A listed German construction group operating across 14 EU member states discovered in Q3 2025 that its upcoming CSRD-compliant sustainability report required disclosure of working conditions, wages, safety incidents, and collective agreement compliance for approximately 2,800 workers deployed through staffing agencies across its project portfolio. The group’s ESG reporting team had spent 18 months building environmental disclosures covering carbon emissions, waste management, and energy consumption. They had not begun workforce disclosures. When they contacted their six primary staffing agencies requesting structured data on worker wages, working hours, safety incidents, accommodation standards, and collective agreement applicability, five agencies responded that they did not maintain data in formats compatible with ESRS reporting standards. One agency did not respond at all.
The ESG team escalated to the group’s general counsel. The general counsel contacted external advisors, who confirmed that CSRD reporting obligations under ESRS S1 (Own Workforce) and ESRS S2 (Workers in the Value Chain) require disclosure of working conditions for all workers contributing to the reporting entity’s operations, including workers supplied by staffing agencies, subcontractors, and labour intermediaries. The advisors estimated that achieving audit-ready workforce disclosures for the group’s next reporting cycle would require €340,000 in consulting fees, 14 months of data infrastructure development, and renegotiation of data-sharing clauses in all staffing agency contracts.
The group’s CFO asked a question that will become familiar to every listed European contractor over the next 24 months: “We spent €4.2 million on ESG reporting infrastructure and nobody told us we needed worker-level data from our staffing agencies?”
Nobody told them because, until CSRD, nobody needed to know. Environmental reporting required data from the company’s own operations: energy bills, waste manifests, fleet fuel consumption. Governance reporting required data from internal systems: board composition, executive compensation, anti-corruption policies. Social reporting under previous frameworks was largely narrative: general statements about commitment to fair labour practices, diversity aspirations, community engagement. CSRD changes this fundamentally. Social reporting under ESRS S1 and S2 requires quantified, auditable data about specific working conditions for specific worker populations, including those the reporting entity does not directly employ.
CSRD Phase-In Timeline and Entity Scope
The Corporate Sustainability Reporting Directive entered into force on 5 January 2023, with phased application creating a rolling wave of compliance deadlines across European industry. The phase-in schedule determines when each category of undertaking must publish its first CSRD-compliant sustainability report.
| Phase | Reporting Period | First Report Due | In-Scope Entities | Estimated Count |
|---|---|---|---|---|
| Phase 1 | FY 2024 | 2025 | Large public-interest entities (>500 employees, already subject to NFRD) | ~11,700 |
| Phase 2 | FY 2025 | 2026 | Large undertakings meeting 2 of 3 thresholds (250+ employees, €50M+ turnover, €25M+ total assets) | ~38,000 |
| Phase 3 | FY 2026 | 2027 | Listed SMEs (10-250 employees, listed on EU-regulated markets) | ~1,000 |
| Phase 4 | FY 2028 | 2029 | Non-EU parent companies with €150M+ EU turnover and at least one EU subsidiary or branch | ~10,000 |
For construction groups, EPC contractors, and energy companies deploying international workers, the critical transition occurs in Phase 2. The majority of large European contractors — firms with annual turnover exceeding €50 million and workforces above 250 employees — enter mandatory reporting in FY 2025, meaning their first CSRD-compliant sustainability reports are due in 2026. These firms must already have workforce data collection infrastructure operational, or face reporting gaps that auditors will identify and flag.
The Phase 4 extension to non-EU parent companies carries particular significance for cross-border labour supply chains. A Turkish or Indian staffing agency providing workers to European construction projects may itself fall outside CSRD scope, but its European clients are required to report on workers supplied by that agency. The regulatory burden flows upstream through the supply chain, compelling agencies to provide data regardless of whether the agency itself has reporting obligations.
What CSRD Actually Requires for Workforce Reporting
Two ESRS standards create obligations that intersect directly with workforce supply chain operations. The following matrix details the specific disclosure requirements under each standard and their implications for contractors relying on agency-supplied labour.
ESRS S1 and S2 Disclosure Requirement Matrix
| ESRS Standard | Disclosure Requirement | Data Required | Source for Own Workforce | Source for Agency Workers |
|---|---|---|---|---|
| S1-6 | Characteristics of undertaking’s employees | Headcount by gender, contract type, region | Internal HRIS | Not applicable (own employees only) |
| S1-8 | Collective bargaining coverage | % of employees covered, agreements applicable | Payroll/HR records | Not applicable |
| S1-9 | Diversity metrics | Gender pay gap, age distribution, disability | Payroll/HR records | Not applicable |
| S1-14 | Health and safety metrics | Fatalities, recordable injuries, lost-time rate | HSE systems | Not applicable |
| S2-1 | Policies related to value chain workers | Due diligence policies, risk identification | Policy documentation | Policy documentation |
| S2-2 | Engagement with value chain workers | Engagement processes, channels, outcomes | N/A | Must be established |
| S2-3 | Remediation processes | Grievance mechanisms, remediation actions | Internal systems | Must include agency workers |
| S2-4 | Material impacts on value chain workers | Wage adequacy, safety, working time | N/A | Agency data required |
| S2-5 | Actions on material impacts | Prevention, mitigation, remediation measures | N/A | Contractual enforcement |
ESRS S1 is manageable for most large contractors because internal HR and payroll systems already capture the required data for directly employed workers. ESRS S2 is where the structural challenge emerges. A German construction group directly employing 1,200 workers has payroll records, safety incident logs, and working time data for those 1,200 workers in its own systems. The 2,800 workers deployed through staffing agencies exist in the staffing agencies’ systems, not the construction group’s. CSRD does not excuse the reporting entity from disclosure simply because the data resides with a third party. It requires the entity to establish processes for obtaining that data and to disclose the extent to which it can or cannot access information about value chain workers.
The critical distinction is operational: for S1 disclosures, contractors must report. For S2 disclosures, contractors must first build the data infrastructure, then report. The infrastructure includes contractual data-sharing agreements with every staffing agency, standardised data formats across agencies operating in different jurisdictions, quality assurance processes to verify data completeness and accuracy, and aggregation methodologies that produce ESRS-compatible metrics from heterogeneous agency data systems.
Why Staffing Agency Data Opacity Creates Reporting Gaps
European staffing agencies have historically treated worker-level data as proprietary. Wage rates, working hours, safety records, and accommodation arrangements are maintained in agency systems with limited or no structured data sharing with client companies. This opacity serves the agency’s commercial interests: clients who cannot see the full cost structure of deployed workers cannot easily calculate agency margins or negotiate fee reductions.
The opacity also reflects genuine data protection considerations. Worker personal data is protected under GDPR, and agencies legitimately restrict access to individual-level information. However, CSRD reporting does not require individual-level personal data. It requires aggregate metrics: average wages by worker category, total safety incident rates, collective agreement coverage percentages, working time compliance rates. These aggregate metrics can be produced without exposing individual worker identities.
The problem is that most staffing agencies do not produce these aggregate metrics at all. Their systems are designed for operational management — scheduling workers, processing payroll, managing contracts — rather than for sustainability reporting. When the German construction group asked its agencies for “ESRS S2-compatible workforce data,” the agencies had no framework for understanding what was being requested, no systems configured to extract the relevant metrics, and no contractual obligation to provide sustainability reporting data.
Data Gap Analysis: What Agencies Provide vs. What CSRD Requires
| CSRD Data Requirement | What Most Agencies Can Provide | Gap |
|---|---|---|
| Wage adequacy vs. collective agreement minimums by jurisdiction | Raw payroll data (gross amounts) | No cross-referencing against collective agreement classification rates; no jurisdiction-specific wage floor analysis |
| Working time compliance (max weekly hours, rest periods) | Basic timesheet records (hours per day) | No systematic monitoring against jurisdiction-specific maxima; no rest period tracking; no aggregated compliance rates |
| Health and safety incident rates (LTIR, TRIR) | Ad hoc incident reports (if site-reported to agency) | No standardised classification methodology; no denominator data (hours worked) for rate calculation; responsibility gap between agency and client |
| Collective agreement coverage (% of workers, which agreements) | Employment contract references (often generic) | No systematic verification of agreement applicability per jurisdiction and trade; incorrect classifications common |
| Accommodation standards compliance | Rental agreements or addresses | No verification against host-country housing standards; no inspection records; no compliance documentation |
| Training and skills development | Certification records (variable completeness) | No structured competency tracking; no training hours data; no development programme metrics |
| Grievance and remediation mechanisms | No structured systems | Complete gap — most agencies have no formal worker grievance process accessible to value chain reporting |
The German construction group discovered that assembling these metrics for 2,800 agency workers across 14 countries required data from six agencies operating under different data management practices, different contractual frameworks, and different levels of willingness to share operational data. The estimated €340,000 in consulting fees reflected not the complexity of the reporting standard itself, but the complexity of extracting structured data from an agency ecosystem that was never designed to produce it.
A mid-sized Austrian infrastructure contractor faced a comparable challenge when preparing for its first CSRD reporting cycle. The firm operated with approximately 640 agency-supplied workers across Austrian, German, and Czech projects. Data collection from four staffing agencies consumed 3,200 hours of internal staff time over seven months and required engagement of external consultants at a cost of €187,000. Even after this investment, the firm achieved only 74% data coverage — meaning 26% of its value chain workforce remained partially or fully unquantified in its sustainability disclosures.
CS3D: From Reporting to Due Diligence Obligation
If CSRD creates transparency obligations, the Corporate Sustainability Due Diligence Directive (CS3D) creates action obligations. CS3D, adopted in 2024 with phased application beginning in 2027, requires in-scope companies to conduct human rights and environmental due diligence across their value chains, including identifying, preventing, mitigating, and remediating adverse impacts on workers.
The CS3D phase-in follows a revenue-based schedule:
| Phase | Application Date | In-Scope Threshold |
|---|---|---|
| Phase 1 | 26 July 2027 | >5,000 employees and >€1.5 billion worldwide net turnover |
| Phase 2 | 26 July 2028 | >3,000 employees and >€900 million worldwide net turnover |
| Phase 3 | 26 July 2029 | >1,000 employees and >€450 million worldwide net turnover |
For contractors using staffing agencies to deploy international workers, CS3D creates specific obligations that go beyond reporting into active governance:
Identification of adverse impacts. Companies must assess whether workers in their value chain are subject to adverse working conditions, including wage underpayment, excessive working hours, inadequate safety protections, or substandard accommodation. This assessment cannot rely solely on agency assurances. It requires the company to establish independent verification mechanisms. The cost of building an identification framework — including risk mapping, prioritisation methodology, and monitoring infrastructure — ranges from €80,000 to €250,000 for a mid-sized contractor with multi-country operations, based on early implementation data from French companies subject to the Loi de vigilance.
Prevention and mitigation. Where risks of adverse impacts are identified, companies must take measures to prevent or mitigate them. This may include contractual requirements for agencies to meet specific standards, audit rights allowing the company to verify agency practices, and remediation mechanisms when violations are discovered. Contractual renegotiation across a portfolio of 6-10 staffing agency relationships typically requires €40,000-€75,000 in legal fees and 8-14 months of negotiation.
Complaints mechanisms. Companies must establish mechanisms allowing value chain workers to raise concerns about working conditions. For agency-supplied workers, this means creating channels accessible to workers who are not the company’s direct employees and who may have limited awareness of their rights under the company’s due diligence processes. Implementation costs for multilingual complaints mechanisms — including hotline services, case management systems, and investigation protocols — range from €25,000 to €60,000 in setup costs plus €15,000-€30,000 annually in operating costs.
Civil liability. CS3D includes provisions for civil liability where companies fail to conduct adequate due diligence and adverse impacts occur. This means contractors could face litigation from agency-supplied workers whose rights were violated, if the contractor failed to identify and prevent the violation through due diligence. Early cases under France’s 2017 Loi de vigilance demonstrate that courts are willing to hold parent companies responsible for working conditions across their value chains.
The combination of CSRD reporting obligations and CS3D due diligence obligations creates a regulatory framework where listed contractors must both know and act on conditions affecting workers throughout their supply chains, including workers they did not recruit, do not directly employ, and whose data they do not currently access.
The Auditor Problem
CSRD sustainability reports are subject to limited assurance engagement by statutory auditors or independent assurance service providers, with a transition to reasonable assurance expected by 2028. The transition timeline creates escalating scrutiny:
| Assurance Level | Applicable Period | Standard of Evidence | Auditor Conclusion Format |
|---|---|---|---|
| Limited assurance | 2024-2027 | Analytical procedures, inquiry, limited testing | ”Nothing has come to our attention…” (negative assurance) |
| Reasonable assurance | 2028 onward | Substantive testing, detailed evidence examination | ”In our opinion, the disclosures are fairly stated…” (positive assurance) |
Even under the less demanding limited assurance regime, auditors verifying workforce disclosures apply professional scepticism. When a construction group reports that “98% of value chain workers are paid at or above applicable collective agreement minimums,” auditors request the data supporting that claim. They examine wage records cross-referenced against collective agreement rate schedules by jurisdiction, classification, and time period. They evaluate the methodology for determining which collective agreements apply to which workers. They seek evidence that agency-provided data is complete, accurate, and covers the full worker population.
A listed Austrian infrastructure contractor experienced this dynamic during a dry-run assurance engagement in early 2025. The contractor had assembled workforce data from three staffing agencies covering 420 workers deployed to Austrian and German projects. The assurance provider identified the following deficiencies:
Wage data from one agency covered only 78% of the worker population, with 22% of workers’ records missing for periods between contract amendments. The contractor could not demonstrate wage compliance for those workers during the gap periods. Safety incident data from two agencies used different classification methodologies — one agency classified near-misses as recordable incidents while the other excluded them — making aggregation impossible without reclassification. The contractor could not produce a unified incident rate across the combined workforce. Collective agreement applicability had not been verified for 31% of workers deployed to German projects. The contractor had assumed the building industry agreement (Bau-Tarifvertrag) applied to all construction workers, but some workers’ roles fell under metal industry (Metall-Tarifvertrag) or electrical industry (Elektro-Tarifvertrag) agreements with different rate schedules and minimum wages differing by €2.40-€4.80 per hour depending on classification.
The assurance provider concluded that the contractor’s workforce disclosures could not be verified to limited assurance standard. The contractor had 11 months to remediate before its first mandatory reporting period.
Total remediation cost: €187,000 in external consulting plus approximately 2,400 hours of internal staff time valued at an estimated €144,000 in loaded labour costs, bringing the true remediation expense to approximately €331,000.
Financial Consequences of Reporting Failure
Before CSRD and CS3D, contractors could choose whether to govern their workforce supply chains rigorously. Both approaches were legally viable. The regulatory framework now emerging removes this optionality for listed companies and large undertakings. Workforce governance is becoming a compliance obligation with specific reporting requirements, assurance standards, due diligence mandates, and civil liability consequences.
The financial implications are substantial and quantifiable:
| Risk Category | Mechanism | Estimated Financial Impact |
|---|---|---|
| Qualified sustainability report | Auditor unable to verify workforce disclosures; qualified opinion visible to investors and ESG rating agencies | Credit spread widening of 15-25 bps; €2.1M-€3.5M additional annual financing costs on €1.4B outstanding debt |
| ESG rating downgrade | Rating agency assessment reflects disclosure gaps | Exclusion from ESG-screened investment indices; estimated €50M-€200M in potential divestment by mandate-bound institutional investors |
| Procurement exclusion | Public procurement directives referencing ESG qualification criteria | Loss of tender eligibility; 60% of revenue at risk for contractors dependent on public projects |
| CS3D civil liability | Litigation from affected workers or representative organisations | Defence costs €200,000-€500,000 per case; settlement exposure variable; reputational damage unquantifiable |
| Investor engagement | Institutional investors managing ESG-mandated assets; engagement campaigns, voting actions, divestment | Construction sector ESG engagement increased 340% between 2021-2025; board composition votes increasingly tied to ESG disclosure quality |
| Regulatory penalties | Member state enforcement of CSRD transposition; fines for non-filing or materially misleading disclosures | Variable by jurisdiction; Germany: up to €10M or 5% of average annual turnover; France: up to €75,000 per violation |
What Contractors Must Do Now
The timeline for CSRD compliance is not generous. Large listed companies began reporting in 2025. Large non-listed companies begin in 2026. The window for building workforce data infrastructure is closing.
Contractors deploying international workers through staffing agencies should take five specific actions:
Audit existing agency contracts for data-sharing provisions. Most staffing agency contracts contain confidentiality clauses restricting data sharing but do not contain provisions requiring agencies to provide ESRS-compatible workforce data. Contracts must be amended to include structured data obligations specifying format, frequency, coverage, and quality standards. Agencies that refuse to provide sustainability reporting data should be evaluated for replacement. Contract amendment costs range from €5,000 to €15,000 per agency relationship in legal fees, but failure to amend exposes the contractor to data gaps that cannot be closed during the reporting period.
Map worker populations by reporting category. ESRS S1 and S2 require different disclosures for own workforce versus value chain workers. Contractors must clearly categorise every worker contributing to operations as either own workforce (directly employed) or value chain worker (agency, subcontractor, or intermediary employed). The categorisation determines which reporting standard applies and what data is required. For a contractor with 1,200 direct employees and 2,800 agency workers, incorrect categorisation of even 5% of the population — 200 workers — can produce material misstatements in both S1 and S2 disclosures.
Establish collective agreement verification processes. For workers deployed to jurisdictions with universally applicable collective agreements, contractors must verify which agreements apply and confirm wage compliance. This cannot be delegated entirely to agencies. The reporting obligation and assurance requirement rest with the contractor. Germany alone has over 70,000 active collective agreements; identifying the correct agreement for each worker based on trade, region, and employer classification requires specialist knowledge costing €80-€150 per worker in verification fees for initial assessment.
Implement standardised safety incident reporting across agencies. Safety incident data must be aggregated across the entire workforce, including agency workers. This requires standardised classification methodologies aligned with GRI 403 (Occupational Health and Safety) or ESRS S1-14, reporting channels that capture incidents involving agency workers on client sites, and data integration with the contractor’s safety management systems. Implementation costs for a standardised reporting framework across 4-6 agencies range from €30,000 to €60,000.
Engage assurance providers early. Conducting dry-run assurance engagements 12 to 18 months before mandatory reporting identifies data gaps, methodology weaknesses, and remediation requirements while time remains to address them. A dry-run engagement typically costs €40,000-€80,000 — a fraction of the €187,000-€340,000 remediation costs that result from discovering gaps at the reporting deadline.
The construction group that discovered its €340,000 reporting gap had 14 months to remediate. Many contractors have less. The contractors that treat CSRD workforce reporting as a compliance project to be managed alongside environmental disclosures will discover that workforce data is fundamentally different from environmental data. Carbon emissions come from meters and invoices the company controls. Worker conditions come from third-party systems the company has never accessed. Building the infrastructure to access, verify, and report on workforce supply chain data is not a reporting exercise. It is a governance transformation.
ESG compliance is converting workforce governance from an operational preference exercised by sophisticated contractors into a regulatory obligation imposed on all listed companies operating in the EU. Contractors who have governed their workforce supply chains rigorously will find CSRD reporting to be an incremental effort. Contractors who have treated staffing agencies as opaque commodity suppliers will find it to be a structural challenge requiring fundamental changes to how they source, manage, and monitor their deployed workforce.
The regulation does not care which category a contractor falls into. The reporting deadline arrives on the same date for both.
References
-
Directive 2022/2464/EU of the European Parliament and of the Council of 14 December 2022 amending Regulation (EU) No 537/2014, Directive 2004/109/EC, Directive 2006/43/EC, and Directive 2013/34/EU, as regards corporate sustainability reporting (Corporate Sustainability Reporting Directive).
-
Commission Delegated Regulation (EU) 2023/2772 of 31 July 2023 supplementing Directive 2013/34/EU as regards sustainability reporting standards (European Sustainability Reporting Standards — ESRS).
-
Directive (EU) 2024/1760 of the European Parliament and of the Council of 13 June 2024 on corporate sustainability due diligence (CS3D).
-
EFRAG, ESRS S1 — Own Workforce, Exposure Draft and Final Standard, November 2022 / July 2023.
-
EFRAG, ESRS S2 — Workers in the Value Chain, Exposure Draft and Final Standard, November 2022 / July 2023.
-
EFRAG, Implementation Guidance IG 1: Materiality Assessment, January 2024.
-
Loi n 2017-399 du 27 mars 2017 relative au devoir de vigilance des societes meres et des entreprises donneuses d’ordre (French Duty of Vigilance Law).
-
OECD, Due Diligence Guidance for Responsible Business Conduct, 2018.
-
GRI 403: Occupational Health and Safety 2018, Global Reporting Initiative.
-
European Commission, Questions and Answers on the Adoption of European Sustainability Reporting Standards, COM/2023/5303, July 2023.