Updated August 2026
The thresholds keep rising
In February 2026, the Council of the European Union gave final approval to a package of changes narrowing the Corporate Sustainability Reporting Directive. Companies must now have more than 1,000 employees and above €450 million in annual turnover before they are directly required to report. In California, SB 253 applies only to companies with more than $1 billion in annual revenue, and SB 261 only above $500 million. Measured against thresholds like these, the overwhelming majority of established small and growing businesses are not directly regulated by any major sustainability disclosure law in effect today, and even the rules that do apply keep shifting, as we cover in Where the Climate Disclosure Rules Actually Stand Right Now.
Then why does the pressure keep growing
If regulation were the only driver of sustainability activity, this would be the moment for smaller organizations to quietly stand down. A recent survey found the opposite is happening. Among companies that lost their CSRD reporting obligation entirely under the new thresholds, 90 percent said they plan to maintain or expand their sustainability reporting anyway. The reasons they gave had almost nothing to do with regulation: better operational and resource planning, stronger investor confidence, clearer supply chain risk visibility, and requirements set by customers and partners, not governments.
What this means for a business that is not directly regulated
The lesson is not that sustainability reporting stops mattering once a company falls below a legal threshold. It is that the reporting was rarely about the threshold in the first place. Lenders ask questions before renewing a credit line. Larger customers pass along their own reporting obligations through supplier questionnaires. Insurers, landlords, and acquirers increasingly expect a documented answer, not because a regulator requires it, but because the absence of an answer has become its own red flag. An organization waiting for a law to name it directly before building any sustainability infrastructure is optimizing for the wrong signal.
The practical takeaway
Treat regulatory scope as one data point, not the whole picture. The Implementation Gap Assessment is built around exactly this distinction, sorting what actually applies to a specific business from what does not, so effort goes toward the pressure that is real rather than the headline that is loudest.