ISO 17029 and the coming CSRD assurance crunch: Why Europe needs more accredited VVBs now

Europe is building the most ambitious corporate sustainability reporting architecture in the world. The Corporate Sustainability Reporting Directive (CSRD), even in its revised, post-Omnibus I form, requires mandatory third-party assurance of sustainability statements from companies that, in aggregate, employ hundreds of millions of people across the continent. The infrastructure to deliver that assurance credibly and at scale barely exists.

This is not a forecast, but structural problem that is visible right now, to anyone paying attention to the conformity assessment ecosystem.

The assurance mandate and what it actually requires

The CSRD, as modified by the Omnibus I package that entered into force in March 2026, now applies to companies with more than 1,000 employees and annual net turnover above €450 million. Approximately 80% of companies originally in scope have been excluded by the revised thresholds. Those that remain represent the largest and most systematically significant corporations operating in the EU.

Every one of them needs their sustainability statement independently assured.

The reference standard for conducting that assurance is ISSA 5000, the International Standard on Sustainability Assurance published by the International Auditing and Assurance Standards Board (IAASB). ISSA 5000 is effective for engagements on sustainability information reported for periods beginning on or after 15 December 2026. The European Commission is required to adopt an EU-level limited assurance standard by 1 October 2026.

The direction of travel is clear. The question is who performs the assurance.

Two tracks and a structural asymmetry

The CSRD creates two authorised tracks for sustainability assurance providers. 

• The first and currently dominant track is statutory auditors: in France, commissaires aux comptes; in Germany, Wirtschaftsprüfer; in the UK, registered auditors. These professionals operate under established national audit frameworks, subject to oversight by bodies such as the CEAOB (Committee of European Auditing Oversight Bodies).

• The second track is what the CSRD calls independent assurance service providers (IASPs): third-party bodies authorised by member states to conduct sustainability assurance alongside, or instead of, statutory auditors. Whether this track is open, and under what conditions, depends on how each member state transposes the directive into national law. Member states that open the IASP track must subject these providers to requirements equivalent to those governing statutory auditors on ethics, independence, training, and examination.

Here lies the structural asymmetry. The statutory auditor track, while deep in established expertise and institutional trust, was built for financial reporting. Sustainability assurance under ISSA 5000 is technically distinct, it involves validating GHG emissions inventories, assessing double materiality analyses, evaluating biodiversity impact claims, and reviewing supply chain data that extends far beyond anything a traditional financial audit touches. The competence sets required overlap but are not identical.

The IASP track, by contrast, is designed precisely for organisations with deep sustainability and environmental domain expertise. In several EU member states, accredited Validation and Verification Bodies (VVBs), organisations operating under ISO/IEC 17029:2019 and ISO 14065:2020, are the natural candidates for this track. They are built for exactly this type of independent, accredited sustainability assurance.

The problem is that there are not enough of them.

The ISO 17029 infrastructure: solid but sparse

ISO/IEC 17029:2019 is the international standard that defines general principles and requirements for VVBs. It covers impartiality, competence management, process design, information security, and the separation of critical functions, the structural requirements that give a VVB its independence and credibility.

Accreditation against ISO 17029, granted by national accreditation bodies, DAkkS in Germany, COFRAC in France, UKAS in the United Kingdom, provides formal, third-party verified confirmation that a VVB meets these requirements. Accreditation against ISO 14065, which builds on ISO 17029 with sector-specific requirements for GHG and environmental information, adds the domain-specific layer.

This infrastructure is robust. The IAF (International Accreditation Forum) multilateral recognition arrangement ensures that accreditation granted in one jurisdiction is recognised across member states. The standards are technically sound, regularly updated, and aligned with international best practice.

What it is not, is large.

The pool of ISO 17029-accredited VVBs currently operating in Europe was built to serve regulatory verification markets; EU ETS, CORSIA, national MRV (Monitoring, Reporting and Verification) schemes… and voluntary carbon markets. These markets have significant capacity requirements of their own. Adding CSRD sustainability assurance to this existing demand, at the scale the directive implies, requires a material expansion of the accredited VVB ecosystem.

That expansion cannot happen quickly. The accreditation process for a VVB, from a structured starting point through document review, witness assessment, and accreditation decision, takes a realistic 9 to 18 months. Building the competence, processes, and impartiality structures that satisfy an accreditation body takes additional preparation time before the formal application even begins.

A parallel Europe has already seen: the notified body crisis

There is an instructive precedent for what happens when a regulatory mandate for third-party conformity assessment outpaces the capacity of the accredited bodies available to deliver it.

The EU Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR) created mandatory conformity assessment requirements for medical devices across the EU. The number of accredited Notified Bodies authorised to conduct these assessments was insufficient to handle the volume of applications that followed.

The result was documented in the European Commission's own survey data: as of March 2026, 33,175 MDR applications had been submitted to Notified Bodies against only 17,549 certificates issued, leaving an estimated 15,000+ applications in the pipeline. Average review times extended to 13 to 18 months for standard devices. Companies faced real market access risks.

The dynamics for CSRD sustainability assurance are structurally similar. A regulatory mandate requiring third-party assurance, a constrained pool of qualified providers, and a fixed institutional clock, with ISSA 5000 effective from December 2026 and an EU limited assurance standard due by October 2026, is a configuration that creates bottlenecks.

What needs to happen and why ISO 17029 is the right foundation

The solution is not to lower the bar for who can conduct sustainability assurance. Credibility is the entire point of the exercise. If corporate sustainability statements are assured by bodies that lack the independence, competence, and systematic processes that accreditation verifies, the assurance adds nothing. The greenwashing problem it is designed to solve is replaced by an assurance theatre problem.

The solution is to accelerate the development of the accredited VVB ecosystem, which means three things in practice.

First, national accreditation bodies across EU member states need to proactively position themselves to process VVB applications for CSRD assurance scope extensions efficiently. The institutional readiness of accreditation bodies, not just the VVBs themselves, is a bottleneck that deserves explicit attention from regulators.

Second, organisations with existing sustainability, environmental, or quality management expertise that are considering entering the sustainability assurance market need to begin building ISO 17029-compliant systems now. The organisations that are in position when the market opens are those that started 18 months before. That window is closing.

Third, the IASP framework that member states are developing as they transpose the CSRD needs to create clear, workable pathways for accredited VVBs to operate as sustainability assurance providers, without requiring them to replicate the statutory audit infrastructure they are explicitly not.

The credibility argument

There is a broader argument here that goes beyond market capacity.

The credibility of CSRD reporting depends, ultimately, on the credibility of the assurance that underpins it. A sustainability statement assured by an organisation that is itself independently accredited, that has had its impartiality structures, competence systems, and verification processes externally verified by a national accreditation body, carries a different weight than one assured by an organisation that has simply declared itself qualified.

ISO 17029 exists precisely to provide that independent, structural verification of a VVB's credibility. The IAF mutual recognition arrangement means that accreditation granted anywhere in the framework is recognised globally. This is not a domestic trust mechanism but an international one.

As CSRD sustainability assurance matures from a nascent practice to a regulated market, accreditation under ISO 17029 will increasingly define the boundary between credible assurance and its simulacrum. The organisations that have built accreditation-ready systems now will be the ones that define the professional standards of the field.

Europe needs more of them. The infrastructure is proven. A detailed breakdown of what ISO 17029 accreditation requires including process steps, typical timelines, and the structural gaps most VVBs encounter is available here. What is needed is the capacity to use it.