CSRD Reporting Timeline After the Omnibus: Who Reports and When

The CSRD calendar has changed twice: once by the "stop-the-clock" delay of April 2025, and again by the Omnibus I scope cut, Directive (EU) 2026/470, which entered into force on 18 March 2026. This article sets out the dates as they stand on 8 October 2026. It replaces an earlier version that placed stop-the-clock in 2024, said the Omnibus delayed listed SMEs by two years, used the old scope thresholds and said the supplier cap was already in effect. None of that is right.

What Changed, in Order

The CSRD entered into force in January 2023 with four waves of reporting. The first wave started with financial year 2024. In April 2025 the stop-the-clock delay pushed the second and third waves back by two years. In February 2026 the Official Journal published Omnibus I, which then cut the scope itself. Member States must transpose its CSRD changes by 19 March 2027, so national rules, especially for the transition options below, may still differ.

Wave 1: Companies Already Reporting

Companies that were already covered by the Non-Financial Reporting Directive began reporting for financial year 2024, with reports in 2025. They were not affected by the delay. The Omnibus then raised the scope test, and some of these companies now fall below it. According to the law-firm summaries I read, Member States may exempt such companies from reporting for financial years 2025 and 2026. This is an option, not an automatic rule, so whether a given company still reports for FY2025 depends on its country's transposition. From FY2027 the new scope applies to everyone.

Wave 2: Other Large Companies

Large companies that were not under the earlier directive were due to report for FY2025. The stop-the-clock delay moved their first report to FY2027, published in 2028. The Omnibus then narrowed who counts as large: EU companies need more than 1,000 employees and more than €450 million net turnover. The earlier version of this article gave the old test of 250 employees, €50 million turnover and €25 million balance sheet. That is no longer the test. Many companies that were expecting to be in wave 2 are now out of scope.

Listed SMEs: Removed, Not Delayed

Listed small and medium-sized enterprises were the original third wave, due for FY2026 before the delay and FY2028 after it. The Omnibus then removed listed SMEs from mandatory scope, and removed the Commission's power to adopt a separate SME standard. The earlier version of this article said the Omnibus delayed them by two years and created an "SME opt-out". The first part is the stop-the-clock delay, which the Omnibus overtook. The second I could not find in any source. One adviser page I read still shows FY2028 for this wave, which I think is out of date, so check the status for any listed SME you work with.

Non-EU Groups

A non-EU group is in scope if it has more than €450 million net turnover in the EU for two consecutive years and an EU subsidiary or branch with more than €200 million turnover. The earlier version gave €150 million, which is the old figure. For the first reporting year, one adviser source gives FY2028, with reports in 2029. A law-firm summary I read does not state a year, so treat FY2028 as likely and not confirmed. The earlier version also said these groups report under "ESRS G1", which is a governance standard and not a third-country standard.

Which ESRS Applies

The revised ESRS were adopted as Delegated Regulation (EU) 2026/1563 and published on 21 September 2026. According to a law-firm summary, they enter into force on 10 November 2026 and are mandatory for financial years starting on or after 1 January 2027. For FY2026, companies can choose the existing ESRS, the existing ESRS with some reliefs or the revised ESRS in full. This means that wave 2 companies will report on the revised standard from their first report.

What This Means for Supplier Data Requests

The earlier version said that wave 1 companies had issued supplier requests since late 2024, that wave 2 would begin systematic collection in 2026 to 2027, and that collection starts 12 to 18 months before each report. I could not source any of these. Here is the reasoning I can support. A company reporting for FY2027 needs data for the whole of 2027, so its requests should arrive during or soon after that year. Fewer companies are now in scope, so the number of direct requests should fall. Companies that dropped out may still send questionnaires under their own supplier codes, and banks and other laws are unaffected. This is my inference and not a sourced forecast.

The cap on what in-scope companies can require from smaller suppliers is a separate rule. The earlier version said it was already in effect. The standard entered into force on 24 September 2026, but the cap applies to financial years starting on or after 1 January 2027. Until then, a request is not covered by it. See the companion article on scope and the value chain cap.

Planning steps for a supplier

• Ask each EU customer whether it is in CSRD scope, and under which wave.
• Ask whether any wave 1 customer has used a national exemption for FY2025 or FY2026.
• Keep a 2027 data set in a standard form from January 2027, since that is the first year for wave 2.
• Check whether your customer's questions fall inside the Annex II list once the cap applies.
• Do not assume that a customer who dropped out of scope has stopped asking.

Frequently Asked Questions

References

Directive (EU) 2026/470 (Omnibus I), Official Journal, 26 February 2026. CMS, Final adoption of Omnibus I Directive simplifying CSRD and CSDDD. Dcycle, CSRD reporting timeline after Omnibus I (an adviser page, which I used only for the wave dates and FY2028 for non-EU groups; its non-EU turnover figure of €150 million conflicts with the law-firm summary and I did not use it). Garrigues and Linklaters summaries of Delegated Regulations (EU) 2026/1560 and 2026/1563. These are summaries and not the legal texts, so confirm dates and national options on EUR-Lex and in your Member State's law.