CSRD Phase-In 2026: Which Companies Fall Into Wave 2 and What Changes Under Omnibus Simplification

If your company was told in 2023 that it was a Wave 2 CSRD reporter and would publish its first sustainability statement in 2026, two things have happened since. The date moved, and then the definition moved. There is a reasonable chance you are no longer Wave 2 at all.

This is the single most common confusion in European sustainability reporting right now, and it stems from the fact that two separate pieces of legislation did two different jobs. One changed when companies report. The other changed which companies report. Conflating them produces the wrong answer.

Here is what Wave 2 means now, when it actually starts, and what else the simplification package altered.

Two Instruments, Two Different Jobs

The Stop the Clock Directive, adopted in April 2025, was the fast tracked measure. It did one thing: it postponed reporting by two years for companies that had not already started. Wave 2, originally due to publish in 2026 on financial year 2025 data, moved to publishing in 2028 on financial year 2027 data. Wave 3 shifted by the same two years. Wave 1 was untouched.

The Omnibus I Directive, formally Directive (EU) 2026/470, is the substantive reform. It was published in the Official Journal on 26 February 2026 and entered into force in mid March. It did not change dates. It changed thresholds, and it changed them dramatically.

So the sequence matters. Stop the Clock bought time for a cohort defined under the old rules. Omnibus then redefined the cohort. A company that used its Stop the Clock reprieve to keep preparing may now discover it was never going to be required to report at all.

Who is Wave 2 Now

Under the original CSRD, Wave 2 captured large companies not previously covered by the Non-Financial Reporting Directive, using a test of any two of three criteria set at 250 employees, 50 million euro net turnover and 25 million euro balance sheet total. That is why the original scope estimate ran to roughly 50,000 companies across the EU.

Omnibus replaced that with a much narrower and, importantly, cumulative test. An EU company is in scope only if it has more than 1,000 employees and more than 450 million euro in net turnover. Both, not either. Non-EU groups come into scope at more than 450 million euro of turnover generated within the EU.

The effect is a reduction of roughly 80 to 85 per cent of the originally in scope population, depending on whose estimate you use. Listed SMEs, which formed the original Wave 3, have been removed from CSRD scope entirely, so that category has effectively ceased to exist. Certain smaller financial institutions and financial holding undertakings also fall out.

The revised scope thresholds apply to financial years beginning on or after 1 January 2027, which aligns them with the first Wave 2 reporting year.

For a company sitting near the boundary, the practical scoping exercise is now simpler than it used to be, because there is no two of three combination to work through. Count employees. Check net turnover. If either falls short, you are out of mandatory scope.

The Revised Timetable

There is one further wrinkle that catches Wave 1 companies. Those that now fall below the new thresholds receive a transition exemption for financial years 2025 and 2026, but this is a Member State option rather than an automatic entitlement. Whether it is available to you depends on what your national legislature does. A Wave 1 company that has dropped below 1,000 employees or 450 million euro should establish its domestic position before deciding to stop reporting, not assume the exemption applies.

What Else Omnibus Changed

Scope narrowing is the headline, but four other changes matter operationally.

Double materiality survived. This is the most important thing that did not change. Companies remain required to assess both how sustainability issues affect the business and how the business affects people and the environment. The assessment that consumes the most time and judgement in a CSRD programme was left substantially in place, so the reduction in datapoints does not translate into a proportionate reduction in effort.

The value chain cap, with a significant gap. Omnibus prevents in scope companies from requiring value chain partners with 1,000 employees or fewer to provide more sustainability information than the voluntary standard for smaller companies covers. It is genuine protection for SMEs against unbounded data requests from large customers.

It does not extend to gross Scope 1, Scope 2 and Scope 3 greenhouse gas emissions under ESRS E1-8. Emissions data is carved out. Any supplier reading the simplification coverage and expecting carbon questionnaires to ease off has drawn the wrong inference, and any in scope company assuming it cannot ask has misread its own position.

Assurance stopped where it was. The planned escalation from limited to reasonable assurance was dropped. Limited assurance remains the requirement, and the Commission is due to publish harmonised limited assurance standards by mid 2027.

The standards were rewritten. The Commission adopted the revised European Sustainability Reporting Standards on 3 July 2026. Mandatory datapoints fall by more than 60 per cent and total datapoints by more than 70 per cent, against an original framework of over 1,000 individual datapoints. The revised standards apply from financial year 2027, with voluntary early application permitted for financial year 2026. That timing is convenient for Wave 2, whose first mandatory year is the same one the new standards take effect.

There is also a three year grace period for value chain related disclosures, under which companies unable to obtain data must explain what is missing and how they intend to collect it. An undocumented gap remains the weakest thing in any sustainability statement.

The Transposition Gap Nobody Plans for

Here is the practical complication that catches companies out, and it is worth understanding properly because it can mean you are obliged to report under national law even though EU level reform says otherwise.

CSRD and Omnibus are directives. They bind Member States, not companies directly. Member States have until March 2027 to transpose the Omnibus changes into national law.

Until that happens, three different situations exist across the bloc. In countries that transposed CSRD and Stop the Clock, reporting continues under the original CSRD thresholds as amended by Stop the Clock and the Quick Fix measures, because that is what the national statute currently says. In countries that have not yet transposed CSRD at all, reporting continues under the older NFRD regime. And in countries that move early on Omnibus, the new thresholds apply sooner.

The consequence for a group operating in several Member States is that its obligations may differ by jurisdiction during 2026 and into 2027, not because the companies differ but because national implementation is at different stages. Anyone assuming the Omnibus thresholds are already effective everywhere is likely to be wrong somewhere.

What this Means in Practice

If you have fallen out of scope, verify it against your national law rather than the directive, and check whether the Wave 1 transition exemption is available domestically if that applies to you. Then make a deliberate decision rather than a default one. Customers, banks and investors still ask for sustainability data to meet their own obligations, and the value chain cap explicitly does not shield you on emissions. Companies that continue reporting after falling out of scope are making a commercial judgement, which is a legitimate thing to do, but it should be a judgement rather than inertia.

If you remain in scope as Wave 2, 2026 is a planning year rather than a reporting year, and the runway is genuinely useful. Your first report covers financial year 2027, which begins in roughly five months. Two pieces of work do not compress: the double materiality assessment, which was left largely intact by simplification, and value chain data collection, which typically takes twelve to eighteen months to establish. Both need to start well before the reporting year opens.

Build against the revised ESRS rather than the original standards, since they apply from financial year 2027, exactly matching your first mandatory year. Voluntary early application for financial year 2026 is available and worth considering as a dry run.

If you are near the boundary, model both sides. The cumulative test means a company at 1,100 employees and 430 million euro turnover is out, while one at 1,050 employees and 460 million euro is in. Small movements in either metric change the answer completely, which was much less true under the old two of three structure.

In all cases, watch national transposition in each country where you have reporting entities. That is where the obligation actually lives until March 2027, and it is the variable most likely to produce an unwelcome surprise.

The broader read on the Omnibus package is that it reduced the number of companies caught and the volume of what they disclose, without reducing the difficulty of the parts that were always hardest. Double materiality still drives scope. Value chain data still depends on suppliers who may not have it. Assurance still applies. For the companies that remain in Wave 2, simplification has bought time and trimmed the datapoint list. It has not made the work meaningfully easier.

Wave 2 Checklist

1. Apply the cumulative Omnibus test, more than 1,000 employees and more than 450 million euro net turnover, rather than the old two of three criteria.

2. For non-EU parents, test turnover generated within the EU against the 450 million euro threshold.

3. Confirm your position under national law in each Member State where you have reporting entities, since transposition runs to March 2027 and obligations differ during the gap.

4. If you are a Wave 1 company now below the thresholds, check whether your Member State has adopted the FY2025 and FY2026 transition exemption before stopping.

5. Plan Wave 2 reporting for financial year 2027, published 2028, not 2026.

6. Build against the revised ESRS adopted on 3 July 2026, which apply from FY2027 and can be applied voluntarily for FY2026.

7. Keep your double materiality assessment current, because simplification did not remove it and it still determines what you report.

8. Start value chain data collection now, allowing twelve to eighteen months before your first reporting year.

9. Do not rely on the value chain cap for emissions, since ESRS E1-8 GHG metrics are carved out of it.

10. Plan assurance around limited assurance only, and watch for the Commission's harmonised standards due by mid 2027.

Position as of July 2026. Omnibus I entered into force in March 2026 but national transposition runs to March 2027, so obligations vary by Member State in the interim. The revised ESRS were adopted on 3 July 2026 and remain subject to the scrutiny period. Confirm current requirements against the European Commission and your national regulator, and take professional advice for your circumstances.

Sources

Directive (EU), European Commission, EFRAG, Commonwealth Climate and Law Initiative, BDO, ClimatePartner, Cooley, Morrison Foerster, Coolset, Councilfire, Sprih, ReFlow

This article is intended for general professional information and does not constitute legal, financial, or investment advice.