When Is CSRD Reporting Required? The Post-Omnibus Timeline

The original CSRD created four reporting waves covering an estimated 50,000 companies globally. After the Omnibus simplification, roughly 90% of them are out of mandatory scope. If you’re still planning around the pre-Omnibus timeline for when CSRD reporting is required, three of the four original deadlines have been either postponed or eliminated.

The confusion is understandable. Between the Stop-the-clock Directive in April 2025, the Omnibus threshold overhaul, and the July 2026 delegated acts, even experienced compliance teams are working from outdated wave labels. Wave two? Postponed. Wave three? Gone for most companies. The neat four-row table from 2023 doesn’t match the law anymore.

Here’s what actually applies now, tested against the final amended directive (EU) 2026/470 rather than the original 2022 text.

Three Variables That Determine Your Reporting Deadline

CSRD does not impose a single date. Your reporting trigger depends on three things:

1. Company size against the new thresholds. The Omnibus replaced the old two-out-of-three test with a cumulative requirement: more than 1,000 employees and net turnover above EUR 450 million. Both conditions must be met. The Council confirmed these thresholds in February 2026.
2. EU vs. non-EU status. EU companies are tested against the size threshold directly. Non-EU parent groups face a separate test under Article 40a, based on EU-generated turnover and the presence of qualifying EU subsidiaries or branches.
3. Financial year vs. publication year. “FY2027 reporting” means the company measures the financial year starting on or after January 1, 2027. The report itself is published in the following cycle. When someone says “CSRD is required in 2028,” clarify whether they mean the year being measured or the year the document appears. Those are different years with different planning windows.

That third variable trips up more people than any threshold calculation. Get it wrong and your entire project timeline shifts by 12 months.

What the Omnibus Changed (and What It Didn’t)

The original CSRD, adopted in 2022, cast a wide net. Four waves, staggered by size and listing status, aimed to bring standardized sustainability reporting to the vast majority of large European businesses and many international groups.

The Omnibus package, combined with the April 2025 Stop-the-clock Directive, restructured that entirely:

The critical nuance: Omnibus narrowed who reports, not what they report. Companies that remain in scope face full ESRS requirements, double materiality assessments, and mandatory assurance. The bar got higher for entry. The work inside the bar didn’t shrink.

And don’t assume that falling out of mandatory scope means the market stopped caring. KPMG found that two-thirds of surveyed companies outside the Omnibus scope intended to continue voluntary ESG reporting. Customers, lenders, and supply-chain partners don’t wait for legal mandates to ask for data.

The Current CSRD Timeline

Forget the four-wave labels. Here is the timeline that reflects the law as it stands:

Two calendar traps worth flagging:

First, “FY starting on or after January 1, 2027” behaves differently depending on your fiscal year. A calendar-year company starts measuring on January 1, 2027 and publishes its CSRD report in 2028. A company with a March 31 year-end starts the relevant fiscal year on April 1, 2027.

Second, member states must adopt and publish national transposition measures by July 26, 2028. That means some companies will begin their FY2027 reporting year before the national rules are formally in place. Waiting for transposition is not a compliance strategy. The directive is binding regardless.

Non-EU Companies and the Article 40a Test

The idea that CSRD is “an EU thing” is wrong. Article 40a creates a reporting obligation for non-EU parent undertakings that meet specific EU-presence conditions.

The test has two parts:

1. EU turnover threshold: The non-EU group must generate more than EUR 450 million in the EU during each of the last two consecutive financial years.
2. EU connection: The group must have either an EU subsidiary or an EU branch that generates more than EUR 200 million in net turnover.

EFRAG is developing the specific sustainability reporting standards for Article 40a entities. First statements will cover FY2028 data, with publication expected in 2029. The report scope is generally global, though non-EU groups may limit certain topics to EU-related impacts under the stated approach.

How many companies does this affect? EFRAG estimated approximately 350 to 450 US companies and 150 to 200 UK companies remain in scope, down from an original estimate of roughly 10,000. These are estimates with limited public methodology, but the direction is clear: the Omnibus cut the non-EU population significantly while keeping the obligation real for large multinationals with substantial European operations.

If you’re a US or UK group with major EU subsidiaries, the right question is not “does CSRD apply to us?” It’s “do we exceed the two-year consecutive turnover test, and does our EU presence clear the EUR 200 million bar?” If both answers are yes, you have roughly 18 months before the reporting year starts.

What the Report Must Contain

CSRD is not a standalone sustainability brochure. The sustainability statement sits inside the management report, is published alongside the annual financial statements and assurance opinion, and must be approved before publication. The Commission’s FAQ confirms that the management report must be published within a national maximum of 12 months after the balance sheet date, with listed issuers facing a four-month deadline.

The content is governed by the European Sustainability Reporting Standards (ESRS), developed by EFRAG. The central framework is double materiality:

• Impact materiality: Does the company create actual or potential positive or negative impacts on people and the environment?
• Financial materiality: Do sustainability matters create risks or opportunities that could affect enterprise value, cash flows, access to finance, or cost of capital?

Both lenses apply simultaneously. A topic that is material under either lens triggers disclosure requirements under the relevant ESRS standard. This is not a menu where companies pick the topics they’re comfortable with. It’s a structured assessment that must be robust enough for an independent assurer to evaluate.

The practical content requirements span environment (climate change, pollution, water and marine resources, biodiversity, resource use and circular economy), social (own workforce, value-chain workers, affected communities, consumers and end-users), and governance. For each material topic, companies must disclose governance arrangements, policies, targets, actions, metrics, and performance.

Assurance is mandatory from the start at the limited level. The Commission must adopt EU-wide limited-assurance standards by October 1, 2026, with member states permitted to apply national standards until then. Limited assurance involves less extensive procedures than reasonable assurance, but it still requires evidence, documented controls, and a defensible data trail. Companies that assume “limited” means “light” will be surprised by what assurers actually request.

Where Most CSRD Efforts Break Down: Auditable Data

I’ve spent over 15 years helping companies track physical assets and environmental conditions across industrial operations. In my experience, the hardest part of any reporting obligation is never understanding the regulation. It’s collecting reliable data from the real world.

The first wave of CSRD reports confirms this. KPMG analyzed 50 first-wave ESRS statements published in early 2025 and found something telling: almost all companies reported Scope 1, 2, and 3 emissions. Fewer than one-third reported actual reductions. Measuring a baseline is relatively straightforward when the numbers come from energy bills and fuel invoices. Proving that capital allocation and operations are changing requires a fundamentally different data infrastructure.

KPMG also found that companies felt significantly less prepared for pollution data, social metrics, and value-chain disclosures than for climate. The reason is obvious: climate data (energy consumption, fuel purchases) already lives in finance systems. Pollution monitoring, real-time resource consumption at the facility level, workforce conditions across suppliers? That data often doesn’t exist in any system at all.

PwC’s global CSRD survey found that more than 90% of respondents were using or planning to use spreadsheets for sustainability data. At the same time, the average CSRD implementation involved eight different business functions: sustainability, finance, operations, procurement, technology, legal, HR, and more. Eight functions feeding a spreadsheet. That’s not a reporting process. That’s a reconciliation problem waiting for an assurer to identify it.

The gap is between having a report and having auditable data. A published PDF looks the same whether the numbers come from governed source systems or from someone’s best estimate in an email thread. An assurer will not look at both the same way.

This is where operational measurement technology becomes relevant. Environmental monitoring sensors, automated tracking of resource consumption across facilities, IoT-based data collection for energy, emissions proxies, temperature, and asset utilization generate timestamped, traceable, machine-readable records. Exactly the kind of evidence that CSRD’s assurance requirements and XBRL electronic tagging increasingly demand.

If your CSRD data strategy starts with “ask the facility manager to fill out a quarterly form,” you’re building on sand. The companies that reported successfully in the first wave connected their sustainability statements to continuous operational measurement, not estimates compiled after the fact.

Frequently Asked Questions

Is CSRD reporting required in 2026?

Not for most companies. Wave-one companies (former NFRD population) already reported on FY2024 data in 2025. Requirements for companies originally due in FY2025 or FY2026 were postponed by the Stop-the-clock Directive. The amended second set begins for financial years starting on or after January 1, 2027, with reports appearing in 2028. Wave-one companies should check the 2025 ESRS quick fix for transitional flexibility on their FY2025 and FY2026 reporting cycles.

Which EU companies must report under the new scope?

The amended threshold requires both conditions: more than 1,000 average employees during the financial year and net turnover above EUR 450 million. Meeting only one condition is insufficient. Confirm group consolidation rules, employee calculation methodology, and your member state’s transposition timeline before concluding that any entity is in or out.

Does a US parent company need to report under CSRD?

Potentially. Under Article 40a, a non-EU parent must generate more than EUR 450 million in EU turnover during each of the last two consecutive financial years and have an EU subsidiary or branch exceeding EUR 200 million. If both conditions are met, the group reports on FY2028 data, published in 2029. EFRAG estimates 350 to 450 US companies remain in scope.

What is the difference between the financial year and the publication year?

The financial year is the period being measured. The publication year is when the management report containing the sustainability statement is filed. A company reporting on FY2027 data publishes in its 2028 reporting cycle. Listed issuers on EU regulated markets must publish within four months of year-end. Other companies follow national rules, capped at 12 months after the balance sheet date.

Is reasonable assurance required from the start?

No. The initial requirement is limited assurance, which involves less extensive testing. The Commission must adopt EU limited-assurance standards by October 1, 2026. Companies should still build data controls as if a stronger standard is coming: the directive anticipates a potential transition to reasonable assurance, and assurers already probe evidence chains rigorously under the limited standard.

Can companies below the new thresholds stop sustainability reporting?

Legally, they have no mandatory CSRD obligation. Practically, many won’t stop. KPMG found two-thirds of surveyed companies outside the Omnibus scope intended to continue voluntary ESG reporting. Customers, lenders, investors, and value-chain partners routinely request sustainability data regardless of legal mandates. Legal exemption and market irrelevance are not the same thing.

If your sustainability data starts with what happens on the ground (across facilities, fleets, and supply chains), that’s where operational IoT closes the gap between estimates and auditable measurements. Our environmental tracking solutions are built for exactly this kind of continuous, traceable data collection. Questions? Talk to our team, or reach out at info@datanetiot.com.