The regulatory picture around the EU's Corporate Sustainability Reporting Directive has shifted significantly over the past year. The Omnibus I Amendment Directive is now final. Reporting timelines have been adjusted. Thresholds have changed. For U.S.-based companies with EU exposure, 2026 is the year to get oriented.
This piece maps the key dates, explains the current reporting structure, and flags what's settled versus what companies are still waiting on.
How CSRD phases in: from waves to two tracks
CSRD originally rolled out across four waves defined by company size, listing status, and geography. Omnibus I compressed that structure significantly.
One group of companies is already reporting. A second group — everyone else who remains in scope — begins with FY 2027 data.
Companies already reporting (former Wave 1) — FY 2024, reporting in 2025: The first cohort covers large public-interest entities that were subject to the predecessor Non-Financial Reporting Directive — primarily listed companies, banks, and insurers with 500 or more employees. These companies published their first CSRD-compliant reports earlier this year. They were not included in the "Stop-the-Clock" relief that Omnibus I extended to other reporting waves, though certain transitional reliefs allow them to temporarily omit specific disclosures.
Some Wave 1 companies now fall below the revised Omnibus I thresholds — more than 1,000 employees and €450 million or more in net annual turnover. For those companies, exiting is not immediate. CSRD obligations continue through the 2027 reporting year (covering FY 2026 data). EU member states may grant exemptions, but this will vary country by country.
Companies subject to original Waves 2, 3, and 4 — significant changes apply:
- Former Wave 2 companies (other large EU entities) that clear the revised thresholds must now begin reporting in 2028, covering FY 2027 data — a two-year delay from the original timeline.
- Former Wave 3 companies (listed SMEs and small credit institutions) are no longer in scope under the revised CSRD.
- Former Wave 4 companies (non-EU groups) face a revised threshold: €450 million or more in net EU turnover — up significantly from the original €150 million — plus an EU subsidiary or branch with €200 million or more in EU revenue. Those that meet the revised criteria begin reporting in 2029, covering FY 2028 data.
Timeline
| Date | Milestone | Who it affects |
|---|---|---|
| January 2023 | CSRD enters into force | All in-scope companies |
| July 2023 | First set of ESRS adopted by European Commission | All in-scope companies |
| January 1, 2024 | Former Wave 1 reporting period begins (FY 2024) | Large PIEs under former NFRD |
| Early 2025 | Former Wave 1 first reports published | Large PIEs |
| February 26, 2026 | Omnibus I published in EU Official Journal — now final law | All in-scope companies |
| ~Late 2026 | Commission deadline to adopt simplified ESRS | All in-scope companies |
| March 19, 2027 | EU member state transposition deadline for Omnibus I | EU member states |
| January 1, 2027 | Reporting period begins for FY 2027 data (optional early adoption) | Former Wave 2 EU companies |
| January 1, 2028 | Mandatory reporting period begins (FY 2027 data) | Former Wave 2 EU companies |
| 2028 H1 | First reports published under revised CSRD | Former Wave 2 EU companies |
| January 1, 2028 | Reporting period begins for FY 2028 data | Non-EU groups (former Wave 4) |
| 2029 H1 | First reports published | Non-EU groups |
What Omnibus I changed — and what it didn't
Omnibus I is final. But it's worth being precise about what that means.
The directive raised thresholds significantly. EU companies now need more than 1,000 employees and €450 million or more in net annual turnover to remain directly in scope. The original criteria were considerably lower, and this change removed a large number of mid-size European companies from mandatory reporting. Listed SMEs are no longer in scope. For non-EU companies, the revised threshold is €450 million in net EU turnover — up from €150 million in the original directive — plus an EU subsidiary or branch with at least €200 million in EU revenue.
Other notable changes: the planned progression from limited to reasonable assurance has been removed. The EU will develop limited assurance standards, which must be adopted by July 2027. Sector-specific ESRS have been eliminated. Companies with fewer than 1,000 employees are now protected from extensive data requests from larger reporting companies in their value chains.
What Omnibus I did not do: finalize the reporting standards. The European Sustainability Reporting Standards — the actual framework companies report against — remain under revision. EFRAG's current draft reduces mandatory data points by 61% (from approximately 1,100 to roughly 430) and eliminates all voluntary disclosures. All topical disclosures, including climate, are now fully subject to materiality — if a topic isn't material to your business, you don't report on it. The final simplified ESRS is expected by September 18, 2026, with mandatory reporting starting in 2028 and optional early adoption for FY 2026 data. A separate standards track for non-EU groups — the N-ESRS — is also in development, though that work is currently paused pending finalization of the main ESRS.
EU member state transposition is also still underway. Member states have until March 19, 2027, and progress is uneven across the 27 EU member states and three EEA EFTA countries. Ropes & Gray's monthly CSRD Transposition Tracker is the most reliable resource for monitoring national-level developments.
Where U.S. companies stand
For most U.S.-based multinationals, the operative question is whether they clear the revised Wave 4 threshold: €450 million or more in net EU turnover, with an EU subsidiary or branch generating at least €200 million in EU revenue. That bar is meaningfully higher than it was under the original directive. Companies that were planning for CSRD obligations under the old €150 million threshold should reassess whether they remain in scope.
For those that do, the timeline is FY 2028, with first reports due in 2029. Building CSRD-compliant reporting infrastructure — data collection systems, double materiality assessments, assurance readiness — takes time. The draft ESRS, while not final, is detailed enough to begin orienting data collection processes. The September 2026 final version is the starting gun for many companies — those who haven't begun any groundwork by then will find themselves moving quickly once FY 2027 reporting arrives.
Even companies outside CSRD's direct scope face indirect exposure. CSRD-reporting companies must disclose on their supply chains, and if your enterprise customers are among them, your sustainability data is already part of their compliance picture — whether or not you're required to report.
Our Regulatory Readiness Solutions: Whether you’re navigating CSRD in Europe, California’s climate disclosure laws, or emerging EPR requirements, the pressure to keep up with the ever-evolving sustainability landscape is mounting. If you’ve been asked to prepare for new sustainability regulations but aren't sure where to start, you’re not alone. We help companies cut through complexity with a clear roadmap that gets you from where you are to where you need to be. Reach out today.
