSRD	Sustainability information in the management report	EU legislators	Member States transpose the 2026 amendments by March 19, 2027
ISSB	Decision-useful sustainability information for users of general purpose financial reports	IFRS Foundation	Issued June 2023, effective for periods starting on or after January 1, 2024 where applied
TCFD	Recommendations on climate-related financial risk	Financial Stability Board	Disbanded October 2023
SECR	Energy use and carbon in annual reports	UK Government	Financial years starting on or after April 1, 2019
ESOS	Energy audits and action plans	UK Government, with the Environment Agency as scheme administrator	Four-year cycle, phase 4 deadline December 5, 2027

UK, EU and US requirements by regulator, rule and date

UK rules: SECR, ESOS, climate disclosure and UK SRS

For SECR, a company is large when it exceeds two of three conditions for financial years beginning on or after April 6, 2025: £54 million turnover, a £27 million balance sheet total and 250 average employees, according to Companies House guidance. ESOS is regulated by the Environment Agency, Natural Resources Wales, the Northern Ireland Environment Agency and the Scottish Environment Protection Agency.

The 2022 climate disclosure regulations apply to financial years starting on or after April 6, 2022. They cover traded companies, banks and insurers with more than 500 employees, AIM companies with more than 500 employees and companies with turnover above £500 million and more than 500 employees.

UK SRS S1 and UK SRS S2 were published on February 25, 2026 for voluntary use. The FCA’s policy statement PS26/19 of September 30, 2026 replaces TCFD-aligned listing rules with a comply or explain requirement to report against UK SRS for accounting periods starting on or after January 1, 2027, with first reporting in 2028.

EU rules under CSRD after the 2026 amendments

Directive (EU) 2026/470 was published in the Official Journal on February 26, 2026 and entered into force on March 18, 2026. Member States must bring in national measures by March 19, 2027 and may exempt companies that fall outside the new scope for financial years beginning between January 1, 2025 and December 31, 2026. The Directive states that the Commission will revise the first set of ESRS within six months of entry into force and sets July 1, 2027 for limited assurance standards.

US rules: the SEC proposal and California SB 253

The SEC adopted climate disclosure rules on March 6, 2024 and stayed them on April 4, 2024, so they have never taken effect. It proposed to rescind them in full on May 29, 2026, and its website still lists the rescission as a proposed rule. California’s SB 253 applies to business entities with total annual revenue above $1 billion that do business in California. CARB’s proposed regulation sets November 10, 2026 for first Scope 1 and Scope 2 reports, does not require Scope 3 reporting for 2026 and awaits final approval, according to CARB guidance.

Example in practice: a UK manufacturer with an EU subsidiary

This hypothetical scenario applies the thresholds above. A private UK manufacturer has 600 employees, £120 million turnover and a £70 million balance sheet total. It owns a German subsidiary with 300 employees, and its EU net turnover is below €450 million.

• SECR applies because the company is large and unquoted, assuming it used more than 40 MWh of energy.
• ESOS applies through the employee test, with qualification tested on December 31, 2026 and notification due by December 5, 2027.
• CSRD does not apply because the subsidiary has fewer than 1,000 employees and group EU net turnover is below €450 million. A customer in scope may still request value chain information, but the Directive limits what it can require from undertakings with 1,000 or fewer employees.
• The 2022 climate disclosure regulations do not apply because the company is not traded, a bank or an insurer and its turnover is below £500 million.
• UK SRS S1 and UK SRS S2 are available for voluntary use.

Where the frameworks fall short and how to check which apply

Thresholds test legal entities, so a group can hold entities in and out of scope. Dates move by statute or regulator announcement, as 2026 showed for CSRD, ESOS and UK listing rules. ISSB Standards are not law until a jurisdiction or regulator adopts them, and SECR covers energy and carbon only. Four checks confirm which rules apply:

• Confirm each legal entity’s employees, turnover and balance sheet total against its latest accounts.
• Confirm listing status and whether the group has an EU subsidiary or branch.
• Check the regulator’s page for the current date, such as GOV.UK for ESOS or the FCA for listed companies.
• Match each requirement to the version in force, where disclosure management checklists that include ISSB, CSRD and TCFD requirements can support the review.

Matching each rule to its trigger turns five acronyms into one reporting calendar

SECR and ESOS follow UK company size, CSRD follows EU headcount and turnover, ISSB follows adoption and TCFD lives on as the structure inside ISSB Standards, so the five rules sort by trigger. A business that tests each entity against those triggers once a year, and again when a regulator moves a date, knows which reports it owes before the data requests start. Teams that want those requirements held in one place can see how Ideagen disclosure management checklists map ISSB, CSRD and TCFD requirements.

Frequently asked questions

Do companies need to report under both TCFD and ISSB?

No, because the IFRS Foundation states that applying the TCFD recommendations in addition to ISSB Standards is not necessary to obtain information in line with them. Some companies may still need the TCFD recommendations because of jurisdictional requirements, which includes UK listed companies until the FCA’s new rules apply. Check which rules the regulator currently sets before dropping TCFD alignment.

Does SECR apply to small companies?

Usually not, because SECR covers quoted companies, large unquoted companies and large LLPs. Quoted companies of any size must report, subject to the 40 MWh exemption. The government encourages other companies to report in the same way, but that remains voluntary.

What should an organization do if it does not qualify for ESOS?

Check the qualification test, then tell the regulator if it has been contacted before or qualified in an earlier phase. GOV.UK says no further action is needed otherwise, although a non-qualifying organization can carry out an ESOS assessment voluntarily and publish the results through its own reports or website.