CSRD and ESG Compliance: What Companies in Greece and Cyprus Need to Know

What is CSRD?

The Corporate Sustainability Reporting Directive (CSRD) is the EU directive that expanded and standardized sustainability reporting requirements for companies operating in the EU, requiring detailed disclosure across environmental, social, and governance (ESG) topics. For companies newly in scope, or expecting to come into scope as CSRD's phased rollout continues, the practical challenge is usually not understanding that CSRD applies: it is knowing what evidence is actually needed to report against it, particularly on the social ("S") side.

The social pillar: what CSRD asks for

CSRD's social pillar covers the same ground as most established social compliance standards: labour practices, working conditions, health and safety, human rights, and grievance handling, both within a company's own operations and, in many cases, its supply chain. This is where CSRD reporting and social compliance certification overlap directly: a company that has already built a documented, audited Social Management System has already produced most of the evidence CSRD reporting requires.

Where ISO 26000, SA8000, and PAS 24000 fit

These three are related but distinct, and companies researching this space often conflate them:

• ISO 26000 is guidance, not a certification. It sets out the principles and core subjects of social responsibility, but there is no audit and no certificate at the end of it.
• SA8000 is the longer-established, internationally recognized certifiable standard for social accountability, and the one most commonly named directly in Greek public tenders today.
• PAS 24000 is a newer certifiable specification covering the same core ground as SA8000. Certification Bodies can be accredited for it by a National Accreditation Body, as Accredia does in Italy, and Italian contracting authorities have accepted it as equivalent evidence in 2026 tender clarifications, subject to the tender wording. This is covered in full on VALIDX's PAS 24000 vs SA8000 comparison page.

The practical takeaway: ISO 26000 can inform your policy, but only SA8000 or PAS 24000 gives you an independently audited certificate to point to, whether that is for a tender requirement, an investor question, or CSRD reporting itself.

Getting started

Companies preparing for CSRD reporting, or already fielding ESG questions from customers, investors, or tender documents, do not need to start the evidence-gathering process from a blank page. If your organization is already certified to ISO 9001, ISO 14001, ISO 45001, ISO 37001, or ISO 37301, a large share of the management-system structure PAS 24000 requires is already in place. VALIDX, via ICDQ, can run a scoping call to confirm exactly what gap remains between what you have today and a full PAS 24000 certification.

Learn more about PAS 24000 certification →

FAQ

Does CSRD require a specific certification like PAS 24000 or SA8000?

No. CSRD itself does not mandate either certification by name; it requires companies to report against specific disclosure requirements. Holding a certification like PAS 24000 or SA8000 is one way to have independently audited evidence ready for that reporting, not a legal requirement of CSRD itself.

Is ISO 26000 enough on its own?

On its own, no, since ISO 26000 is guidance rather than a certifiable standard. Companies that need an auditable certificate, for a tender, an investor, or CSRD evidence, need PAS 24000 or SA8000 in addition to, or instead of, ISO 26000 guidance.

How do I know if PAS 24000 or SA8000 is the right fit?

It depends on what a specific tender, customer, or reporting requirement actually names. VALIDX can advise on which certification fits your situation during an initial scoping call.