Member States shall ensure statutory audits of financial statements of public‑interest entities and medium‑sized and large undertakings by auditors or audit firms approved under Directive 2006/43/EC. Auditors must opine on whether the management report is consistent with the financial statements and prepared in accordance with legal requirements (excluding sustainability reporting under Article 19a); where applicable they must provide a limited assurance opinion on compliance of sustainability reporting with this Directive, including standards under Article 29b, the process used to identify reported information, markup under Article 29d, and compliance with Article 8 of Regulation (EU) 2020/852. Auditors must state whether material misstatements in the management report were identified and indicate their nature.

The rules apply mutatis mutandis to consolidated financial statements and management reports. Member States may permit a different auditor or an independent assurance services provider to give the limited assurance opinion if subject to requirements equivalent to Directive 2006/43/EC, covering training and examination, continuing education, quality assurance, ethics and independence, appointment and dismissal, investigations and sanctions, work organisation and reporting irregularities. Transitional accreditation and continuing education provisions are specified; from 6 January 2027 cross‑border assurance is permitted under supervisory conditions, and accredited third‑party assurance reports must be made available as an annex to the management report or by other publicly accessible means.