Mandatory CSR: what the law requires, from very small companies to large groups

The question rarely comes through a piece of legislation: more often through a CSR questionnaire attached to supplier qualification, or a public tender that has scored bids on an environmental criterion since 21 August 2026. Yet no legislation requires CSR as an overall approach, although around twenty environmental, social and governance obligations fall under it. They are triggered by different criteria: headcount, turnover, building area, energy consumption, fleet size and products placed on the market.

A company with 40 employees operating a 1,200 m² warehouse is therefore subject to the Tertiary Decree, while a group with 800 employees will leave CSRD’s scope once the European Omnibus is transposed. This page classifies these obligations by criterion then by size, with their deadlines from 2026 to 2028, updated on 28 September 2026.

1What is mandatory within CSR?

Corporate social responsibility, or CSR, means, according to the European Commission, responsibility for the impacts of enterprises on society. The Ministry of the Economy presents it as an approach any company can adopt, regardless of size: no legislation requires it as a whole, and the law addresses it through a general principle and targeted obligations.

A management principle enshrined in the Civil Code

Since the 2019 Pacte law, Article 1833 of the Civil Code states that every company is managed in its corporate interest, taking into consideration the social and environmental issues of its activity. The provision applies to all companies, from a single-member SAS to a listed group, but requires no report, indicator or specific penalty: it sets a way of making decisions. The statutory raison d’être and mission-led company, created by the same law, remain optional.

Around twenty specific obligations with penalties

Portail RSE, a free public service, describes 10 schemes in its regulatory fact sheets, from the greenhouse gas emissions inventory to the vigilance plan, of which only one, the VSME standard, is voluntary. Rules on waste, buildings, energy, fleets, products and public procurement bring the total to around twenty obligations.

They cover the usual CSR pillars: the environment (emissions inventory, energy audit, buildings, waste), social matters (gender equality at work, disability, social dialogue) and governance (anti-corruption, whistleblowing, vigilance). Penalties can reach €50,000 for a missing emissions inventory, 2% of turnover for an energy audit not carried out, 1% of payroll for an unpublished gender equality index.

2Headcount is only one of the 6 criteria triggering an obligation

Looking for your obligation in a headcount table means missing nearly half of them: recent legislation targets a building’s area, energy consumption, a number of vehicles or a product, regardless of company size.

Headcount and turnover

Headcount remains the first trigger, with 5 thresholds: 20 employees for employing disabled workers, 50 for social requirements and the whistleblowing system, more than 500 for the greenhouse gas emissions inventory, 1,000 for gender balance in governing bodies and 5,000 for the duty of vigilance. Each provision has its calculation rules: annual average, consecutive financial years, company or group scope.

Turnover almost never acts alone: it combines with headcount for the anti-corruption programme under the Sapin 2 law, from 500 employees and more than €100m, and with the balance sheet for CSRD, which currently covers companies exceeding 2 of the 3 size thresholds in law, before the dual threshold of 1,000 employees and €450m provided for by Omnibus.

Buildings and energy

The tertiary sector energy efficiency scheme covers any building or group of buildings containing at least 1,000 m² of tertiary activities (offices, shops, warehouses, hotels): a 40% reduction in energy consumption in 2030 and annual reporting on the OPERAT platform by 30 September. Owners and tenants share the obligation, as our article on the Tertiary Decree and BACS decree explains. Above 290 kW of heating or air conditioning, the building must also be controlled by an automation system from 2025, then above 70 kW on 1 January 2030.

The law of 30 April 2025 made energy consumption a criterion in its own right: an energy audit every 4 years from 2.75 GWh of average annual consumption, the first before 11 October 2026, and an ISO 50001-certified energy management system from 23.6 GWh. The old size criteria have disappeared, so the mandatory energy audit can cover an energy-intensive SME and spare a much larger service company.

Property projects have their own rules: any new office, retail, industrial or warehouse building with a footprint of more than 500 m² covers 40% of its roof with solar panels or vegetation from 1 July 2026, 50% on 1 July 2027, and outdoor car parks larger than 1,500 m² receive photovoltaic canopies, on 1 July 2026 above 10,000 m² and on 1 July 2028 below that, with a possible postponement subject to conditions.

Vehicles, air conditioning, products and public procurement

A company with at least 100 light vehicles pays an annual incentive tax if low-emission vehicles account for less than 18% in 2026 and 25% in 2027 of those entering its fleet during the last 4 calendar years, at a rate of €4,000 then €5,000 per vehicle shortfall, weighted by its renewal rate; our article on greening fleets explains the calculation. Air-conditioning and refrigeration units containing at least 5 tCO2e of fluorinated gases require leak checks, and the F-gas Regulation removes equipment using the most warming gases from the market.

The activity itself finally triggers obligations: placing a product on the market, which brings it into an extended producer responsibility (EPR) scheme, the Packaging Regulation or the Deforestation Regulation, and bidding for a public contract, since every tender procedure launched from 21 August 2026 includes an environmental criterion.

3Obligations by company size, from 20 to 5,000 employees

Headcount-related obligations accumulate with size: 2 below 20 employees, 9 from 5,000, according to our count of legislation in force, plus CSRD and the anti-corruption programme when turnover or the balance sheet exceeds their thresholds. Building, energy, fleet or product criteria apply additionally at every size.

Fewer than 50 employees: a common foundation

Every company must separate at source its paper, metal, plastic, glass, wood and textile waste, and its biowaste from 1 January 2024; detailed sorting rules apply once it exceeds 1,100 litres of waste a week or does not use public collection. It also keeps a chronological register of the waste it produces. All employers report their employees covered by the disabled worker employment obligation; from 20 employees, they must employ 6% or pay a contribution.

At this size, surprises come from criteria other than headcount: an SME with 30 employees renting a 1,500 m² warehouse falls under the Tertiary Decree, a company of 15 people consuming 3 GWh a year must commission an energy audit, and a young brand selling packaged products joins a producer responsibility organisation.

From 50 to 499 employees: social requirements expand

The 50-employee threshold triggers most social obligations: the gender equality index published every 1 March, the economic, social and environmental database (BDESE) for the Social and Economic Committee (CSE), consultation of the CSE on the environmental consequences of company decisions, and an internal whistleblowing system. With a trade union representative and at least 50 employees on the same site, annual negotiations also cover commuting mobility.

The index will change format: the pay transparency bill, presented to the Council of Ministers on 10 September 2026, retains the current index in 2027 and provides for a switch to 7 new indicators from 2028, keeping the 50-employee threshold.

From 500 to 4,999 employees: emissions inventory and anti-corruption

Above 500 employees (250 in overseas territories), the company publishes a greenhouse gas emissions report (BEGES) every 4 years with a transition plan, or faces a fine of €50,000, €100,000 for a repeat offence, and possible exclusion from public contracts. For a company not required to publish a sustainability report, Article R. 229-47 of the Environmental Code limits mandatory indirect emissions to those from electricity, heat and steam consumed, and scope 3 is required only from companies subject to CSRD.

At 500 employees and more than €100m turnover, the anti-corruption programme under the Sapin 2 law is added, for which the sanctions commission of the French Anti-Corruption Agency can impose up to €1m on a legal person. From 1,000 employees over 3 financial years, senior executives and governing bodies must include at least 30% of each sex from March 2026, then 40% in 2029.

5,000 employees and above: the duty of vigilance

Companies with at least 5,000 employees including their French subsidiaries, or 10,000 including their foreign subsidiaries, establish a vigilance plan covering human rights, health, safety and the environment at their subsidiaries, subcontractors and suppliers. The European Corporate Sustainability Due Diligence Directive (CSDDD), rewritten by Omnibus, will apply only in July 2029, above 5,000 employees and €1.5bn turnover, and no longer requires a climate transition plan; our article on the transition plan reviews what remains required.

4Obligations that follow products placed on the market

For a company that manufactures, imports or distributes, most environmental obligations depend on what it sells, regardless of size, with deadlines staggered by product family between 2026 and 2028.

• Packaging: the European PPWR Regulation has applied from 12 August 2026, with an EU declaration of conformity and PFAS thresholds in food packaging; EPR for professional packaging starts on 1 January 2027 and requires a unique identifier.
• Other EPR schemes: textiles, furniture, electrical equipment and toys fall under more than twenty schemes, with the list and EPR fee calculation covered in a dedicated article.
• Textiles: the law of 8 July 2026 against ultra-fast fashion applies a penalty from 1 September 2026 and bans advertising of these products on 1 January 2027; large companies can no longer destroy unsold clothing and footwear from 19 July 2026.
• Batteries and devices: battery passports and removable batteries on 18 February 2027 (the Council of the EU proposes postponing removability by 18 months for certain categories), and the right to repair for manufacturers of household appliances, screens and smartphones.
• Raw materials: the European Deforestation Regulation (EUDR) applies on 30 December 2026 to large and medium-sized companies placing cocoa, coffee, soya, palm oil, wood, rubber or cattle on the market, and on 30 June 2027 to micro and small companies, except for wood already covered by the 2010 Timber Regulation.
• Construction: the RE2020 2028 carbon threshold for project owners and the reform of EPR for construction products and materials, whose provisions are still awaited.

Communication about these products is also regulated: the European EmpCo Directive, applicable from 27 September 2026 in states that have transposed it, bans in particular unsubstantiated generic environmental claims and, for a product, carbon neutrality based on offsetting; France has not yet transposed it. Our articles on prohibited environmental claims and environmental labelling review what applies in the meantime.

5CSRD: mandatory for whom in 2026, and after Omnibus?

On CSRD, the Corporate Sustainability Reporting Directive, European and French law do not say the same thing on 28 September 2026.

In France, the 2023 thresholds still apply

The Commercial Code still covers large companies exceeding 2 of the 3 thresholds: 250 employees, €50m turnover, €25m balance sheet total. Large public-interest entities with more than 500 employees, such as listed companies, have published from the 2024 financial year; the others will publish in 2028, for the 2027 financial year, following the law of 30 April 2025 that postponed the timetable by 2 years.

Omnibus I Directive (EU) 2026/470, published on 26 February 2026, raises the threshold to more than 1,000 employees and more than €450m turnover, 2 cumulative criteria that will reduce the number of companies concerned by 80%, according to Portail RSE. It must be transposed no later than 19 March 2027, and until then, as Portail RSE points out, its thresholds do not apply in France.

Simplified standards published on 21 September 2026

For companies remaining in scope, the revised European Sustainability Reporting Standards (ESRS) were published in the Official Journal of the Union on 21 September 2026 through Delegated Regulation (EU) 2026/1563. They contain around 61% fewer data points and apply to financial years starting from 1 January 2027, with early application possible from 2026. Our article on Bilan Carbone® and CSRD explains the emissions inventory’s place in this report.

For SMEs, a voluntary standard that will serve as a ceiling

Published on the same day was the voluntary standard intended for companies with no more than 1,000 employees, succeeding the VSME standard recommended by the Commission in July 2025. No company is required to apply it; however, the Omnibus Directive makes it a ceiling, effective once transposed: a customer subject to CSRD will not be able to demand information beyond it from these partners, solely for the data in its sustainability report. Our CSRD guide for SMEs explains its use.

6CSR timetable 2027: deadlines from late 2026 to 2028

From August 2026 to the end of 2028, around fifteen deadlines affect a large number of companies.

Deadlines in late 2026

OPERAT reporting of 2025 consumption is due by 30 September 2026 for tertiary buildings, for which the reporting rate was estimated at only 50 to 60% of the relevant stock in May 2026. The first energy audit must be completed before 11 October 2026, and the Deforestation Regulation applies to large and medium-sized companies on 30 December 2026. EPR for professional packaging starts on 1 January 2027, and the ministry asks every company concerned to have joined a producer responsibility organisation by the end of the year.

The years 2027 and 2028

In 2027, deadlines mainly concern reporting: first financial years under the revised ESRS, the equality index still in its current format on 1 March, Omnibus transposition before 19 March, an energy management system before 11 October for the largest consumers, a 25% fleet quota. In 2028, large companies publish their first CSRD report, the European ETS2 carbon market puts a carbon price on fuels and heating, and car parks of 1,500 to 10,000 m² must be equipped by 1 July.

What has not yet been published

Several expected provisions may still change this timetable: the Omnibus transposition law, expected before 19 March 2027; the pay transparency bill, presented on 10 September; transposition of the EmpCo Directive, adopted by the Senate in February 2026 and awaiting the National Assembly; legislation for the reform of building products EPR. The presidential election adds uncertainty over obligations originating in France, classified in our article on obligations that may change in 2027.

7Below the thresholds, CSR comes through customers

Below all the thresholds, the most pressing requirement often comes from a contract: major customers, public buyers and rating platforms request information that the law does not require directly from the company, to meet their own obligations.

Major customers subject to CSRD or the duty of vigilance

A customer subject to CSRD reports on its value chain emissions, and a purchasing organisation subject to the duty of vigilance regularly assesses its suppliers: for those suppliers, the 2 provisions translate into questionnaires, audits and contractual clauses. The voluntary standard’s ceiling will protect companies with no more than 1,000 employees once Omnibus is transposed, but only for data intended for the customer’s sustainability report.

Public buyers since 21 August 2026

Every tender procedure launched from 21 August 2026 includes at least one environmental award criterion and one environmental performance condition, according to the public service for businesses: price as the sole criterion disappears, and the commitment made in the bid becomes contractual. Our article on the environmental criterion in public contracts explains what earns points. The buyer may also exclude a company that did not publish, the previous year, the BEGES, vigilance plan or sustainability report it was required to produce.

Private ratings and labels

EcoVadis, B Corp, the Lucie label or an SBTi commitment arise from no law: they are voluntary approaches that some customers require by contract. EcoVadis assesses the maturity of a CSR approach without recalculating emissions, and the new B Corp standards make climate action a certification prerequisite. According to Portail RSE, the VSME standard also aims to facilitate access to credit and public procurement.

Where to start

• Record your 6 criteria: average headcount, turnover and balance sheet total, tertiary floor areas and car parks, energy consumption over the last 3 years, number of light vehicles, products placed on the market.
• Date each obligation, starting with those in late 2026: OPERAT, energy audit, EUDR, EPR for professional packaging.
• Prepare what customers request: a Bilan Carbone® covering scopes 1, 2 and 3 and a written social and environmental policy, in the European voluntary standard’s format. Below 500 employees, Diag Décarbon'Action funds part of it.

For us at Projet Celsius, the most costly mistake is believing the issue does not concern you because you are below the CSRD threshold: obligations triggered by a warehouse, an energy bill or a product range fall on fixed dates, and customers in scope expect quantified data well before the law requires it. An energy audit and a Bilan Carbone® carried out together also share part of their data collection.

8Key takeaways

• CSR is not mandatory as an approach: the Civil Code merely asks companies to take social and environmental issues into consideration.
• Around twenty obligations fall under it, triggered by 6 criteria: headcount, turnover, buildings, energy, fleets and products.
• Headcount structures social requirements: 20 employees for disability, 50 for the index and BDESE, more than 500 for BEGES, 5,000 for vigilance.
• CSRD still follows the 2023 thresholds in France; Omnibus, to be transposed before 19 March 2027, reserves it for companies with more than 1,000 employees and €450m.
• Below the thresholds, pressure comes from customers: CSRD questionnaires soon capped by the voluntary standard, vigilance, the environmental criterion in public contracts from 21 August 2026.

Our BEGES guide and our CSRD guide for SMEs explain the 2 reporting obligations; our analyses of SNBC 3 and the PNACC 3 adaptation plan show how the national trajectory reaches companies without a direct obligation.

Further resources

Frequently asked questions

1Is CSR mandatory for an SME?

Not as an overall approach: no law requires an SME to have a CSR policy or CSR report. An SME is, however, subject to specific obligations falling under it: waste and biowaste sorting, a waste register, employing disabled workers from 20 employees, the equality index, BDESE and a whistleblowing system from 50 employees, and, depending on its situation, the Tertiary Decree, energy audit, EPR or environmental criterion in public contracts.

2Is CSRD mandatory for companies with 250 employees?

In French law, it still covers companies exceeding 2 of the 3 thresholds (250 employees, €50m turnover, €25m balance sheet), for a first report in 2028 covering the 2027 financial year. Omnibus I Directive, to be transposed before 19 March 2027, reserves CSRD for companies with more than 1,000 employees and €450m turnover: a company with 250 employees will leave its scope upon transposition.

3Is VSME mandatory?

No: the VSME standard, which became the voluntary standard published in the Official Journal of the Union on 21 September 2026, remains optional for all companies. Once the Omnibus Directive is transposed, no later than 19 March 2027, it will serve as a ceiling: a customer subject to CSRD will not be able to request information beyond it from a partner with no more than 1,000 employees for its sustainability report.

4Which companies must produce a carbon footprint?

The greenhouse gas emissions inventory (BEGES) is mandatory for companies with more than 500 employees (250 in overseas territories), every 4 years, with a transition plan. Companies subject to CSRD also publish their emissions in their sustainability report. Outside CSRD, BEGES requires only scopes 1 and 2; a full Bilan Carbone® remains voluntary, but it is often the first information customers request.

5Is EcoVadis mandatory?

No: EcoVadis is a private rating that no law requires. It becomes a requirement when a customer includes it in supplier qualification or a contract. It assesses the maturity of a CSR approach using documents and replaces neither BEGES nor a sustainability report.

6Which CSR obligations arrive in 2027?

The main ones are EPR for professional packaging on 1 January 2027, the battery passport on 18 February, Omnibus transposition on CSRD before 19 March, application of the Deforestation Regulation to small companies on 30 June, an energy management system from 23.6 GWh on 11 October and a 25% low-emission vehicle quota for fleets of 100 vehicles or more.

Ask Guillaume your questionA personal reply within 24 working hours

Send my questionor: [email protected]