CSRD for Medical Device Companies: Sustainability Reporting Requirements in 2026

How the EU Corporate Sustainability Reporting Directive affects medical device manufacturers — scope, ESRS standards, double materiality, timelines, Omnibus simplification, and practical compliance steps for MedTech.

The EU Sustainability Reporting Obligation That Reshaped Corporate Disclosure

The Corporate Sustainability Reporting Directive (CSRD) -- Directive (EU) 2022/2464 -- is the most far-reaching sustainability disclosure regulation ever adopted by the European Union. It replaced the Non-Financial Reporting Directive (NFRD, Directive 2014/95/EU), which had applied to roughly 11,700 companies with thin and inconsistent disclosure requirements. CSRD expanded mandatory sustainability reporting to approximately 50,000 EU companies, introduced binding European Sustainability Reporting Standards (ESRS), and required auditable, machine-readable disclosures covering environmental, social, and governance topics across the full value chain.

For the medical device and in vitro diagnostics industry, CSRD matters because the MedTech value chain is deeply entangled with sustainability issues. Device manufacturers source raw materials globally, operate energy-intensive manufacturing facilities with strict cleanroom requirements, use sterilization processes with significant environmental footprints, produce large volumes of single-use products and packaging, and sell into healthcare systems under mounting pressure to decarbonize. Every one of those activities generates disclosures under ESRS.

The regulatory landscape shifted again in early 2026. The Omnibus I Directive ((EU) 2026/470), published in the Official Journal of the European Union on February 26, 2026 and entered into force on March 18, 2026, significantly simplified CSRD by raising scoping thresholds, eliminating SME reporting requirements, removing the escalation to reasonable assurance, and mandating simplified ESRS. Approximately 80 percent of companies previously in scope were removed overnight. But for the large medical device manufacturers that remain in scope -- and for those still subject to Wave 1 reporting obligations -- the compliance clock is still running.

This guide covers the current state of CSRD as of May 2026, with particular focus on what the directive means for medical device and IVD manufacturers.

CSRD Scope After Omnibus: Which MedTech Companies Are Affected

Original Scope (Pre-Omnibus)

The original CSRD, adopted in December 2022, applied a staggered approach with three waves for EU companies and a fourth wave for non-EU companies:

Wave	Criteria	First Reporting Year
Wave 1	Companies already subject to NFRD (public interest entities with 500+ employees)	FY 2024 (reporting in 2025)
Wave 2	Large companies meeting two of three: >250 employees, >EUR 25M balance sheet, >EUR 50M net turnover	FY 2025 (reporting in 2026)
Wave 3	Listed SMEs meeting two of three: >10 employees, >EUR 900K turnover, >EUR 450K balance sheet	FY 2026 (reporting in 2027)
Wave 4	Non-EU companies with >EUR 150M EU net turnover and an EU subsidiary or branch meeting thresholds	FY 2028 (reporting in 2029)

Revised Scope (Post-Omnibus, March 2026)

The Omnibus I Directive raised the thresholds dramatically. Under the revised CSRD, mandatory reporting now applies only to companies meeting both of the following criteria:

More than 1,000 employees (average over the financial year)
More than EUR 450 million net turnover

This replaces the previous "two of three" size test and the much lower employee threshold of 250. In addition:

Listed SME reporting requirements are eliminated entirely. The Wave 3 category no longer exists.
Non-EU company thresholds were also raised: the parent undertaking must have EU-generated turnover above EUR 450 million, and at least one EU subsidiary or branch must generate turnover above EUR 200 million.
Approximately 80 to 85 percent of companies previously subject to CSRD are now out of scope.

Transition Relief for Wave 1 Companies

Companies that were already reporting under Wave 1 (FY 2024) but no longer meet the revised thresholds cannot simply stop. CSRD obligations continue for original Wave 1 companies through the 2026 reporting year, meaning they must publish reports in 2026 (covering FY 2025 data) and in 2027 (covering FY 2026 data). However, EU member states may issue an exemption to relieve these companies of reporting for FY 2025 and FY 2026. This is on a country-by-country basis, so companies must check national transposition measures.

What This Means for MedTech

The revised thresholds mean that only the largest medical device manufacturers remain in mandatory scope. Companies like Siemens Healthineers, Philips, Medtronic, Abbott, Johnson & Johnson (MedTech), Becton Dickinson, Stryker, Boston Scientific, and Zimmer Biomet -- all with well over EUR 450 million in EU turnover and more than 1,000 employees -- are firmly in scope. Mid-size device manufacturers with EU revenues below EUR 450 million are now out of scope for mandatory reporting.

However, being out of scope does not mean being unaffected. Large in-scope companies must report on their value chains, which means they will continue requesting sustainability data from their suppliers -- including smaller MedTech companies that supply components, materials, or contract manufacturing services. The Omnibus introduced value chain protections that limit disproportionate data requests to SMEs, but suppliers should still expect to receive questionnaires aligned with the Voluntary Standard for SMEs (VSME).

Timeline and Reporting Waves in 2026

The reporting timeline has been reshaped by two legislative interventions: the "Stop-the-Clock" Directive ((EU) 2025/794), which entered into force on April 17, 2025, and the Omnibus I Directive ((EU) 2026/470). The current timeline is as follows:

Financial Year	Reporting Year	Who Reports
FY 2024	2025	Wave 1 companies (those already subject to NFRD) -- first CSRD reports published
FY 2025	2026	Wave 1 companies continue; companies above revised thresholds file second report
FY 2027	2028	Wave 2 begins: large companies meeting revised thresholds (>1,000 employees, >EUR 450M turnover)
FY 2028	2029	Non-EU companies with >EUR 450M EU turnover and qualifying EU subsidiary/branch

Key points:

Wave 2 was postponed by two years. Originally scheduled to report for FY 2025, these companies now report for FY 2027 (in 2028).
Wave 3 is eliminated. Listed SMEs are no longer required to report under CSRD.
Simplified ESRS are expected to be adopted by the European Commission by approximately September 2026, in time for companies to apply them for FY 2027 reporting.
Member states must transpose the Omnibus I Directive into national law by March 19, 2027.

For a large EU-based medical device manufacturer already in Wave 1, the current reality is straightforward: file the second CSRD report in 2026 (FY 2025 data) using the existing ESRS Set 1, and prepare for the simplified ESRS when they become applicable. For a non-EU device manufacturer with significant EU revenue, the first reporting year is FY 2028, with the Non-EU ESRS expected no earlier than October 2027.

The ESRS Framework: What Companies Must Report On

The European Sustainability Reporting Standards (ESRS) are the technical standards that operationalize CSRD reporting requirements. They were developed by EFRAG (the European Financial Reporting Advisory Group), adopted by the European Commission on July 31, 2023 as a Delegated Act, and became effective for Wave 1 companies starting with FY 2024.

Structure of ESRS Set 1

ESRS Set 1 comprises 12 standards organized into four groups:

Cross-Cutting Standards

Standard	Title	Purpose
ESRS 1	General Requirements	Defines the conceptual architecture: double materiality, reporting boundaries, qualitative characteristics, presentation
ESRS 2	General Disclosures	Mandatory for all reporters -- covers governance, strategy, impact/risk/opportunity management, metrics and targets

Environmental Standards (E1-E5)

Standard	Title	Key Disclosures
ESRS E1	Climate Change	GHG emissions (Scope 1, 2, 3), transition plans, energy consumption, carbon pricing
ESRS E2	Pollution	Air, water, soil pollution; substances of concern; microplastics
ESRS E3	Water and Marine Resources	Water consumption, water stress areas, marine ecosystems
ESRS E4	Biodiversity and Ecosystems	Impact on biodiversity, land use change, ecosystem services
ESRS E5	Resource Use and Circular Economy	Material inflows/outflows, waste, product design for circularity

Social Standards (S1-S4)

Standard	Title	Key Disclosures
ESRS S1	Own Workforce	Working conditions, equal treatment, freedom of association, health and safety
ESRS S2	Workers in the Value Chain	Supply chain labor conditions, child labor, forced labor
ESRS S3	Affected Communities	Community rights, indigenous peoples, land-related impacts
ESRS S4	Consumers and End-Users	Product safety, responsible marketing, data privacy

Governance Standard (G1)

Standard	Title	Key Disclosures
ESRS G1	Business Conduct	Anti-corruption, bribery, lobbying, political engagement, supplier payment practices

Reporting Mechanics

ESRS 1 and ESRS 2 are mandatory for all in-scope companies. The topical standards (E1-E5, S1-S4, G1) are applied based on the outcome of the double materiality assessment: a company reports on a topic only if it has been assessed as material from either the impact or financial perspective (or both).

The original ESRS Set 1 contained approximately 1,000 data points. Under the simplified ESRS proposed by EFRAG in its December 2025 technical advice to the European Commission, this has been reduced by approximately 61 to 70 percent, to roughly 300 to 400 data points. The simplification retains the overall architecture but emphasizes principles-based narrative disclosures, proportionality, and decision-usefulness.

Sector-Specific Standards: Status

Sector-specific ESRS were originally planned for adoption alongside the cross-sectoral standards. The Omnibus I Directive has now removed the Commission's power to adopt sector-specific standards. Instead, the Commission may provide sector-specific guidance depending on demand from reporting companies. This is significant for MedTech: there will not be a formal ESRS standard tailored to medical devices, but companies still apply the cross-sectoral ESRS to their industry-specific circumstances.

Double Materiality: The Core Assessment Methodology

Double materiality is the conceptual foundation of CSRD reporting. It requires companies to assess sustainability topics from two independent perspectives:

Impact materiality (inside-out): How the company's activities and business relationships cause or contribute to actual or potential impacts on people and the environment. This covers the full value chain -- from raw material extraction through product end-of-life.
Financial materiality (outside-in): How sustainability-related risks and opportunities affect the company's financial position, financial performance, cash flows, cost of capital, or access to finance over the short, medium, and long term.

A sustainability topic requires disclosure if it is material from either perspective. Most material impacts will also generate financial risks or opportunities over time, but the two dimensions must be assessed independently.

The DMA Process

Conducting a double materiality assessment (DMA) involves several structured steps:

Step 1: Define the scope and boundaries. Identify the reporting entity, its value chain (upstream and downstream), the time horizons (short: 0-2 years, medium: 2-5 years, long: 5+ years), and the list of sustainability topics to assess. ESRS 1 and EFRAG's Implementation Guidance provide the reference list of sustainability matters, sub-topics, and sub-sub-topics.

Step 2: Identify impacts, risks, and opportunities (IROs). For each sustainability topic, identify actual and potential impacts (positive and negative, caused or contributed to by the company), as well as financial risks and opportunities arising from sustainability dependencies. This requires input from operations, procurement, R&D, regulatory affairs, quality, and commercial teams.

Step 3: Assess impact materiality. Evaluate the severity (scale, scope, irremediable character) and likelihood of actual and potential impacts. Score and prioritize. Engage affected stakeholders -- including workers, communities, patients, healthcare professionals, and civil society organizations -- to validate the assessment.

Step 4: Assess financial materiality. Evaluate how identified sustainability risks and opportunities could affect the company's financial performance and position. This requires input from finance, risk management, and investor relations teams.

Step 5: Determine material topics and disclose. Topics meeting the materiality threshold on either dimension are subject to mandatory disclosure. Document the methodology, assumptions, stakeholder engagement process, and governance of the DMA. ESRS 1 requires that the basis of preparation disclose the DMA methodology in detail.

Step 6: Review and update. The DMA is not a one-time exercise. It must be revisited annually or whenever material changes occur in the company's operations, structure, or external environment.

MedTech Considerations in Double Materiality

For medical device manufacturers, the DMA yields industry-specific patterns. Topics that typically score high on impact materiality include:

Resource use and circular economy (ESRS E5): Medical devices generate substantial material flows, and the tension between single-use devices (infection control) and circular economy principles (waste reduction) is a defining industry challenge.
Pollution (ESRS E2): Ethylene oxide sterilization emissions, chemical use in manufacturing, and pharmaceutical residues from combination products all carry pollution impacts.
Climate change (ESRS E1): Energy-intensive manufacturing (cleanrooms, sterilization), cold-chain logistics, and global supply chains drive significant Scope 1, 2, and 3 emissions.
Own workforce and value chain workers (ESRS S1, S2): Labor conditions in electronics and plastics supply chains, particularly in emerging markets, are a persistent concern.
Consumers and end-users (ESRS S4): Patient safety, access to healthcare, and the affordability of medical technology have direct social impact dimensions.

MedTech-Specific Sustainability Topics Under CSRD

Climate Change and Greenhouse Gas Emissions (ESRS E1)

Medical device manufacturing is energy-intensive. Maintaining ISO Class 7 and Class 8 cleanrooms requires continuous air filtration, temperature control, and humidity management. Sterilization processes -- whether ethylene oxide (EtO), gamma irradiation, steam, or electron beam -- consume significant energy and in some cases generate direct emissions. Global distribution networks with temperature-controlled logistics add to the carbon footprint.

Under ESRS E1, MedTech companies must disclose:

Scope 1 emissions from owned or controlled sources (sterilization, on-site energy generation, company vehicles)
Scope 2 emissions from purchased electricity, heat, and steam (cleanroom operations, manufacturing lines)
Scope 3 emissions across the value chain -- typically the largest share for device companies, driven by purchased goods and services (raw materials, components), upstream transportation, and the use and disposal of sold products

For Wave 1 reporters, Scope 3 disclosure was required from the first reporting year. Under the simplified ESRS, Scope 3 requirements are expected to be streamlined, but the obligation to disclose material value chain emissions remains.

Resource Use and Circular Economy (ESRS E5)

ESRS E5 is arguably the most directly relevant environmental standard for medical device companies. It requires disclosure on:

Resource inflows: The types and quantities of materials entering the company, including critical raw materials, recycled content, and renewable resources
Resource outflows: Products and materials leaving the company, including the percentage designed along circular principles (durability, reparability, recyclability, reusability)
Waste: Waste generated by type (hazardous vs. non-hazardous), waste diverted from disposal (preparation for re-use, recycling, other recovery), and waste directed to disposal (incineration, landfill)

The MedTech circular economy challenge is structural. Many devices are designed for single use for legitimate infection control reasons. Regulatory requirements under EU MDR mandate specific packaging, sterility, and performance standards that can conflict with circular design principles. ESRS E5 acknowledges these tensions but still requires disclosure on resource efficiency and circular economy practices.

Practical disclosures for MedTech companies include:

The weight and proportion of single-use vs. reusable devices in the product portfolio
Packaging minimization efforts and recycled content in packaging
Reprocessing programs for devices eligible for reprocessing under FDA or EU frameworks
Critical raw materials used in devices (e.g., rare earth elements in imaging equipment, platinum in electrodes)
End-of-life take-back or recycling programs

Pollution (ESRS E2)

Medical device manufacturing involves substances of concern. Ethylene oxide is classified as a carcinogen and is under increasing regulatory scrutiny -- the EU has set strict emission limits, and the US EPA finalized a rule in 2024 strengthening EtO emission standards for commercial sterilization facilities. ESRS E2 requires disclosure on:

Pollutant emissions to air, water, and soil
Substances of concern and substances of very high concern (SVHC) used in manufacturing and present in products
Microplastics generated or released

For companies operating EtO sterilization facilities, this standard requires detailed quantitative emission data.

Supply Chain Transparency (ESRS S2, E1 Scope 3)

The MedTech supply chain is global and multi-tiered. A single device may contain components sourced from dozens of countries, with raw materials (titanium, stainless steel, polymers, electronic components, rare earth elements) extracted and processed across multiple jurisdictions. Under CSRD, companies must report on sustainability impacts in the value chain, not just their own operations.

This is operationally challenging. Collecting Scope 3 emissions data, labor practice information, and environmental impact data from hundreds of suppliers -- many of which lack their own sustainability reporting infrastructure -- requires significant investment in supplier engagement, data platforms, and estimation methodologies.

The Omnibus introduced value chain protections: in-scope companies can only request limited information from SMEs in their value chain, aligned with the VSME. There is also a three-year transitional relief period for value chain reporting, allowing companies to use estimates and explain where actual data is unavailable.

Several social standards have MedTech-specific dimensions:

ESRS S4 (Consumers and End-Users): Patient safety is the core regulatory mandate of the medical device industry, and the intersection with sustainability reporting is direct. Companies must disclose product safety information, responsible marketing practices, and data privacy measures.
ESRS S2 (Workers in the Value Chain): Labor conditions in electronics manufacturing, plastics production, and mining of raw materials are material for most device companies.
ESRS S3 (Affected Communities): Manufacturing facilities and mining operations may affect local communities through pollution, water use, or land rights impacts.

Governance (ESRS G1)

ESRS G1 covers business conduct including anti-corruption, bribery, lobbying, and political engagement. For MedTech companies, these topics have particular resonance given the industry's history of compliance challenges related to interactions with healthcare professionals, government procurement, and regulatory lobbying. Companies must disclose:

Anti-corruption and anti-bribery policies and their implementation
Confirmed incidents of corruption and actions taken
Lobbying and political engagement activities and expenditures
Payment practices (average payment terms to suppliers)

How CSRD Interacts With EU MDR and Other Regulations

CSRD does not exist in isolation. For medical device manufacturers, it interacts with several overlapping EU regulatory frameworks, creating both compliance synergies and potential tensions.

EU MDR (Regulation (EU) 2017/745) and IVDR (Regulation (EU) 2017/746)

The Medical Device Regulation and the IVD Regulation contain provisions that intersect with sustainability:

GSPR (General Safety and Performance Requirements): Annex I of EU MDR includes requirements related to chemical, physical, and biological properties of devices (GSPR 10-12), which overlap with pollution and hazardous substance disclosures under ESRS E2. Devices must be designed and manufactured to minimize risks from substances, including those that are carcinogenic, mutagenic, or toxic to reproduction (CMR) or have endocrine-disrupting properties.
Risk management: ISO 14971 risk management processes, which are central to MDR compliance, generate data on environmental hazards that can feed into ESRS E1, E2, and E5 disclosures.
Technical documentation: The technical file requirements under MDR Annex II and III contain information on materials, manufacturing processes, and product lifecycle that overlaps with ESRS resource use and circular economy disclosures.

The European Commission's February 2026 proposals to simplify MDR and IVDR may further integrate environmental considerations into device regulation, creating additional data synergies with CSRD reporting.

EU Taxonomy Regulation

The EU Taxonomy requires in-scope companies to disclose the proportion of their activities that are "environmentally sustainable" under the Taxonomy's technical screening criteria. For MedTech companies, this means assessing which products, services, and capital expenditures qualify under the six environmental objectives (climate mitigation, climate adaptation, sustainable use of water and marine resources, transition to a circular economy, pollution prevention, and biodiversity protection).

The Omnibus also introduced changes to the EU Taxonomy, limiting its application to companies in scope of the revised CSRD thresholds. The European Commission has signaled further simplification of Taxonomy reporting obligations.

Eco-Design for Sustainable Products Regulation (ESPR)

The ESPR (Regulation (EU) 2024/1781) establishes a framework for eco-design requirements across product categories. While medical devices have a conditional exemption for aspects already covered by MDR/IVDR (Article 1(2)(h)), the ESPR introduces the Digital Product Passport (DPP) concept. The ESPR central registry is expected to be operational by July 2026, with DPP requirements for batteries by February 2027. Medical devices may eventually be brought into scope through delegated acts.

DPP data requirements -- material composition, carbon footprint, recyclability, repairability -- overlap substantially with ESRS E5 disclosures. Companies investing in DPP compliance infrastructure will find that the same data supports CSRD reporting.

Corporate Sustainability Due Diligence Directive (CSDDD)

The CSDDD (Directive (EU) 2024/1760) was also simplified by the Omnibus I Directive. The revised thresholds are significantly higher (>5,000 employees and >EUR 1.5 billion net turnover), meaning fewer MedTech companies will be directly subject to due diligence obligations. However, CSDDD requires in-scope companies to identify, prevent, mitigate, and account for adverse human rights and environmental impacts in their value chains -- which directly supports the value chain reporting required under CSRD.

Practical Compliance Roadmap: Seven Steps for MedTech Companies

Step 1: Determine Whether Your Company Is in Scope

This sounds simple but requires careful analysis:

Calculate average headcount and net turnover using the definitions in the Accounting Directive (Directive 2013/34/EU), as amended by Omnibus.
For non-EU companies, calculate EU-generated turnover and determine whether you have a qualifying EU subsidiary or branch.
Consider consolidated vs. standalone reporting: thresholds apply at the consolidated group level for parent companies.
Check whether your member state has issued a Wave 1 transition exemption, if applicable.

Even if your company is below the revised thresholds, assess whether your customers (who may be in scope) will request sustainability data from you as part of their value chain reporting.

Step 2: Conduct a Double Materiality Assessment

The DMA is the foundation of your CSRD report. For MedTech companies:

Assemble a cross-functional team: sustainability, regulatory affairs, quality, operations, procurement, finance, legal, and commercial.
Map your value chain: identify the upstream suppliers and downstream customers/distributors that generate the most significant sustainability impacts.
Use EFRAG's list of sustainability matters as the starting point. For each topic, assess impact materiality (severity and likelihood of impacts) and financial materiality (magnitude and likelihood of financial effects).
Engage external stakeholders: patients, healthcare professionals, advocacy groups, and local communities affected by manufacturing operations.
Document everything: the DMA methodology, assumptions, data sources, stakeholder engagement process, and governance oversight must be disclosed in the basis of preparation.

Under the simplified ESRS, DMA requirements are expected to be more principles-based, reducing the prescriptiveness of the assessment methodology. However, the fundamental dual-perspective approach remains.

Step 3: Perform a Gap Analysis Against ESRS Requirements

For each material topic identified in the DMA, map your current data and disclosure capabilities against the applicable ESRS disclosure requirements:

What data do you already collect? (GHG emissions from ISO 14001 systems, waste data from environmental permits, workforce data from HR systems)
What data is missing? (Scope 3 emissions from value chain, biodiversity impact data, product-level circularity metrics)
What processes need to be established or upgraded? (Data collection from subsidiaries, supplier engagement for value chain data, internal controls for sustainability data)
Where are the estimation methodologies acceptable, and where is primary data required?

Step 4: Build Data Collection Infrastructure

This is where most MedTech companies encounter the steepest learning curve. Sustainability data collection requires:

Centralized data management: A platform or system that can collect, validate, and store sustainability data from multiple sites, business units, and jurisdictions. This may be a dedicated ESG data platform or an extension of existing ERP/QMS systems.
Standardized methodologies: Consistent calculation methods for GHG emissions (GHG Protocol), water consumption, waste categorization, and other metrics across all reporting entities.
Supplier engagement: Processes for collecting sustainability data from suppliers, ranging from simple questionnaires to integration with supplier management systems. The VSME provides a framework for requesting data from SME suppliers.
Internal controls: Policies and procedures to ensure the accuracy, completeness, and reliability of sustainability data, similar to financial reporting controls.

Step 5: Establish Governance and Internal Controls

CSRD requires companies to integrate sustainability governance into their corporate governance framework:

Board oversight: The administrative, management, and supervisory bodies must oversee sustainability matters. Disclose the governance structure, the body responsible for sustainability, and its competencies.
Management responsibility: Define roles and responsibilities for sustainability data collection, reporting, and assurance across the organization.
Internal controls: Implement controls over sustainability data that are proportionate to those applied for financial reporting. This includes data validation, reconciliation, segregation of duties, and audit trail requirements.
Incentive alignment: Disclose whether any incentive schemes for members of administrative, management, and supervisory bodies are linked to sustainability matters.

Step 6: Prepare for Limited Assurance Engagement

CSRD requires an independent third-party assurance opinion on the sustainability statement. Under the Omnibus, this remains at the limited assurance level -- the planned escalation to reasonable assurance has been removed.

Key points for assurance preparation:

The EU limited assurance standard is expected to be adopted by the Commission by July 1, 2027.
Until the EU standard is adopted, assurance practitioners will apply existing standards (typically ISAE 3000).
Engage your assurance provider early in the reporting process, not just at the end. Involve them in the DMA, data collection design, and internal control assessment.
Prepare comprehensive documentation: policies, methodologies, data sources, calculations, assumptions, and evidence of management review.
Expect the assurance provider to test a sample of disclosures for accuracy and completeness.

Step 7: Draft, Review, and Submit the CSRD Report

The sustainability statement must be:

Included as a dedicated section of the management report (not a standalone document)
Prepared in XHTML format per the European Single Electronic Format (ESEF)
Digitally tagged using XBRL taxonomy (once the ESRS XBRL taxonomy is formally adopted by the Commission)
Published alongside the annual financial statements

The XBRL tagging requirement is not merely a formatting exercise. Every quantitative metric and many qualitative disclosures must carry a digital tag from the ESRS taxonomy, enabling machine readability and automated comparison by regulators, investors, and data aggregators. EFRAG is updating the XBRL taxonomy to align with the simplified ESRS, with updated taxonomy expected by December 2026.

Data Collection and Governance Challenges Specific to MedTech

Global Supply Chain Complexity

Medical device companies source from hundreds or thousands of suppliers across dozens of countries. Tier 1 suppliers may provide basic sustainability data, but Tier 2 and Tier 3 suppliers -- where many of the most significant environmental and social impacts occur (raw material extraction, basic component manufacturing) -- often lack the infrastructure to provide ESRS-compliant data.

The Omnibus's value chain relief measures help: companies may use estimates for value chain data during a transitional period and are protected from having to request disproportionate information from SME suppliers. However, the underlying challenge remains: building a sustainability data picture across a complex, multi-tier supply chain requires sustained investment in supplier relationships, data platforms, and estimation methodologies.

Site-Level Data Granularity

Biodiversity (ESRS E4) and water (ESRS E3) disclosures require site-level data. A MedTech company with manufacturing facilities in water-stressed regions (e.g., parts of India, China, the Middle East, or the Mediterranean) must disclose water consumption at the site level and assess impacts on local water systems. Similarly, facilities located near protected habitats must assess and disclose biodiversity impacts.

This level of granularity goes beyond what most companies currently collect. Environmental management systems (ISO 14001) may capture total water withdrawal and waste generation, but linking that data to site-specific ecological context requires additional analysis.

Subsidiary and Cross-Border Methodology Alignment

Large device manufacturers typically operate subsidiaries in multiple EU member states and beyond. Each subsidiary may collect data using different systems, methodologies, and reporting boundaries. Ensuring consistent application of the ESRS methodology across the group -- from Scope 1 emission calculations at a sterilization facility in Germany to waste categorization at a packaging plant in Ireland -- requires centralized guidance, standardized templates, and a robust consolidation process.

Cross-Functional Coordination

CSRD reporting cannot be delegated to the sustainability team alone. The data required spans:

Operations: Energy consumption, waste generation, water use, production volumes
Procurement: Supplier sustainability data, raw material sourcing, critical raw materials
Regulatory affairs: Product safety data, MDR compliance information, substance information
Quality: Non-conformances, corrective actions, product recall data
Finance: Capital expenditure on sustainability initiatives, cost of environmental compliance, revenue from sustainable products
Human resources: Workforce demographics, health and safety data, training
Legal: Compliance incidents, litigation, lobbying expenditures
R&D: Product design for circularity, material innovation, lifecycle assessment

Establishing a cross-functional reporting governance structure, with clear data ownership and accountability, is essential. Many MedTech companies find that CSRD reporting is the catalyst for breaking down organizational silos that have existed for years.

Assurance and Verification Requirements

Limited Assurance: The Current Standard

Under the Omnibus-revised CSRD, limited assurance is the permanent standard. The previous plan to escalate to reasonable assurance by 2028 has been removed. This is a meaningful simplification: limited assurance provides a moderate level of confidence that the sustainability information is free from material misstatement, whereas reasonable assurance (equivalent to a financial audit) would have required substantially more rigorous testing and evidence.

However, limited assurance still demands:

A systematic process of inquiry, analytical procedures, and limited testing
Documentation of the reporting entity's internal controls over sustainability information
Assessment of the appropriateness of methodologies, assumptions, and estimates
Evaluation of the presentation and disclosure of sustainability information

The Commission must adopt the EU limited assurance standard by July 1, 2027. Until then, assurance providers apply existing standards.

Who Can Provide Assurance

Assurance must be provided by:

Statutory auditors or audit firms already authorized to audit financial statements in the relevant member state
Independent assurance services providers (IASPs), a new category of provider that member states may authorize specifically for sustainability reporting assurance

The Omnibus introduced simplified registration conditions for third-country auditors, with a transitional period through 2030 for auditors providing assurance on non-EU entities.

Digital Tagging and Machine Readability

CSRD requires sustainability information to be digitally tagged using the ESRS XBRL taxonomy, integrated into the European Single Electronic Format (ESEF). This means:

Every quantitative metric (e.g., tonnes of CO2e, cubic meters of water consumed, tonnes of waste generated) must carry a digital tag
Qualitative disclosures are also tagged where taxonomy elements exist
The tagged report is machine-readable, enabling automated data extraction by regulators (through the European Single Access Point), investors, rating agencies, and data aggregators

EFRAG is developing an updated XBRL taxonomy aligned with the simplified ESRS. The taxonomy is expected to be available by late 2026, with consultation on the updated taxonomy beginning in mid-July 2026.

What to Do Now -- Even If Not Yet in Scope

Many MedTech companies that were previously in scope have been removed by the Omnibus threshold increase. But there are several reasons to continue investing in sustainability reporting capability:

Value Chain Pressure From In-Scope Customers

If your company supplies components, materials, or contract manufacturing services to large device manufacturers that remain in scope, those customers must report on their value chains. They will request sustainability data from you -- aligned with the VSME, if you are an SME, or with the full ESRS framework if you are a larger supplier. Being able to provide this data efficiently is a competitive advantage; being unable to do so is a commercial risk.

Investor and Lender Expectations

Even without a regulatory mandate, investors and lenders increasingly expect sustainability disclosure. Private equity firms, banks, and institutional investors use ESG data in due diligence, portfolio monitoring, and lending decisions. Companies with robust sustainability data infrastructure have better access to capital.

National and Sector-Specific Requirements

Individual EU member states may introduce national sustainability reporting requirements that go beyond the CSRD minimum. Some member states already have national supply chain due diligence laws (e.g., Germany's Supply Chain Due Diligence Act, France's Duty of Vigilance Law). These laws remain in force regardless of the Omnibus simplification.

The Direction of Travel Is Clear

The Omnibus simplified CSRD, but it did not reverse the fundamental principle that large companies must report on sustainability. The thresholds may be adjusted again in the future, the simplified ESRS may be expanded, and sector-specific guidance may emerge. Companies that build sustainability data infrastructure now will be prepared for whatever comes next.

Practical Immediate Steps for Out-of-Scope Companies

Adopt the VSME for voluntary reporting. EFRAG published the VSME in December 2024, and it is expected to be adopted by the Commission as a delegated act by June or July 2026. Using the VSME provides a structured framework for disclosure that is proportionate to SME capabilities.
Conduct a streamlined materiality assessment. Even a simplified DMA -- identifying the top 5-10 sustainability topics most relevant to your business and stakeholders -- provides strategic value and prepares you for future reporting obligations or customer requests.
Start collecting Scope 1 and 2 emissions data. This is the foundation of climate reporting and relatively straightforward to implement using energy bills and emission factors.
Map your value chain. Understand where your most significant sustainability impacts occur, even if you are not yet required to quantify them.
Engage with key customers. Understand what sustainability data your largest customers need from you, and develop processes to provide it efficiently.
Monitor regulatory developments. The simplified ESRS will be adopted in 2026, national transposition measures will emerge through early 2027, and the non-EU ESRS is expected by late 2027. Stay informed through EFRAG's Knowledge Hub and your industry association.

The Regulatory Landscape Is Simplified, Not Simplistic

The Omnibus I Directive represented a genuine simplification of CSRD. Higher thresholds removed the vast majority of companies from mandatory scope. The elimination of sector-specific standards, the removal of reasonable assurance escalation, and the reduction of ESRS data points by over 60 percent all meaningfully reduced the compliance burden.

But for the large medical device manufacturers that remain in scope -- and there are many -- the requirements are still substantial. Double materiality assessments, value chain reporting, limited assurance, digital tagging, and the full suite of ESRS topical standards apply. Wave 1 companies are filing their second reports in 2026 under the existing ESRS, and Wave 2 companies must prepare for their first reports in 2028 under the simplified standards.

The most effective approach for MedTech companies is to treat CSRD not as a compliance checkbox but as a strategic exercise. The DMA reveals business risks and opportunities. The data collection infrastructure supports operational efficiency and supplier management. The governance structures strengthen decision-making. And the disclosures build trust with investors, customers, regulators, and patients. Companies that invest seriously in sustainability reporting capability -- whether or not they are currently in scope -- will be better positioned in a market that is moving, with accelerating speed, toward mandatory transparency.