CSR mandates are tightening: what your business has to do now

If you set your CSR plan a year ago, the ground has already shifted under it. In the EU, the Omnibus simplification package narrowed who has to report under the CSRD, pulling thousands of smaller companies out of scope while keeping the largest firmly in. In the US, the federal climate disclosure rule is gone, and individual states have stepped into the gap with their own laws. The result is not less pressure, it is messier pressure: different rules in different markets, and buyers asking suppliers for environmental data regardless of what any regulator requires. If your website still carries old environmental claims from the previous regime, the fastest first move is to scan your claims free with GreenClaim.ai and see what now looks risky. This guide lays out what the mandates actually say in 2026, who they apply to, and the response that holds up no matter which way the rules move next.

What counts as a CSR mandate in 2026?

A CSR mandate is a legal or contractual requirement to disclose, and increasingly to substantiate, your environmental and social impact. Three forces now define the landscape, and they are pulling in different directions.

In the EU, the Corporate Sustainability Reporting Directive was significantly reshaped by the 2025 Omnibus package. Reporting obligations now focus on the largest companies, broadly those with more than 1,000 employees and turnover above 450 million euros, with smaller and listed SME entities largely removed and sector-specific standards delayed. Crucially, the CSRD still reaches non-EU companies with substantial EU revenue and presence, so a US business with a meaningful European operation can still be in scope. It also keeps double materiality: you report both how climate risk affects you and how your business affects people and the planet.

In the US, the federal SEC climate disclosure rule is no longer being enforced, and the action has moved to the states. California’s SB 253 requires large companies, broadly those above 1 billion dollars in revenue, to disclose greenhouse gas emissions, and SB 261 requires companies above 500 million dollars to report climate-related financial risk. More states are expected to introduce similar laws, which means a patchwork rather than a single national standard.

Who actually has to report?

The honest answer is that formal reporting thresholds catch the biggest companies, but the practical reach is far wider. Even if your business sits below every statutory threshold, your largest customers probably do not, and they increasingly pass their obligations down the chain. A procurement questionnaire asking you to evidence your environmental contribution is a mandate in everything but name. The companies winning those tenders are the ones that can answer with specifics rather than sentiment.

The risk most companies miss: the claim, not the activity

Regulators are not only watching whether you act, they are watching what you say. Broad, unsubstantiated environmental language is exactly what the US FTC Green Guides, the UK CMA Green Claims Code, and the EU’s rules are built to challenge. A line on your homepage written for the old environment can become a liability under the new one. Before you rewrite your CSR strategy, it is worth auditing your existing wording. You can check your sustainability copy free and see which phrases now carry risk, and our guide to green claims compliance walks through the fixes.

From reporting to real action: the response that holds up

Whichever way the rules move next, one thing stays true: a specific, verified, documented contribution is defensible, and a vague intention is not. This is where a reforestation programme earns its place in a CSR report. Rather than claiming neutrality, you fund the planting and stewardship of real trees and report exactly what was planted and where.

ForestNation is built for that standard. We plant verified trees in Tanzania with field-measured CO2 data, drawn from a study of thousands of GPS-tagged trees, at 0.025 tonnes of CO2 per tree per year with a 30% uncertainty discount applied so the figure stays conservative. Every tree is tracked and auditable, which is precisely what assured reporting now demands. You can read the full field-measured methodology, build your corporate forest as a programme, or start with a single campaign.

Imagine your sustainability lead at the next board review presenting not a vague slide, but a named company forest, a tree count that reconciles, and a map of exactly where each one is growing. That is the difference between a claim that invites scrutiny and one that survives it.

What to do this quarter

• Confirm whether you, or any of your major customers, fall in scope of the EU CSRD or the new US state laws.
• Audit your existing website and marketing claims for language that no longer holds up.
• Replace neutrality and offset language with specific contribution claims you can evidence.
• Stand up a verified, tracked impact programme so your next report and tender response point to real, auditable action.

Conclusion

CSR mandates are not really heating up so much as splintering: tighter in the EU for the largest companies, fragmented across US states, and quietly universal through the supply chain. Trying to keep pace with the wording is a losing game. The companies that come through it well will be the ones whose claims point to something real, verified, and easy to show. A tracked reforestation contribution is one of the cleanest ways to be that company.

For the bigger picture on positioning your sustainability story credibly, see our guide to green marketing strategies.