How CSRD phases sustainability reporting in waves, what the 2025 stop-the-clock and omnibus changes mean, and what to build before your first ESRS report.
The CSRD moved from directive to reporting reality
The Corporate Sustainability Reporting Directive — Directive (EU) 2022/2464 — entered into force in January 2023, with member states required to transpose it into national law by July 2024. It replaced the narrower Non-Financial Reporting Directive and tied the content of disclosure to a dedicated standards layer: the European Sustainability Reporting Standards, adopted as Commission Delegated Regulation (EU) 2023/2772. Two features matter for planning. Reporting phases in by company category, in waves. And reports are subject to assurance, initially at a limited level — so the supporting evidence has to exist in a form an assurance provider can examine, not just in a form a marketing team can publish.
Wave one is already reporting
The first wave covers companies that were already subject to the Non-Financial Reporting Directive — large public-interest entities above the old employee threshold. These companies published their first ESRS-based reports in 2025, covering financial year 2024. Nothing in the 2025 adjustments changed that: wave one is a finished fact, and its reports now define what regulators, investors, and assurance providers expect the format to look like.
Later waves were designed to follow in sequence
As adopted in 2022, the second wave would have brought in all other large companies — those meeting at least two of the three EU size criteria — with first reports covering financial year 2025. The third wave would have covered listed small and medium-sized companies, except micro-undertakings, from financial year 2026, with a temporary opt-out available. A fourth stage addressed non-EU companies with significant activity in the Union. The 2025 measures changed the timing of the middle waves, which is exactly why the sequence still needs to be tracked rather than assumed.
What stop-the-clock postponed — and what it did not
Directive (EU) 2025/794, adopted in April 2025 and known as the stop-the-clock directive, postponed the application of the CSRD reporting requirements for the second and third waves by two years. For a wave-two company, the first report now covers financial year 2027 and is published in 2028, rather than covering financial year 2025 as originally adopted. For listed SMEs in wave three, the first reporting year moves from financial year 2026 to financial year 2028. Member states were given until the end of 2025 to transpose the postponement, so the operative date for any specific company is the one in its national law, not the date in the directive’s recitals.
- Unchanged: wave one. Companies already reporting continue on their existing calendar.
- Postponed: wave two (other large companies) and wave three (listed SMEs) each move by two years.
- Unchanged: the reporting obligation itself. The directive adjusts dates, not the duty to report or the ESRS content.
- Unchanged: the need to prepare. Data collection, controls, and assurance readiness have lead times measured in reporting cycles, not weeks.
The omnibus package is still a proposal
In February 2025 the Commission presented an omnibus simplification package, including proposal COM(2025) 80, which would reshape the CSRD’s scope: a higher employee threshold aimed at concentrating obligations on the largest companies, a cap on the information that can be requested from smaller value-chain partners, removal of the mandate for sector-specific standards, and a commitment to revise the delegated ESRS with substantially fewer datapoints. As of mid-2026 these changes remain under negotiation between the Parliament and the Council. They are direction, not settled law.
Plan to the law in force, not to the headline
A company that stops preparing because a proposal might raise a threshold is taking a position on unfinished legislation. The defensible posture is the opposite: track the negotiations, but build the data and control foundation that any plausible final text still requires. If the final scope excludes the company, the foundation remains useful for lender, customer, and investor questionnaires that increasingly mirror ESRS datapoints.
What the omnibus does not propose to change
The proposals keep the double materiality principle at the centre of the assessment and keep limited assurance as the assurance level, stepping back from an earlier trajectory towards reasonable assurance. The ESRS remain the reporting content. In other words, the debate is about who reports and how much, not about whether the reporting model itself survives.
ESRS is the content layer: what a first report must contain
The first set of ESRS in Delegated Regulation (EU) 2023/2772 consists of two cross-cutting standards — ESRS 1 on general requirements and ESRS 2 on general disclosures — and ten topical standards covering environment (E1 to E5), social matters (S1 to S4), and governance (G1). ESRS 2 disclosures apply to every reporter. The topical standards apply through the materiality assessment: a company reports on the topics where its impacts, risks, and opportunities are material, and must be able to explain a conclusion that a topic is not material.
Double materiality drives the datapoint list
The assessment runs in two directions at once: impact materiality looks outward at how the company affects people and the environment, and financial materiality looks inward at how sustainability matters affect the company’s prospects. The output is not a narrative but a determinate list of topical standards and datapoints — which is why the assessment itself must be documented, evidenced, and repeatable, because the assurance provider will test how the list was produced.
The value chain is part of the perimeter
The ESRS extend into the upstream and downstream value chain, with phase-in reliefs for the first reporting years. In practice this means a first report already depends on information the company does not hold internally: supplier data, estimates where primary data is unavailable, and a documented rationale for both. Value-chain data is usually the longest lead-time item in a first reporting cycle and the first place an unprepared timeline breaks.
Build the reporting machine before the deadline
The difference between a calm first report and a distressed one is rarely knowledge of the standards; it is whether the underlying data, evidence, and ownership exist as daily controls. A first ESRS report behaves like a first audit: every figure needs a source, an owner, a method, and a review trail, and every estimate needs its rationale recorded while it is made. Governance has to be explicit about who owns the disclosure — typically a cross-functional structure in which sustainability leads the content, the controller function applies financial-reporting discipline to the data, legal reviews the statements, and the audit committee oversees the process for which management remains responsible.
- Map
- Assign
- Control
- Rehearse