The immediate task is not to build a full report around a proposal. It is to determine whether your group is plausibly in scope, identify which entities would publish the report, test whether the proposed global and EU-related reporting boundaries are workable, and document the questions that need legal or technical confirmation.

What Is ESRS-40a Reporting?

ESRS-40a is the proposed European Sustainability Reporting Standard for certain undertakings governed by the law of a country outside the European Union. It is being developed under Article 40a of the EU Accounting Directive for large non-EU groups with significant EU activity.

EFRAG, an independent private association established in 2001 to advise the European Commission on corporate reporting standards ,published the ESRS-40a exposure draft and consultation materials on 23 July 2026. The consultation closes on 31 October 2026. EFRAG plans to use the feedback to finalize its technical advice to the European Commission, which is expected in January 2027. The Commission will then follow its own process before adopting a delegated act.

That sequence matters. The exposure draft is a credible basis for readiness planning, but it is not the final standard. Any implementation decision should identify which points come from the Accounting Directive, which come from EFRAG’s current proposal, and which remain subject to change.

VECTRA’s guide to ESG gap analysis and pre-audit remediation planning uses the same discipline: establish the requirement, record the current evidence, distinguish confirmed gaps from open interpretations, and assign a proportionate next action.

Who Is Expected to Be in Scope of ESRS Reporting Under Article 40a?

EFRAG’s current project page states that, following the Omnibus amendments, Article 40a applies when a non-EU undertaking meets both parts of the scope test.

The undertaking must:

•      generate more than EUR 450 million in net turnover in the EU in each of the last two consecutive financial years; and

•      either have an EU branch generating more than EUR 200 million or be the ultimate parent of EU subsidiaries generating more than EUR 200 million.

This is a group and entity analysis, not a brand-level estimate. You need to confirm the ultimate parent, the legal entities included in the group, the turnover generated in the EU, the relevant periods, and the EU subsidiary or branch condition. Currency conversion, changes in group structure, acquisitions, disposals, and the interpretation of turnover should be documented rather than resolved through an informal spreadsheet assumption.

The EU subsidiary or branch would be responsible for publishing and making the sustainability report accessible under the applicable national implementation arrangements. The report would cover the non-EU parent group at the required level, not only the local EU entity that publishes it.

If your conclusion is close to a threshold or depends on a complex structure, obtain legal advice. A content guide can explain the framework, but it cannot determine the legal scope of a specific group.

What Does the ESRS-40a Exposure Draft Propose?

EFRAG says the exposure draft retains the overall 12-standard architecture of ESRS while adapting it for third-country undertakings. The proposed model focuses on the undertaking’s impacts on people and the environment. It removes disclosures centered on financial risks, opportunities, resilience, and dependencies that form part of the wider ESRS model for EU undertakings.

The consultation asks stakeholders to consider four practical issues:

•      whether the deletions and additions from the wider ESRS architecture are appropriate;

•      how companies outside the EU would apply concepts and terms based on EU law;

•      whether the proposed global and EU-related reporting approach is workable; and

•      how ESRS-40a can operate alongside jurisdictional standards based on IFRS Sustainability Disclosure Standards.

The proposed reporting boundary is especially important. EFRAG explains that ESRS-40a would generally cover global impacts. For topics other than climate, a reporting group may be able to limit information to impacts connected with the EU under the proposed mixed approach. That choice would affect data ownership, systems, consolidation, controls, estimates, and the evidence retained to support the boundary.

Organizations already reporting under other frameworks should avoid building a separate ESRS-40a data universe. VECTRA’s article on reducing ESG data fatigue across reporting frameworks explains why common definitions, controls, and source records should support multiple reporting outputs where the requirements genuinely align.

The 7 Questions to Test ESRS-40a Scope and Readiness

These questions turn the current proposal into a controlled assessment. They do not replace legal analysis or the final standard.

1. Which Non-EU Undertaking Is the Reporting Group?

Start by identifying the ultimate non-EU parent and the group perimeter that may be covered. Do not begin with the EU subsidiary that happens to own the reporting project.

Record:

•      the ultimate parent and governing law;

•      the consolidation perimeter used for financial reporting;

•      EU subsidiaries, branches, and recent structural changes;

•      joint arrangements or controlled entities that may require interpretation;

•      the proposed reporting level; and

•      the legal and finance owners responsible for confirming the conclusion.

The scope record should show the source documents used, the period covered, the reviewer, and any limitations. If the legal structure changes before 2028, the assessment needs an event-based review rather than waiting for the next annual cycle.

2. Does EU Turnover Exceed EUR 450 Million for Two Consecutive Years?

Calculate EU net turnover for the same group and on a consistent basis for each of the last two consecutive financial years. Reconcile the result to controlled financial information.

A screenshot of a management dashboard is weak evidence if the underlying definition, data source, adjustments, and approval cannot be reconstructed. The scope file should allow a competent reviewer to repeat the calculation.

3. Is the EU Subsidiary or Branch Condition Met?

After the EU turnover test, confirm whether the group has a qualifying EU presence. EFRAG’s summary identifies two routes: an EU branch generating more than EUR 200 million or EU subsidiaries generating more than EUR 200 million under the ultimate parent condition.

Map every relevant EU subsidiary and branch, the turnover measure used, the applicable period, and the entity expected to publish. Where several EU entities could be involved, clarify national responsibilities, ownership, governance, language, publication, and assurance arrangements early.

This step should end with a legal-entity decision, not a general statement that the group has substantial EU operations.

4. Which Impacts Would Be Reported Globally and Which Could Be EU-Related?

The proposed mixed approach creates a design decision with significant data consequences. Climate reporting would remain global under EFRAG’s current explanation. For other topics, the group may be able to limit disclosures to EU-related impacts.

This is not merely a reporting-system setting. It depends on how the company understands its value chain and impacts. VECTRA’s review of double materiality lessons from the first wave of CSRD reports provides useful context on evidence, stakeholder perspectives, and the need to connect assessment conclusions with the disclosures that follow.

5. Which Existing Data and Controls Can Be Reused?

Map the proposed disclosure requirements to data already collected for group reporting, legal compliance, enterprise systems, customer requests, voluntary reporting, and local obligations. Reuse only when the definition, boundary, period, unit, method, owner, and evidence are compatible.

VECTRA’s explanation of the VSME value-chain cap and supplier data burden reinforces a useful principle: ask for information because a defined requirement or decision needs it, not because a broad template contains a field.

6. Can the Company Produce Evidence That Can Be Reviewed and Assured?

Article 40a reporting is expected to require an assurance opinion. Readiness therefore depends on control quality, not only data availability..

Do not wait until the first reporting year to discover that narrative claims have no source, local systems use different definitions, or supplier estimates cannot be reproduced. VECTRA’s Reporting service supports framework alignment, materiality, stakeholder engagement, gap analysis, data collection, and performance monitoring. Where evidence needs readiness testing before external review, Pre and Post Audit Assistance provides a separate route for testing gaps, corrective actions, and retained evidence.

7. What Should Be Done Before the Standard Is Final?

Act on no-regret controls and defer decisions that depend on unsettled text. A proportionate readiness plan should separate three categories.

Proceed now with:

•      legal-entity and turnover mapping;

•      ownership and governance;

•      data inventory and definition control;

•      source-to-disclosure traceability;

•      impact and stakeholder mapping; and

•      identification of material systems and evidence gaps.

Monitor or test before committing to:

•      the final disclosure list;

•      the exact mixed-boundary method;

•      detailed presentation requirements;

•      final interoperability decisions; and

•      implementation choices that would be expensive to reverse.

Escalate for legal or technical advice when:

•      the group is close to a threshold;

•      the publishing entity is unclear;

•      turnover treatment is disputed;

•      global and EU-related impacts cannot be separated reliably; or

•      local law creates an additional or conflicting requirement.

This approach prevents two opposite errors: doing nothing until the delegated act is final, or spending heavily to implement an exposure draft as though no change were possible.

ESRS-40a Readiness Decision Table

Start With the Scope File, Not the Reporting Template

Your first deliverable should be a controlled scope file that identifies the reporting group, calculates the thresholds, names the publishing route, records the proposed boundary, and distinguishes confirmed requirements from consultation proposals. That file gives every later workstream a defensible starting point.

If your group appears to be in scope, VECTRA can help translate the emerging requirements into a practical reporting and evidence plan through its Reporting service. The aim is not to predict every final datapoint. It is to build the ownership, definitions, traceability, and review controls that will remain useful when the standard is finalized.

Summary

Who

The future requirement is aimed at certain non-EU undertakings with significant EU activity. Legal, finance, sustainability, reporting, internal control, data, and assurance teams will need a shared scope conclusion and operating plan.

What

ESRS-40a is a proposed sustainability reporting standard focused on the impacts of large non-EU groups on people and the environment. The current exposure draft retains the 12-standard ESRS architecture but adapts the content and reporting boundary for Article 40a.

When

The EFRAG consultation closes on 31 October 2026. The cost-benefit survey closes on 11 October 2026. The first reports are expected to cover the financial year 2028 and be published in 2029, subject to the final legal process.

Where

The requirement is triggered by significant EU activity, while the proposed report generally covers impacts across the non-EU parent group. The mixed approach may allow EU-related limits for certain non-climate topics.

Why

The policy objective is to improve transparency about the impacts of the largest non-EU groups active in the EU and support a level playing field. For companies, early scope and control work reduces the risk of late boundary disputes, duplicated data requests, and evidence that cannot withstand review.

Frequently Asked Questions

Is ESRS-40a final?

No. EFRAG published an exposure draft for consultation. Feedback will inform its technical advice to the European Commission. The Commission must then complete its own process before adopting the standard through a delegated act.

When does ESRS reporting start for non-EU companies under Article 40a?

EFRAG states that reporting under the future ESRS-40a will apply for financial years beginning on or after 1 January 2028. The first sustainability reports are therefore expected to be published in 2029.

What are the proposed Article 40a thresholds?

EFRAG’s current summary states that the non-EU undertaking must generate more than EUR 450 million in EU net turnover in each of the last two consecutive financial years and must either have an EU branch generating more than EUR 200 million or be the ultimate parent of EU subsidiaries generating more than EUR 200 million.

Does ESRS-40a use double materiality?

The exposure draft focuses on impacts on people and the environment. EFRAG says it removes disclosures on risks, opportunities, resilience, and dependencies from the wider ESRS model. Companies should review the final standard before setting the permanent assessment method.

Can a company report only EU impacts?

The exposure draft proposes a mixed approach. Climate information would remain global, while a group may be able to limit certain other disclosures to EU-related impacts. The method and evidence for applying that option should be tested carefully.

Should a company start collecting every proposed datapoint now?

No. Start with scope, boundaries, ownership, data inventory, and evidence controls. Use a limited dry run to test the system, then expand when the final requirements are clearer.

Related Posts

•  How to Make ESG and Climate Reporting Easier

•  FMCG Sustainability Data: How to Collect Evidence Procurement Can Use

•  Independent Assurance vs. Internal Audit: Avoid the Wrong Review

VECTRA International is a trusted Business Resilience & Operational Capability Building Partner. Through our ecosystem of integrated solutions, we help organizations transform operational complexity into resilient performance, measurable business impact, and sustainable growth.

Chaussée de Wavre 1517B, 1160 Brussels, Belgium.

A Note on Our Visuals: At VECTRA, we combine human expertise with advanced technology. Some of the supportive imagery in this article was generated using artificial intelligence tools like Google Gemini. We ensure all conceptual AI assets align with our brand standards and accurately reflect our data.

The post ESRS Reporting for Non-EU Companies: Are You in Scope of ESRS-40a? appeared first on VECTRA International.

For large and medium enterprises, and for micro and small operators already covered by the EU Timber Regulation, the main application date is 30 December 2026. Most other micro and small enterprises have until 30 June 2027. The work should begin with your exact role, product codes, supply routes, and company size, not with a generic checklist.

What Does EUDR Compliance Require in 2026?

The legal starting point is Regulation (EU) 2023/1115 and its Annex I product list. The European Commission’s current explanation of EUDR compliance due diligence separates the operational work into three steps for upstream operators:

1.  Collect the required product, supplier, production, geolocation, and legality information.

2.  Assess the risk that a relevant product does not comply.

3.  Reduce any identified risk to no or only a negligible level before placing the product on the EU market or exporting it.

The deforestation cut-off is 31 December 2020. Relevant commodities must not have been produced on land subject to deforestation after that date. Wood products are also subject to the forest-degradation requirement defined by the Regulation.

This is not only a document-collection exercise. Your system needs to connect product scope, source plots or establishments, supplier evidence, risk criteria, mitigation, approval, and submission. If the required information cannot be collected, or if the risk remains more than negligible, an upstream operator must not place the relevant product on the EU market or export it.

Who Must Act, and by When?

EUDR compliance responsibilities depend on the activity performed in the supply chain. The same corporate group can contain different legal entities with different roles, and one company may hold more than one role.

The Commission’s current explanation of EUDR roles and responsibilities should be used with the legal text, official guidance, and FAQs. Do not assume that the party named as the supplier in a commercial contract is automatically the EUDR operator.

A useful first step is to establish a verified current state and then test it against the applicable date and requirement. VECTRA’s guide to baseline assessments and readiness assessments explains why those are separate management decisions.

What Changed Before the EUDR Compliance 2026 Deadline?

The rules and implementation tools have changed since the original 2023 Regulation was published. A readiness plan based on an early briefing deck may now be incomplete.

The European Commission confirmed in July 2026 that:

•  the Regulation applies from 30 December 2026 for large and medium enterprises and for micro and small operators already covered by the EUTR;

•  it applies from 30 June 2027 for most other micro and small enterprises;

•  the Annex I product scope has been updated;

•  soluble coffee, certain palm oil derivatives, and frozen cattle tongues were added, with those newly added products becoming subject to the Regulation from 30 December 2027;

•  certain hides, skins, leather, re-treaded tyres, soybeans for sowing, specified vulcanized rubber articles, conveyor and transmission belts, and certain vehicle and aircraft seats were removed; and

•  the Information System and its technical rules were updated to support due diligence statements, simplified declarations, and automated submissions.

The Commission’s July 2026 EUDR scope and implementation update provides the current summary, while the August 2026 EUDR implementation FAQ addresses detailed implementation questions. Product decisions should still be made against the current Annex I codes and the facts of the transaction.

The simplifications change how some responsibilities and submissions work. They do not remove the need to confirm product scope, collect the required evidence, identify the responsible legal entity, and follow the rules that apply to its role.

The 7 EUDR Compliance Checks to Complete

1. Confirm Product Scope by CN or HS Code

Begin with the product as traded, not only the commodity it contains. Annex I uses Combined Nomenclature and Harmonized System codes to define relevant products. A product containing wood, rubber, cocoa, or another covered input is not automatically in scope, and a product that appears unrelated at first glance may still be listed.

Create a controlled scope register that records:

•  the product and trade name;

•  the current CN or HS code used for customs and EUDR analysis;

•  the relevant commodity or derived product;

•  the applicable Annex I version and review date;

•  the placing-on-market, making-available, import, or export activity;

•  the legal entity responsible for that activity; and

•  the rationale and reviewer for the scope decision.

Do not copy a product list from a supplier or an old implementation memo without rechecking it. The 2026 product-scope changes make version control essential. If the code or product description is uncertain, obtain customs or legal advice before building the rest of the process around a doubtful classification.

2. Assign the Correct Role, Legal Entity, and Date

Map the transaction from production to the first EU market placement and onward. Identify who imports, who acts as customs declarant, who first places the product on the EU market, who processes it into another relevant product, who trades it, and who exports it.

treat company-group arrangements carefully. EUDR responsibilities attach to the legal entity carrying out the relevant activity. Central systems and shared teams can support the work, but they do not transfer legal responsibility away from the operator.

3. Connect Products to Source Plots and Establishments

Traceability must connect the relevant product to the place where the commodity was produced. For most relevant commodities, that means the geolocation of all plots of land. For cattle, the required location data refers to the establishments where the animals were kept under the applicable rules.

The EUDR Information System allows operators to provide coordinates individually, in bulk, or through GeoJSON files, and supports an API for bulk management. Test both the business data and the submission process. A technically valid file can still be wrong if it contains the wrong plots, an incomplete batch relationship, or mixed origin data.

Data controls matter as much as collection. VECTRA’s guide to stronger FMCG sustainability data and supplier evidence explains how ownership, definitions, validation, and audit trails prevent supplier information from becoming an unverified spreadsheet exercise.

4. Test the Deforestation-Free Evidence

The operator needs adequately conclusive and verifiable information that the relevant products are deforestation-free. A map should be treated as a source for analysis, not as a conclusion by itself.

Satellite imagery, the EU Forest Observatory, public datasets, supplier records, field information, and independent verification may all contribute. None should be treated as infallible. Record the data source, date, reviewer, finding, uncertainty, and decision so another competent person can reproduce the reasoning.

The control also needs to prevent mixing with products of unknown or non-compliant origin. Mass-balance claims, warehouse practices, aggregation points, transport documents, and processor records should be tested against the traceability model used for the due diligence decision.

5. Verify Legality in the Country of Production

EUDR legality is not limited to proof of title or a harvest permit. The relevant legislation of the country of production can cover land-use rights, environmental protection, forest-related rules, third-party rights, labor rights, human rights protected under international law, free, prior and informed consent where relevant, tax, anti-corruption, trade, and customs requirements.

Build a legality register by commodity and country. For each requirement, identify the source law, competent authority, supplier obligation, evidence expected, validity period, translation needs, and escalation route.

This is one reason a general supplier declaration is insufficient. The evidence must apply to the relevant producer, place, activity, product, and time. Where indigenous peoples, workers, or communities may be affected, the risk assessment should consider reliable information about claims, rights, consultation, and access to remedy. VECTRA’s guide to human rights due diligence for supplier impacts provides a separate method for assessing impacts on people. It supports the work but does not replace the EUDR legal test.

6. Document the Risk Assessment and Any Mitigation

If simplified due diligence does not apply, the operator must assess the risk of non-compliance using the Regulation’s criteria. Country benchmarking is one input, not the complete assessment.

The Commission’s country benchmarking guidance classifies countries as low, standard, or high risk. Sourcing only from low-risk countries may allow simplified due diligence where the conditions are met, but the operator must still collect the required information and remain alert to mixing, circumvention, or new concerns.

A documented risk assessment should address, as relevant:

•  country classification and local deforestation conditions;

•  forests and the presence or rights of indigenous peoples;

•  reliable claims concerning ownership or use of production areas;

•  corruption, falsified documents, weak law enforcement, conflict, or sanctions;

•  the reliability and consistency of the Article 9 information;

•  supply-chain complexity and the ability to connect products to origin;

•  mixing, circumvention, unknown-origin, and prior non-compliance risks; and

•  any other information indicating possible non-compliance.

Separate the initial exposure from the effect of verified controls. VECTRA’s supplier risk assessment checklist explains how to distinguish inherent risk from residual risk and connect a finding to a decision. For EUDR, the final threshold remains specific: the operator can proceed only where the risk is no or negligible.

Where the risk is not negligible, require additional information, conduct surveys or audits, strengthen traceability, support supplier capacity, change controls, or take another proportionate measure. Record why the measure addresses the identified risk and how its effectiveness was checked. A planned action does not reduce risk until it has been implemented and verified.

7. Test Governance, Submission, Retention, and Response

An EUDR process is not ready until it works under realistic operating conditions. The person approving a product should be able to see the scope decision, evidence status, risk conclusion, mitigation result, and applicable submission before the product moves.

Use the Information System acceptance environment to test registration, user access, data upload, review, submission, and exception handling before relying on the production environment. The Commission distinguishes clearly between the two: acceptance submissions have no legal value, while production submissions do.

Supplier expectations should also be reflected in contracts, operating instructions, and controlled evidence requests. VECTRA’s guide to moving a supplier code of conduct from policy to practice explains how to connect requirements to evidence, monitoring, corrective action, and escalation.

What Should Non-EU Suppliers Prepare?

Most non-EU producers do not have direct EUDR obligations unless they directly place relevant products on the EU market. They can still determine whether an EU buyer can comply on time.

Suppliers should be ready to provide accurate and consistent information covering:

•  the producing entity and relevant intermediaries;

•  product description, commodity, quantity, and production period;

•  production country and, where relevant, subnational region;

•  plot coordinates or required cattle-establishment information;

•  documents supporting the right to produce or use the land;

•  evidence that the commodity is deforestation-free;

•  evidence of compliance with relevant laws in the country of production;

•  chain-of-custody and segregation information; and

•  prompt notification if any information changes or becomes unreliable.

EU buyers should explain why each item is requested, define the format, protect sensitive information, allow realistic time for correction, and avoid asking smallholders for multiple inconsistent templates. Supplier capacity-building can be a legitimate risk-mitigation measure when it addresses a defined gap and the result is verified.

VECTRA’s Pre and Post Audit Assistance service can support readiness testing, evidence review, gap closure, and re-testing. For organizations that need to connect product scope, supply-chain data, supplier risk, mitigation, and regulatory controls, VECTRA’s Compliance, Risk & Due Diligence service provides the primary commercial route.

SUMMARY

Who

Large and medium enterprises carrying out covered activities, and micro and small operators already covered by the EUTR, face the 30 December 2026 application date. Most other micro and small enterprises follow on 30 June 2027. Non-EU suppliers may need to provide the evidence their EU customers require.

What

Covered products must satisfy the deforestation-free and legality conditions, follow the applicable due diligence process, and be covered by the required statement or declaration before the relevant market action.

When

The deadline depends on company size, role, prior EUTR coverage, and whether a product was newly added for 30 December 2027. Due diligence must be completed before the product is placed on the EU market or exported.

Where

The rules govern relevant products placed or made available on the EU market or exported from it. The evidence reaches back to the countries, plots, establishments, suppliers, and intermediaries connected to production.

Why

The business needs a defensible decision that covered products meet the Regulation, not a collection of disconnected declarations. Strong preparation also reduces border delay, blocked product, rushed supplier requests, and inconsistent decisions across legal entities.

Start With One Real Product Flow

Choose one relevant product expected to move soon after the applicable date. Trace it from the responsible legal entity back to every required plot or establishment, then forward through risk assessment, approval, Information System submission, customs, and downstream records. Record every missing connection. That exercise will show whether the immediate problem is scope, role, data, evidence, risk judgment, supplier capacity, or system control.

Frequently Asked Questions

What is the EUDR compliance deadline?

The Regulation applies from 30 December 2026 for large and medium enterprises and for micro and small operators already covered by the EU Timber Regulation. It applies from 30 June 2027 for most other micro and small enterprises. Newly added products identified in the 2026 scope update are subject from 30 December 2027.

Which commodities does the EUDR cover?

The seven commodities are cattle, cocoa, coffee, palm oil, rubber, soy, and wood. Annex I defines the relevant products by CN or HS code. Check the current Annex rather than assuming every product containing a covered commodity is included.

Does a low-risk country remove the need for due diligence?

No. An operator sourcing only qualifying products from low-risk countries may use simplified due diligence if the conditions are met. It must still collect the required information and act if new information indicates possible non-compliance or circumvention.

Is certification enough to prove a product complies?

No. Certification and third-party verification can contribute information, but the responsible operator must ensure that the evidence meets the Regulation’s requirements and supports the product-specific conclusion. The legal responsibility is not transferred to the certifier.

Do non-EU suppliers have direct EUDR duties?

Generally, a producer or supplier outside the EU does not have a direct obligation unless it directly places relevant products on the EU market. It may still need to provide geolocation, legality, traceability, and product data to the operator responsible for compliance.

How long must EUDR records be kept?

Operators must retain due diligence documentation for five years from the date the relevant product is placed on the EU market or exported. Downstream operators and traders also have five-year record-keeping duties for specified supplier, buyer, and reference information.

View Related Posts

• Preparing for the EU Digital Product Passport: Governance, Traceability, and Compliance Readiness in 2026

•  PPWR Compliance 2026: What Applies Now and What to Fix First

•  Why Operational Resilience Is More Than a Dashboard

VECTRA International is a trusted Business Resilience & Operational Capability Building Partner. Through our ecosystem of integrated solutions, we help organizations transform operational complexity into resilient performance, measurable business impact, and sustainable growth.

Chaussée de Wavre 1517B, 1160 Brussels, Belgium.

A Note on Our Visuals: At VECTRA, we combine human expertise with advanced technology. Some of the supportive imagery in this article was generated using artificial intelligence tools like Google Gemini. We ensure all conceptual AI assets align with our brand standards and accurately reflect our data.

The post EUDR Compliance 2026: 7 Checks to Complete Before 30 December appeared first on VECTRA International.