CSRD timeline 2026: key dates and deadlines

The regulatory picture around the EU's Corporate Sustainability Reporting Directive has shifted significantly over the past year. The Omnibus I Amendment Directive is now final. Reporting timelines have been adjusted. Thresholds have changed. For U.S.-based companies with EU exposure, 2026 is the year to get oriented.

This piece maps the key dates, explains the phase-in structure, and flags what's settled versus what companies are still waiting on.

How CSRD phases in: the wave structure

CSRD obligations don't apply all at once. They roll out across four waves, each defined by company size, listing status, and geography.

Wave 1 — FY 2024, reporting in 2025: The first wave covers large public-interest entities that were already subject to the predecessor Non-Financial Reporting Directive — primarily listed companies, banks, and insurers with 500 or more employees. These companies published their first CSRD-compliant reports earlier this year and are now mid-way through their second reporting cycle, incorporating early lessons into their processes.

Wave 2 — FY 2025, reporting in 2026: Wave 2 captures other large EU companies that clear the revised Omnibus I thresholds: 1,000 or more employees and €450 million or more in net annual turnover. First reports covering FY 2025 are due this year. For most of these companies, this is their first mandatory disclosure under a framework of this complexity.

Wave 3 — FY 2026, reporting in 2027: Listed SMEs and small non-complex credit institutions fall into Wave 3, reporting under a proportionate set of simplified standards. The current year is the active data collection period. Companies that haven't yet established collection processes and governance structures are already behind.

Wave 4 — FY 2028, reporting in 2029: Wave 4 covers non-EU companies generating €150 million or more in net EU turnover with at least one qualifying EU subsidiary or branch. This is the most directly relevant wave for U.S.-based multinationals. The "Stop-the-Clock" postponements introduced under Omnibus I, which adjusted timelines for certain EU-based companies, do not extend to Wave 4. That deadline is unchanged.

What Omnibus I changed — and what it didn't

Omnibus I is final. But it's worth being precise about what that means.

The directive raised thresholds significantly: EU companies now need 1,000 or more employees and €450 million or more in net annual turnover to be directly in scope. The original criteria were considerably lower, and this change removed a large number of mid-size European companies from mandatory reporting. For non-EU companies, the threshold is €150 million in EU net turnover — that number was not raised by Omnibus.

Other notable changes: the planned progression from limited to reasonable assurance has been removed, sector-specific standards have been eliminated, and companies with fewer than 1,000 employees are now protected from extensive data requests from larger reporting companies in their value chains.

What Omnibus I did not do: finalize the reporting standards. The European Sustainability Reporting Standards — the actual framework companies report against — remain in draft form. The Commission has until approximately late August 2026 to adopt a simplified final version. That draft, released in December 2025, reduces mandatory data points by 61% and eliminates all voluntary disclosures. Companies should be using it to orient data collection now, with the understanding that the final version may differ.

EU member state transposition is also still underway. Member states have until March 19, 2027. Progress is uneven across the 27 EU member states and three EEA EFTA countries — Ropes & Gray's monthly CSRD Transposition Tracker is the most reliable resource for monitoring national-level developments.

Where U.S. companies stand

For most U.S.-based multinationals, Wave 4 is the operative timeline: FY 2028, first reports due in 2029. That schedule was not affected by Omnibus I's Stop-the-Clock provisions.

Two years and a financial year sounds like runway. It isn't. Building CSRD-compliant reporting infrastructure — data collection systems, double materiality assessments, assurance readiness — takes 12 to 18 months. Companies that wait for the final ESRS before beginning will be building under deadline pressure. The draft standards are detailed enough to start.

Even companies outside CSRD's direct scope face indirect exposure. CSRD-reporting companies must disclose on their supply chains, and if your enterprise customers are among them, your sustainability data is already part of their compliance picture — whether or not you're required to report.

Our Regulatory Readiness Solutions: Whether you’re navigating CSRD in Europe, California’s climate disclosure laws, or emerging EPR requirements, the pressure to keep up with the ever-evolving sustainability landscape is mounting. If you’ve been asked to prepare for new sustainability regulations but aren't sure where to start, you’re not alone. We help companies cut through complexity with a clear roadmap that gets you from where you are to where you need to be. Reach out today.