The Corporate Sustainability Reporting Directive (CSRD), formally Directive (EU) 2022/2464, is the EU law that turned sustainability disclosure from a light-touch narrative exercise into audited, standardised, machine-readable reporting on par with financial statements. It replaced the older Non-Financial Reporting Directive (NFRD) and, at its original scope, was expected to pull roughly 50,000 companies into mandatory reporting, before a wave of 2025–2026 simplification sharply narrowed who actually has to comply.
What CSRD requires
CSRD does not invent new metrics in the directive itself; it sets the architecture and points to a detailed rulebook. Four pillars define the obligation.
Double materiality. This is the conceptual core. Companies must assess and report sustainability matters through two lenses: how the business affects people and the environment (impact materiality), and how sustainability matters affect the company's financial position, performance and prospects (financial materiality). A topic is reportable if it is material under either lens. The double materiality assessment is what determines which disclosures a given company must make.
ESRS. The actual disclosure content comes from the European Sustainability Reporting Standards (ESRS), adopted as delegated acts and developed by EFRAG. The first set of twelve cross-cutting and topical standards covers environment (including climate), social and governance matters. In their original form they carried well over a thousand data points, a volume that became one of the central complaints driving the later simplification effort.
Assurance. Sustainability information filed under CSRD must be independently assured. Reporting begins under a limited assurance standard (broadly the level defined in ISAE 3000), with the original framework envisaging a possible later move to reasonable assurance. This is a significant change from the NFRD era, where non-financial statements were largely unaudited.
Digital tagging. Reports must be prepared in a structured, machine-readable format. The sustainability statement is tagged using inline XBRL (iXBRL) against the ESRS XBRL taxonomy and filed within the European Single Electronic Format (ESEF) package. Tagging applies from the first report. There is no separate grace period for the digital layer.
The phased scope waves
CSRD was always designed to phase in by company size and type, so that the largest, best-resourced companies started first. Under the original framework there were four waves, each tied to a first financial year and a first report published the following year.
- Wave 1: Large public-interest entities already covered by the NFRD (listed companies, banks and insurers with more than 500 employees). First financial year 2024, first reports in 2025.
- Wave 2: Other "large undertakings" not previously caught by the NFRD. First financial year 2025, first reports in 2026.
- Wave 3: Listed small and medium-sized enterprises (SMEs), plus certain small and non-complex credit institutions and captive insurers. First financial year 2026, first reports in 2027 (with an opt-out available to 2028).
- Wave 4: Non-EU parent companies generating substantial EU turnover (above €150 million in the EU) through EU subsidiaries or branches. First financial year 2028, first reports in 2029.
That original schedule is the baseline you will still see referenced in older guidance, but two rounds of amendment have since changed both the timing and, for many companies, whether they are in scope at all.
The thresholds
Scope hinges on the definition of a "large undertaking" in the EU Accounting Directive. A company is large if it exceeds at least two of the following three criteria (thresholds raised for financial years beginning on or after 1 January 2024):
- Balance sheet total: more than €25 million (up from €20 million).
- Net turnover: more than €50 million (up from €40 million).
- Employees: more than 250 on average during the financial year.
A company generally has to cross (or fall below) these criteria for two consecutive years before its status changes. Wave 1 additionally carried the NFRD-era "more than 500 employees" public-interest-entity test. These are the numbers that mattered under the original CSRD. Crucially, they are not the numbers that now determine who reports.
The Omnibus changes and what is still uncertain
Between early 2025 and early 2026 the EU substantially rewrote CSRD's reach through its "simplification" agenda, and this is the part that has been genuinely in flux.
First came the "stop-the-clock" directive (Directive (EU) 2025/794, adopted April 2025), which postponed Waves 2 and 3 by two years to give legislators time to agree deeper changes. Then came Omnibus I: proposed by the Commission in February 2025, approved by the European Parliament in December 2025 and by the Council on 24 February 2026, published in the Official Journal on 26 February 2026 and entering into force on 18 March 2026.
The headline effects of Omnibus I:
- A much higher entry threshold. The revised CSRD applies only to large undertakings with more than 1,000 employees and net turnover above €450 million. This removes a very large share of the companies the original directive would have captured.
- Listed SMEs exit entirely. The Wave 3 population (listed SMEs and the smaller financial entities) is out of mandatory scope.
- A higher bar for non-EU groups. The threshold applied to an in-scope non-EU company's EU subsidiary or branch rises to €200 million (from €40 million).
- A lighter rulebook. EFRAG is revising the ESRS with the aim of cutting mandatory data points by roughly 60% (from around 1,100 to a few hundred) and removing voluntary disclosures, with a final public consultation in the first half of 2026 and revised standards expected to take effect for financial year 2027.
What remains uncertain: the revised ESRS are not yet finalised as this is written, so the precise disclosure set is still moving. National transposition of Omnibus I into each member state's law is ongoing and can vary in detail and timing. And the political direction could shift again: CSRD scope has been amended twice in roughly a year, so today's thresholds should be treated as current, not permanent.
The reporting waves at a glance
| Wave | Who (original CSRD) | First financial year reported | Omnibus / stop-the-clock effect |
|---|---|---|---|
| Wave 1 | Large public-interest entities already under NFRD (>500 employees) | FY2024 (reports from 2025) | Continue reporting FY2025 and FY2026; only those still meeting the revised >1,000-employee threshold remain in scope going forward |
| Wave 2 | Other large undertakings (not previously under NFRD) | FY2025 (reports in 2026) | Deferred by stop-the-clock; those meeting the revised thresholds now first report in 2028 for FY2027 |
| Wave 3 | Listed SMEs; small non-complex credit institutions; captive insurers | FY2026 (reports in 2027) | Removed from mandatory scope by Omnibus I |
| Wave 4 | Non-EU parent groups with substantial EU turnover | FY2028 (reports in 2029) | Those meeting the revised thresholds first report in 2029 for FY2028; subsidiary/branch threshold raised to €200m |
How to prepare
Even with the narrowed scope, the answer to "who must report CSRD" is now a moving target, and preparation still pays off for companies near or above the line.
- Re-test your status against the revised thresholds. Do not rely on a 2023 or 2024 scoping memo. Confirm whether you exceed both the >1,000-employee and >€450 million turnover tests, and remember the two-consecutive-years rule.
- Confirm your wave and first reporting year. Wave 1 companies keep reporting through FY2026; former Wave 2 companies that stay in scope look to FY2027 data reported in 2028. Map the exact dates for each in-scope entity in the group.
- Run (or refresh) the double materiality assessment. This drives everything downstream and is unlikely to disappear from any future version of the standards.
- Build the data pipeline, including tagging. iXBRL/ESEF tagging applies from the first report, so treat sustainability data collection with the same rigour and controls as financial data.
- Line up assurance early. Limited assurance means an auditor needs auditable evidence and a defensible methodology. Engage them before, not after, the reporting period closes.
- Track the ESRS revision. The disclosure set is being cut and reshaped; building to the current draft rather than the superseded original avoids wasted effort.