CSRD Timeline 2026: Who Needs to Report and When

Most CSRD timelines you'll find online are wrong. They show a four-phase rollout running from 2024 to 2029 with a 250-employee threshold — the schedule the directive was adopted with in 2022. The Omnibus Simplification Package rewrote it. Waves 2 and 3 moved back two years, the size thresholds went up sharply, and listed SMEs came out of mandatory scope entirely.

This guide is the current version: which wave you're in, when your first report is actually due, and what the years before it should look like.

The CSRD Timeline at a Glance

Wave	Who is in it	First financial year	Report published
Wave 1	Large public-interest entities already reporting under the NFRD (500+ employees)	FY 2024	2025 — already filed
Wave 2	Other large companies above the revised thresholds	FY 2027	2028
Wave 3	Listed SMEs	No longer mandatory — voluntary VSME	—
Wave 4	Non-EU groups with €450M+ net turnover in the EU	FY 2028	2029

Two changes drove this table, and they arrived separately.

Stop the Clock. Directive (EU) 2025/794, adopted in April 2025, postponed reporting deadlines without touching scope. Wave 2 moved from FY 2025 to FY 2027. Wave 3 moved from FY 2026 to FY 2028. Waves 1 and 4 were untouched.

The Substantive Directive, Directive (EU) 2026/470, signed on 24 February 2026, then changed who is in scope at all — raising the thresholds for Wave 2 and removing listed SMEs from mandatory reporting. The Commission's own impact estimates put the reduction at roughly 80% of previously in-scope companies.

If you read a timeline that reflects only the first change, you'll get the dates right and the scope wrong.

Which Wave Are You In?

Wave 1 — Large Public-Interest Entities

You are in Wave 1 if you were already subject to the Non-Financial Reporting Directive (NFRD): a large public-interest entity — listed company, bank, or insurer — with more than 500 employees.

Your first CSRD report covered financial year 2024 and was published in 2025. Nothing in the Omnibus gave Wave 1 relief on disclosures already made. What changed for you is the content of subsequent reports: the revised ESRS Set 1 applies, with fewer mandatory data points.

If you want the detail on what the NFRD required and how much of it carried over, see CSRD vs NFRD.

Wave 2 — Other Large Companies

This is where nearly all the confusion sits, because both the date and the entry test moved.

The date: your first report covers financial year 2027 and is published in 2028.

The test: under the original CSRD, a "large undertaking" met at least two of three criteria — 250+ employees, €50M+ net turnover, €25M+ total assets. The Omnibus replaced that test with a single cumulative one: you are in scope only if you exceed both 1,000 employees and €450M net turnover. Total assets no longer count.

That is a different population of companies, not just a later date for the same one. A group with 400 employees and €120M turnover was squarely in Wave 2 under the original directive and is now out of mandatory scope.

Wave 3 — Listed SMEs

Stop the Clock moved listed SMEs to FY 2028. The Substantive Directive then removed them from mandatory CSRD scope altogether and pointed them at the Voluntary SME standard (VSME) instead.

If you are a listed SME that had already started readiness work, you now have a choice rather than a deadline. Our SME compliance guide covers the VSME and when continuing voluntarily is the right call — which it often is, if larger customers are already asking you for ESG data.

Wave 4 — Non-EU Groups

You are in Wave 4 if your group is headquartered outside the EU, generates more than €450 million in net turnover in the EU in each of the last two years, and has an EU subsidiary, or failing that an EU branch, with more than €200 million in net turnover. Directive (EU) 2026/470 (Article 2, point 13) raised these thresholds from €150 million and €40 million, and let financial holding groups with independent subsidiaries opt out. The CSRD for non-EU companies guide covers the test in detail.

Your timing is unchanged: first report covering financial year 2028, published in 2029. The Omnibus simplifications to ESRS Set 1 will apply when you file, which is a genuine benefit — you get the trimmed standard without ever having reported under the original one.

The Trap: The Deadline Moved, the Baseline Didn't

The single most expensive misreading of this timeline is treating the two-year delay as two years of nothing to do.

A Wave 2 company reporting on financial year 2027 needs data systems capturing that year from 1 January 2027. Not designed in 2027 — capturing in 2027. And because sustainability statements are expected to show comparatives and trends, the practical data horizon starts earlier still.

Companies that paused data collection in mid-2025 when Stop the Clock landed are now reconstructing 2026 figures from spreadsheets and supplier emails. That reconstruction costs more than the collection would have.

The same logic applies to assurance. Limited assurance is required from your first report, and the Commission's harmonised limited assurance standards are due by 1 July 2027 — see our assurance and audit guide. Controls an auditor can test are not built in the year of the audit.

What to Do in Each Year Before Your First Report

Working backwards from a first report on FY 2027, published in 2028:

Three years out — scope and materiality. Confirm whether the revised thresholds change your status, and document the conclusion in a board-ready memo. If you're in, run your double materiality assessment. Everything downstream depends on which topics come out material, so getting this wrong is the costliest error available.

Two years out — gap analysis and systems. Map each material topic to the ESRS data points it requires, then to where that data lives today. Most companies discover that a third of it doesn't exist in any system. Our data collection and gap analysis guide walks through the exercise.

One year out — dry run. Collect a full year of data as if you were reporting on it. Produce a draft sustainability statement. Give it to your auditor informally. The findings from a dry run are cheap; the same findings during the real assurance engagement are not.

Reporting year — collect and control. The systems are running, the controls are documented, and the work is execution rather than design. If you reach your reporting year still designing, you are late regardless of what the directive says.

Timeline of the Rule Changes Themselves

Useful if you're explaining to a board why the plan changed twice:

Date	Event
Nov 2022	CSRD adopted
Jan 2023	CSRD enters into force
FY 2024	Wave 1 first reporting period (filed 2025)
Feb 2025	Commission publishes the Omnibus Simplification Package
Apr 2025	Stop-the-Clock Directive adopted — Waves 2 and 3 postponed
24 Feb 2026	Substantive Directive, (EU) 2026/470, signed — new thresholds, listed SMEs removed
26 Feb 2026	Published in the Official Journal; in force from 18 Mar 2026
Sep 2026	Commission's own deadline to adopt the revised ESRS Set 1: six months after entry into force
19 Mar 2027	Deadline for member states to transpose the substantive changes
Jul 2027	Deadline for the Commission's limited assurance standards
FY 2027	Wave 2 first reporting period (filed 2028)
FY 2028	Wave 4 first reporting period (filed 2029)

Getting the Timeline Right for Your Company

The waves are simple; applying them to a real group structure is not. Consolidated versus standalone thresholds, part-year acquisitions, EU subsidiaries of non-EU parents, and financial years that don't align to the calendar all change the answer.

If you want that answered properly, browse CSRD experts in Germany and CSRD experts in the Netherlands — many have taken Wave 1 companies through a full reporting cycle and are now scoping Wave 2 projects. Our guides on how to hire a CSRD consultant and what CSRD consulting costs cover what a scoping engagement should involve and what it should cost.

The deadline moved. The work didn't get smaller — it just got a more forgiving date attached to it.