Ask who a European company cannot file its sustainability report without, and most answers start with a brand: a large audit network, a data platform, a reporting software house. Ask the law the same question and it gives a different kind of answer. It names no firm at all. It names roles. In France, according to the audit regulator's annual report of 27 May 2026, the assurance role alone at the end of 2025 was open to 3 961 statutory auditors, 38 sustainability auditors and 19 independent third-party bodies. A standard tells the company what to report. An adviser shapes that standard. An assurance provider gives an opinion on what was reported. A supervisor examines the filed statement afterwards. Every one of those roles can be held by more than one organisation, and the documents that create them were written so that it would be.
This is the second piece of the sustainability chapter of the CareerOn Industry Atlas. The first asked where the money is, and found that every euro figure in the public record is a forecast. This one asks who the chain is made of. It matters to a candidate because a role written into law is a job that will exist whichever firm wins the contract, and a brand is not. We name a body only beside the sentence that says what it does. We keep the European, French and global layers apart. And where a document is silent, we say so rather than fill the silence.
The law names no firm a sustainability report cannot be filed without: it names four roles, and the only public list we found of who holds one of them is French, where the assurance role at the end of 2025 was already shared between 3 961 statutory auditors, 38 sustainability auditors and 19 independent third-party bodies.
Eight documents, read for who does what
We read eight dated documents, each opened live in October 2026, and kept a passage from each that assigns a role. Three are adopted European law: the CSRD, Directive (EU) 2022/2464 of 14 December 2022; the European reporting standards, Delegated Regulation (EU) 2023/2772 of 31 July 2023, known as the ESRS; and the Omnibus I Directive (EU) 2026/470 of 24 February 2026, which narrowed the regime. Three come from supervisors: the European Securities and Markets Authority's enforcement report of 7 May 2026, its fact-finding study on materiality of 14 October 2025, and the French market authority's study of the first French statements, published in October 2025. Two come from the Haute autorité de l'audit, the H2A, the French audit regulator: its annual report for 2025, dated 27 May 2026, and the summary of its 2025 inspection programme, dated 18 September 2026.
We also refused three documents, and the refusals are part of the method. A decision of the H2A on its inspection priorities is a scanned image with no text layer, so no quotation can be proven against it. The H2A's web pages on how a third-party body registers are undated pages describing a procedure, and a page about a document is not the document. The French ordinance that opened sustainability assurance beyond statutory auditors is served behind a bot screen that refused both our probe and a real browser. We could not read it, so we do not quote it. What we say about France below rests on the regulator's own dated reports.
Four roles, and the documents that assign them
Start with the standard, because it decides what everyone else in the chain checks. The ESRS do not ask a company to buy anything. They ask it to look outward: "Business relationships include those in the undertaking’s upstream and downstream value chain and are not limited to direct contractual relationships." That one sentence is why sustainability reporting is harder than financial reporting. A company's accounts stop at its own ledger. Its sustainability statement does not.
The standard is written with advice. The CSRD gives that advisory role to EFRAG and describes it precisely: "a non-profit association established under Belgian law that serves the public interest". EFRAG is the one body in the chain the law names. It is named as an adviser, not as an author with a monopoly on the text: the standards themselves are adopted by the Commission as a delegated regulation.
Then the opinion. Here the CSRD made a deliberate choice, and it wrote the choice down. It said "it is desirable to offer undertakings a broader choice of independent assurance services providers". The assurance role was not reserved for statutory auditors. The law opened it to a second category, and left each Member State to decide how. When ESMA later read a sample of real statements, it used exactly the vocabulary of the law: for almost all issuers it selected, "the auditor or independent assurance services provider delivered unqualified limited assurance conclusions regarding the sustainability reports prepared in accordance with ESRS." The supervisor names the role, twice over, and no provider.
Last, the examination. The CSRD tells ESMA to write guidelines "on the supervision of sustainability reporting by national competent authorities". Each country's market supervisor examines the statements; ESMA coordinates them and counts. Its 2026 report describes the counting in its own words: "ESMA collects data on the number of examinations performed and the number of actions taken by enforcers."
Four roles, no firm: who the law says a report passes through
| Role | Who holds it, as written | Assigned by | Legal state |
|---|---|---|---|
| Standard | Information across the upstream and downstream value chain | ESRS, Delegated Regulation (EU) 2023/2772 | Adopted act |
| Advice on the standard | EFRAG, a non-profit association under Belgian law | CSRD, Directive (EU) 2022/2464 | Adopted act |
| Assurance | The auditor or an independent assurance services provider | ESMA fact-finding, October 2025 | Supervisory finding |
| Examination | National enforcers, coordinated and counted by ESMA | ESMA enforcement report, May 2026 | Supervisory finding |
Sources 2 European Commission · 1 EUR-Lex (Publications Office of the European Union) · 5 ESMA · 4 ESMA
Read the exhibit for what is missing. Each role has a document, a legal state and a description of who holds it. No line has a company name. That is not an omission we made. In the eight documents we admitted, it is how the chain is written.
France already shares the opinion
A role written into European law becomes a market only when a country says who may hold it. France has done so, and its audit regulator counts the result. The H2A annual report for 2025 prints the count in one sentence: « À la fin de l’exercice 2025, 3 961 commissaires aux comptes, 38 auditeurs de durabilité et 19 organismes tiers indépendants étaient habilités à certifier des informations de durabilité. » In English: at the end of 2025, those three groups were authorised to certify sustainability information.
The proportion is the story. The statutory auditors are the overwhelming majority. But fifty-seven authorisations sit outside them, in two categories that did not hold this role before the CSRD: individual sustainability auditors, and independent third-party bodies of the kind that already verified non-financial declarations under earlier French rules. That is what the European phrase "a broader choice" looks like once it has a number. It is a small number. It is not zero.
The second H2A document shows that the choice is supervised as one profession, not two. Its 2025 inspection summary states that inspections of the sustainability certification work of statutory auditors, of independent third-party bodies and of the sustainability auditors attached to them « sont effectués exclusivement par des contrôleurs de la H2A ». The same regulator, with its own controllers, inspects all three groups. A candidate choosing between an audit firm and a third-party body is choosing between employers, not between standards of scrutiny.
In France, assurance is already shared: 3 961, 38 and 19
| Group authorised to certify sustainability information | Count at end 2025 | Inspected by |
|---|---|---|
| Statutory auditors | 3 961 | H2A controllers only |
| Sustainability auditors | 38 | H2A controllers only |
| Independent third-party bodies | 19 | H2A controllers only |
Sources 7 Haute autorité de l’audit (H2A) · 8 Haute autorité de l’audit (H2A)
Two limits travel with this exhibit. The count is of authorisations, not of mandates: it says who may sign, not how many reports each group signed, and the annual report does not divide the work between them. And the inspection summary warns that its selection of files is not statistical, so its findings cannot be extrapolated to the whole profession. We print the count and leave the market share unknown, because it is.
Where the law asks for data and names no supplier
The third link is the one most commercial writing about the CSRD is about: data and software. Here the documents are at their most interesting, because they create demand and stay silent on supply. The ESRS sentence on the value chain requires information a company does not hold in its own systems; someone has to gather it from suppliers and customers. The ESMA report records the format a listed company must use for the annual report it files: "all issuers subject to the Transparency Directive publicise their annual financial reports (AFRs) in XHTML format." Somebody has to produce that file.
Neither document says who. The standard asks for value-chain information and does not mention a data provider. The supervisor names the electronic format and does not mention a tool or a vendor. A firm may well find it impractical to report without bought data or reporting software. That is a business judgement, and possibly a correct one. It is not a legal requirement, and none of our eight documents makes it one.
The law asks for information and a format, and names no supplier
| Document | What it requires | What it does not name |
|---|---|---|
| ESRS, Delegated Regulation (EU) 2023/2772 | Information beyond direct contractual relationships, across the value chain | A data provider |
| ESMA enforcement report, May 2026 | Annual financial reports published in XHTML format | The tool or vendor that produces the format |
Sources 2 European Commission · 4 ESMA
This matters for how you read the market. When a vendor describes its product as what the CSRD requires, it is describing the information or the format the law asks for, and claiming that its product is the way to supply them. The claim may be true. It is the vendor's claim, and it should be read as one.
The counter-case, kept in the piece
The strongest objection to this piece is that it confuses the law's grammar with the market's reality. In practice, the objection runs, a handful of large audit networks sign most opinions for listed companies, and a handful of platforms carry most of the data. Writing roles instead of names, it says, hides who actually holds the chain.
We take the objection seriously, and it is partly right. Eight documents naming no firm is not proof that no public document does; it is what the documents we admitted say. The French count shows that statutory auditors hold the great majority of authorisations, which is consistent with concentration, though it cannot measure it. And the regime has just been narrowed: the Omnibus I Directive states that "To avoid an increase in the costs of assurance for undertakings, the requirement to adopt reasonable assurance standards should be removed." A lighter assurance requirement changes what each opinion is worth, and possibly who bids for it.
What the objection cannot do is turn a market position into a legal necessity. A report can be filed without any named firm, because the law asks for a role to be filled, and in France it lists who may fill it. Supervisors have noticed how the role is filled. The French market authority, reading the first statements, wrote that "Very few auditors specifically point out limits in the issuers’ DMA process", the double materiality assessment at the heart of the standard. That is a finding about the quality of the opinion, not about who gave it. It is the right question for a supervisor to ask, and the right one for a candidate to prepare for.
What this means for your career
If you are looking at the sustainability chain as a career, the evidence points in one clear direction. The counted, regulated, inspected profession is assurance. It exists in law in every Member State, it has a public register in France, and in France it is open to people who are not statutory auditors. That last point is new and small, and it is the most useful fact in this piece for anyone who did not train as an auditor.
The skill the supervisors are testing is also clear. An opinion that accepts a company's materiality assessment without challenge is what the French authority flagged. An assurance professional who can read a double materiality assessment, find where it is thin and say so in writing is doing exactly the work the record shows is scarce.
On the CareerOn shelf, two practice simulations sit beside this chapter: ESG analyst: non-financial reporting under CSRD, and ESG analyst: CSRD reporting and double materiality. In this piece, both simulations are unplaced. None of the eight documents names data gathering or gap analysis before assurance as work a reporting company performs, and the materiality finding describes what auditors do, not what analysts do. We do not claim the evidence places a card it does not place. Both remain sound practice for the regime, and the next piece, on the work itself, will test whether the record places them.
Two profiles that this evidence names are not yet on our shelf, and we record them as gaps rather than hide them: the statutory auditor or independent assurance provider who signs the opinion, and the supervisory enforcement examiner who reads the filed statement afterwards.
What we could not prove
We could not read the French ordinance that opened the assurance role, so its date and wording are not in this piece. We could not find, in any admitted document, how many sustainability reports each group of French providers certified. We found no public document that names a private assurance firm beside the reports it assured, and no document that makes a data or software supplier legally necessary. Each of these is a statement about the documents we read, not about the world. If a dated public document settles any of them, we will add it and say what changed.