CSRD Timeline 2026: Who Needs to Report and When

Most CSRD timelines you'll find online are wrong. They show a four-phase rollout running from 2024 to 2029 with a 250-employee threshold — the schedule the directive was adopted with in 2022. The Omnibus Simplification Package rewrote it. Waves 2 and 3 moved back two years, the size thresholds went up sharply, and listed SMEs came out of mandatory scope entirely.

This guide is the current version: which wave you're in, when your first report is actually due, and what the years before it should look like.

The CSRD Timeline at a Glance

Wave	Who is in it	First financial year	Report published
Wave 1	Large public-interest entities already reporting under the NFRD (500+ employees)	FY 2024	2025 — already filed
Wave 2	Other large companies above the revised thresholds	FY 2027	2028
Wave 3	Listed SMEs	No longer mandatory — voluntary VSME	—
Wave 4	Non-EU groups with €150M+ net turnover in the EU	FY 2028	2029

Two changes drove this table, and they arrived separately.

Stop the Clock. Directive (EU) 2025/794, adopted in April 2025, postponed reporting deadlines without touching scope. Wave 2 moved from FY 2025 to FY 2027. Wave 3 moved from FY 2026 to FY 2028. Waves 1 and 4 were untouched.

The Substantive Directive, adopted in late 2025, then changed who is in scope at all — raising the thresholds for Wave 2 and removing listed SMEs from mandatory reporting. The Commission's own impact estimates put the reduction at roughly 80% of previously in-scope companies.

If you read a timeline that reflects only the first change, you'll get the dates right and the scope wrong.

Which Wave Are You In?

Wave 1 — Large Public-Interest Entities

You are in Wave 1 if you were already subject to the Non-Financial Reporting Directive (NFRD): a large public-interest entity — listed company, bank, or insurer — with more than 500 employees.

Your first CSRD report covered financial year 2024 and was published in 2025. Nothing in the Omnibus gave Wave 1 relief on disclosures already made. What changed for you is the content of subsequent reports: the revised ESRS Set 1 applies, with fewer mandatory data points.

If you want the detail on what the NFRD required and how much of it carried over, see CSRD vs NFRD.

Wave 2 — Other Large Companies

This is where nearly all the confusion sits, because both the date and the entry test moved.

The date: your first report covers financial year 2027 and is published in 2028.

The test: under the original CSRD, a "large undertaking" met at least two of three criteria — 250+ employees, €50M+ net turnover, €25M+ total assets. The Omnibus raised the employee threshold to 1,000 employees and the turnover criterion to €450M.

That is a different population of companies, not just a later date for the same one. A group with 400 employees and €120M turnover was squarely in Wave 2 under the original directive and is now out of mandatory scope.

Wave 3 — Listed SMEs

Stop the Clock moved listed SMEs to FY 2028. The Substantive Directive then removed them from mandatory CSRD scope altogether and pointed them at the Voluntary SME standard (VSME) instead.

If you are a listed SME that had already started readiness work, you now have a choice rather than a deadline. Our SME compliance guide covers the VSME and when continuing voluntarily is the right call — which it often is, if larger customers are already asking you for ESG data.

Wave 4 — Non-EU Groups

You are in Wave 4 if your group is headquartered outside the EU, generates more than €150 million in net turnover in the EU, and has at least one EU subsidiary or branch meeting the relevant thresholds.

Your timing is unchanged: first report covering financial year 2028, published in 2029. The Omnibus simplifications to ESRS Set 1 will apply when you file, which is a genuine benefit — you get the trimmed standard without ever having reported under the original one.

The Trap: The Deadline Moved, the Baseline Didn't

The single most expensive misreading of this timeline is treating the two-year delay as two years of nothing to do.

A Wave 2 company reporting on financial year 2027 needs data systems capturing that year from 1 January 2027. Not designed in 2027 — capturing in 2027. And because sustainability statements are expected to show comparatives and trends, the practical data horizon starts earlier still.

Companies that paused data collection in mid-2025 when Stop the Clock landed are now reconstructing 2026 figures from spreadsheets and supplier emails. That reconstruction costs more than the collection would have.

The same logic applies to assurance. Limited assurance is required from your first report, and the Commission is developing reasonable assurance standards by October 2028 — see our assurance and audit guide. Controls that satisfy a reasonable assurance auditor are not built in the year of the audit.

What to Do in Each Year Before Your First Report

Working backwards from a first report on FY 2027, published in 2028:

Three years out — scope and materiality. Confirm whether the revised thresholds change your status, and document the conclusion in a board-ready memo. If you're in, run your double materiality assessment. Everything downstream depends on which topics come out material, so getting this wrong is the costliest error available.

Two years out — gap analysis and systems. Map each material topic to the ESRS data points it requires, then to where that data lives today. Most companies discover that a third of it doesn't exist in any system. Our data collection and gap analysis guide walks through the exercise.

One year out — dry run. Collect a full year of data as if you were reporting on it. Produce a draft sustainability statement. Give it to your auditor informally. The findings from a dry run are cheap; the same findings during the real assurance engagement are not.

Reporting year — collect and control. The systems are running, the controls are documented, and the work is execution rather than design. If you reach your reporting year still designing, you are late regardless of what the directive says.

Timeline of the Rule Changes Themselves

Useful if you're explaining to a board why the plan changed twice:

Date	Event
Nov 2022	CSRD adopted
Jan 2023	CSRD enters into force
FY 2024	Wave 1 first reporting period (filed 2025)
Feb 2025	Commission publishes the Omnibus Simplification Package
Apr 2025	Stop-the-Clock Directive adopted — Waves 2 and 3 postponed
Late 2025	Substantive Directive adopted — new thresholds, listed SMEs removed
Early 2026	Revised ESRS Set 1 adopted via delegated act
2026	Member states transpose the substantive changes
FY 2027	Wave 2 first reporting period (filed 2028)
Oct 2028	Target date for reasonable assurance standards
FY 2028	Wave 4 first reporting period (filed 2029)

Frequently Asked Questions

When is the CSRD deadline for my company?

If you were under the NFRD, it has passed — your first report covered FY 2024. If you are a large company above the revised thresholds, it is your FY 2027 report, published in 2028. If you are a non-EU group with €150M+ EU turnover, it is your FY 2028 report, published in 2029. Listed SMEs no longer have a mandatory deadline.

Did the Omnibus cancel the CSRD?

No. It delayed two waves, raised the size thresholds, trimmed the ESRS data points, and made listed SME reporting voluntary. Double materiality, mandatory limited assurance, and digital tagging all survived intact.

Does CSRD still apply to non-EU companies?

Yes, and on the original schedule. Non-EU groups with more than €150 million of net turnover in the EU and a qualifying EU subsidiary or branch report on financial year 2028.

We dropped below the new thresholds. Do we stop?

You stop having a legal obligation. Whether you stop reporting is a commercial question — banks, insurers, and in-scope customers continue to ask for ESG data regardless, and the value chain requirements of your larger customers land on you either way.

Can we report earlier than our wave requires?

Yes. Voluntary early reporting under ESRS is permitted and is common among companies that expect to enter scope later or that face investor pressure now. It also converts your first mandatory report from an event into a routine.

Getting the Timeline Right for Your Company

The waves are simple; applying them to a real group structure is not. Consolidated versus standalone thresholds, part-year acquisitions, EU subsidiaries of non-EU parents, and financial years that don't align to the calendar all change the answer.

If you want that answered properly, browse our directory of CSRD experts — many have taken Wave 1 companies through a full reporting cycle and are now scoping Wave 2 projects. Our guides on how to hire a CSRD consultant and what CSRD consulting costs cover what a scoping engagement should involve and what it should cost.

The deadline moved. The work didn't get smaller — it just got a more forgiving date attached to it.