CSRD 2027 Reporting Requirements: What the Second Wave Means for Your Company
CSRD 2027 reporting requirements now apply to a far smaller group of companies than the original directive. Omnibus I cuts the number of companies in mandatory CSRD scope by roughly 90%, effective from financial year 2027 for the companies that remain in scope. This guide covers who is still in scope, the exact 2027–2028 timeline, what changed inside the reporting standards, and why out-of-scope companies still face value-chain data requests.
Why the Second Wave Changes Your Planning
CSRD 2027 reporting requirements apply to a much smaller group of companies than the directive originally targeted. The final Omnibus I agreement cuts the number of companies in mandatory CSRD scope by roughly 90%, according to law firm A&O Shearman. One group of companies, the largest public-interest entities, already reports under the original 2024 timeline. A second group, everyone still in scope after the threshold changes, begins reporting on financial year 2027 data.
If your finance or sustainability team built a CSRD project plan around a 2025 or 2026 deadline, that plan needs a rewrite. Thresholds moved, deadlines moved, and the reporting standards themselves are still being rewritten ahead of the second wave's first report.
This article maps exactly who remains in scope, the dates that matter between now and your first report, what changed inside the requirements, and what to do if you fall outside mandatory scope but still supply a customer who reports.
What Is the CSRD Second Wave?
The CSRD second wave is every company that was not part of the original 2024 reporting cohort. Omnibus I collapsed the original four-wave structure into two tracks: one group already reporting, and one group, covering the former Waves 2, 3, and 4, that starts with financial year 2027 data and reports for the first time in 2028. For the full regulatory picture, see carbmee's overview of CSRD requirements.
How CSRD originally phased in across four waves
CSRD originally rolled out across four waves, sorted by company size, listing status, and location. Wave 1 covered large public-interest entities already subject to the Non-Financial Reporting Directive, mainly listed companies, banks, and insurers with more than 500 employees. These companies began reporting on financial year 2024 data and published first reports in early 2025.
Waves 2 through 4 covered progressively smaller and more distant companies: other large EU undertakings, listed small and medium-sized enterprises, and non-EU groups with EU operations.
How Omnibus I collapsed that into two tracks
Omnibus I, the amendment directive published in the EU's Official Journal on 26 February 2026, restructured that timeline entirely. PwC confirms the directive narrows CSRD scope and entered into force twenty days after publication. Companies already reporting continue under transitional rules. Everyone else who still meets the revised thresholds converges into a single second-wave track, reporting for the first time on financial year 2027 data.
How to get started: confirm which track applies to your company before you plan a reporting timeline. The rest of this article shows you how.
CSRD 2027 Reporting Requirements: Are You In Scope?
An EU company falls under the revised rules if it has more than 1,000 employees and more than €450 million in net annual turnover. Non-EU groups qualify if their EU turnover exceeds €450 million and an EU subsidiary or branch generates more than €200 million in EU revenue.
Revised thresholds for EU companies
The original CSRD used the standard EU "large undertaking" test: two of three criteria among more than 250 employees, more than €40 million turnover, and more than €20 million balance sheet total. Omnibus I raised the bar substantially, to more than 1,000 employees and more than €450 million in net turnover, with both conditions now required together. BDO confirms companies that were part of the original Wave 2 and clear this higher bar must report starting in 2028, covering financial year 2027 data.
Revised thresholds for non-EU companies
Non-EU groups now need EU turnover above €450 million, up from €150 million, plus an EU subsidiary or branch generating more than €200 million in EU revenue, up from €40 million. The European Financial Reporting Advisory Group estimates the revised test cuts the number of non-EU companies in CSRD scope from roughly 10,000 to about 1,200, a drop of 88%, as reported by ESG Today.
What happens if a Wave 1 company falls below the bar
Some companies already reporting under the original timeline no longer clear the revised thresholds. Their CSRD obligations do not end immediately. Gibson Dunn notes these companies can be exempted from reporting for financial years 2025 and 2026, but only where their EU member state has transposed that relief into national law.
How to get started: run your latest EU turnover and headcount figures against the revised thresholds before assuming last year's scope determination still holds.
The CSRD 2027 Timeline: Key Dates
The CSRD 2027 reporting requirements formally start on 1 January 2027, the first day of the financial year second-wave companies must report on. Companies can adopt the revised rules voluntarily for financial year 2026 data. Mandatory reporting begins in 2028, with first reports published in the first half of that year.
Optional early adoption and the mandatory start date
Second-wave companies may voluntarily apply the revised CSRD from financial year 2026 data, according to BDO. The mandatory reporting period begins 1 January 2027, meaning the first mandatory reports arrive in 2028.
First reports due in 2028
The first half of 2028 is when former Wave 2 companies publish their first CSRD reports under the revised rules, roughly two years later than the original 2026 target.
Transposition deadline and simplified ESRS adoption
EU member states have until 19 March 2027 to transpose the Omnibus I changes into national law, per Global Policy Watch. The European Commission committed to adopting the simplified ESRS by 18 September 2026, six months after Omnibus I entered into force, per Gibson Dunn.
How to get started: work backward from the H1 2028 reporting date, not the 1 January 2027 calendar start, when setting internal project milestones.
What's Actually Changing in the Requirements
The second wave is not simply the old rules on a new date. The underlying standards are being rewritten alongside the timeline.
Simplified ESRS: fewer, more material data points
EFRAG delivered its technical advice on the simplified European Sustainability Reporting Standards to the European Commission on 3 December 2025. The revision cuts mandatory data points by 61%, according to EFRAG itself. Removing all former voluntary disclosures brings the total cut to 71%, per Herbert Smith Freehills Kramer.
Double materiality: still mandatory, more principles-based
Double materiality assessment remains a legal requirement. The process itself is more principles-based, giving companies more discretion in how they document impact and financial materiality.
Assurance: limited only, standards due mid-2027
The planned progression from limited to reasonable assurance has been removed entirely. Limited assurance remains the requirement, and the Commission must adopt harmonized limited assurance standards by 1 July 2027.
Narrower value-chain data requests
Sector-specific ESRS have been eliminated. Companies with fewer than 1,000 employees are now protected from extensive data requests made by larger reporting companies further up their value chain.
A smaller, more material rulebook still assumes companies can trace every disclosed number back to its source. Fewer data points change what you report. They do not change whether the underlying data holds up to an auditor's questions.
If You're Out of Scope, You're Not Off the Hook
Falling outside the revised CSRD thresholds does not remove sustainability data requests from your desk.
Why in-scope customers still ask for Scope 3 and PCF data
Large manufacturers still in CSRD scope must disclose Scope 3 emissions across their value chains. Coolset notes that many mid-market companies falling out of mandatory scope still face CSRD-style data requests from customers, banks, and procurement teams. Losing the reporting mandate does not remove the request; it moves the request one level up the supply chain.
VSME as the new voluntary baseline
EFRAG's Voluntary SME Standard, VSME, is emerging as the reference format for companies responding to these requests without running a full CSRD program. It gives smaller suppliers a structured way to answer a customer's data request in a format buyers already recognize.
Responding to a data request without full CSRD obligations
Answering a single customer's Scope 3 or Product Carbon Footprint request with a spreadsheet works once. It does not scale across dozens of customer audits a year. This is the exact gap carbmee EIS™, carbmee's Environmental Intelligence platform, is built to close: supplier-level Product Carbon Footprint and Scope 3 data that holds up whether the request comes from a CSRD-reporting customer or a procurement questionnaire.
How to Prepare for CSRD 2027 Reporting Requirements
Companies preparing for the second wave should start with Scope 3 data, not disclosure templates. Templates will keep changing until the simplified ESRS is finalized. A defensible, supplier-level emissions baseline will not.
Build your Scope 3 baseline before the ESRS is final
Waiting for the 18 September 2026 delegated act before starting data work leaves little runway before FY2027 begins. Scope 3 typically accounts for the largest share of a manufacturer's footprint, and it takes the longest to build.
Get supplier-level PCF data flowing early
KWS, the agricultural seed group, calculated 30,000 supplier-level carbon footprints on carbmee EIS and published EY-audited Scope 3 emissions for the first time in autumn 2024, generating Product Carbon Footprints 94% faster than its previous manual process. The lesson for second-wave companies: audit-grade Scope 3 data is achievable well before a mandatory deadline forces the question.
What to do with work already done for the original 2025 deadline
Companies that already built data pipelines for the original Wave 2 timeline have not wasted that effort. The revised ESRS still requires emissions data, supplier engagement, and materiality documentation. That groundwork carries forward directly into a 2027 reporting cycle, even where the exact disclosure format changes. Many second-wave manufacturers are running this same data build for CBAM at the same time, so a single emissions data foundation can serve both.
Where to Go From Here
CSRD 2027 reporting requirements affect a smaller, more clearly defined group of companies than the original directive did. Confirm your scope against the revised thresholds, treat 18 September 2026 as a planning date rather than a deadline, and start your Scope 3 and Product Carbon Footprint data work now, regardless of your final reporting status.
Three problems keep surfacing: scope uncertainty, data readiness for FY2027, and value-chain requests from customers who do report. All three point to the same underlying need: an audit-grade data foundation that runs from BOM to boardroom.
carbmee EIS builds that foundation on a Transactional Data Foundation and Carbontology™, carbmee's classification engine for carbon data, so the same Scope 3 and PCF numbers hold up whether a regulator, an auditor, or a customer's procurement team asks the question. KWS built its audited Scope 3 reporting on carbmee EIS well ahead of its deadline, and Heraeus built a full CSRD-ready data pipeline in two months on the same platform.
