Ninety of the 100 large companies analysed in a new study of reports under the EU’s Corporate Sustainability Reporting Directive (CSRD) say they have an established sustainability due diligence process. Only 13 explain how it actually shapes what they report as material. With the EU Forced Labour Regulation (EUFLR) and the Corporate Sustainability Due Diligence Directive (CSDDD) approaching, that gap matters well beyond reporting.
The figures come from Delivering on Sustainability: Evidence from Year 2 of CSRD Implementation, published in October 2026 by Frank Bold, an organisation working to make responsible business the norm in Europe. The study analyses the published sustainability statements of 100 large listed companies and banks that were among the first to report under the CSRD, covering financial year 2025. The companies operate in sectors the report classifies as high risk, including textiles, food and beverage, energy, transport and finance, and are spread across the EU, with just over half based in Central and Eastern Europe.
Due diligence is described, not shown
Most reports describe a process: policies, a supplier code of conduct, a questionnaire, a materiality matrix. What is missing is the output. Few companies say which human rights impacts they consider most severe, how they prioritised, what they did about it and whether it worked. Only 36 of the 100 describe their material impacts in terms specific to their own business. The link between human rights due diligence (HRDD) and the double materiality assessment (DMA) is rarely explained, even though the DMA should build on it.
Engagement with affected people follows the same pattern. Nearly every company refers to stakeholder consultation, often a general survey carried over from voluntary reporting. Frank Bold could confirm that the consultation was relevant to the affected group in only 21 reports.
Few reports look past direct suppliers
Where the most severe risks lie depends on the business. For a mining company they may be in its own operations; for a brand sourcing textiles or electronics they are often further down the supply chain. Frank Bold points to one common weakness: value chain management that stops at Tier 1 suppliers and self-assessment questionnaires. The result is visible in the numbers. Only 3 of the 100 companies report applying living wage benchmarks to workers in their value chain.
This matches what we see in our own work. When we carry out supplier risk analyses, the most severe risks are often found beyond Tier 1, for example forced labour or the exploitation of migrant workers among subcontractors and further down the supply chain. We therefore agree with Frank Bold’s recommendation: prioritise the parts of the value chain where severe impacts are most likely, and deepen the understanding of them step by step, rather than covering every Tier 1 supplier at the same level of detail.
The EUFLR and CSDDD will test what reports claim
The CSRD report is the visible part of a company’s due diligence. Investors, banks and customers read it to judge whether human rights risks are under control, and a generic report suggests they are not.
The EUFLR, which applies from 14 December 2027, will allow products made with forced labour to be banned from the EU market, wherever in the value chain the forced labour occurs. The CSDDD expects companies to identify and address their most severe impacts. A company that cannot name its most severe risks in its report is unlikely to be ready for either.
Test your latest report against three questions
Take your three most severe human rights risks and check whether your latest report lets a reader answer three questions:
→ What did we find?
→ What did we do?
→ What changed as a result?
If you cannot find those answers, start there: with a risk-based assessment beyond Tier 1, not a longer report.
How Enact supports your reporting and due diligence
We help companies make their CSRD reporting specific and decision-useful: from a reporting roadmap and a double materiality assessment that reflects real impacts on people, to identifying and closing gaps in policies, actions, targets and metrics against the ESRS.
As specialists in human rights and human rights due diligence, we can also help with what the report should rest on: supplier risk analyses beyond Tier 1, human rights impact assessments, and due diligence processes that meet the expectations of the CSDDD and EUFLR.
Read more about our sustainability reporting services and if you want to discuss your next report, contact us at info@enact.se.
Maja Iwar-Svensson