CSRD Timeline for Mid-Caps: What You Must Do by When in 2025–2026

The Corporate Sustainability Reporting Directive (Directive 2022/2464/EU) entered into force in January 2023, but the phased application schedule has created a great deal of confusion among European mid-cap sustainability teams. Which financial year does your company first report on? What exactly must be prepared before that first filing? And what happens if you missed the data collection window for your base year?

This article provides a practical breakdown of the four reporting waves, what each phase requires operationally, and where most mid-caps are currently finding themselves unprepared.

The Four-Wave Phased Rollout

CSRD applies in successive waves, each triggered by company size and public interest:

• Wave 1 — Large public-interest entities (PIEs) already subject to NFRD: First reporting on FY2024 data, published in 2025. Approximately 11,700 companies in the EU fall here: listed companies with more than 500 employees that were already preparing non-financial statements under the old NFRD regime (Directive 2014/95/EU).
• Wave 2 — Large non-PIE companies: First reporting on FY2025 data, published in 2026. Threshold: more than 250 employees AND either more than €50M turnover or more than €25M balance sheet total. This is where the majority of larger mid-caps find themselves.
• Wave 3 — Listed SMEs, small non-complex credit institutions, captive insurance undertakings: First reporting on FY2026 data. Listed SMEs may opt out until FY2028 by providing a brief exemption statement.
• Wave 4 — Non-EU parent companies with substantial EU presence: Third-country companies with EU-generated net turnover above €150M and at least one large EU subsidiary or listed EU branch report from FY2028.

The practical consequence: if your company crossed the Wave 2 size thresholds in FY2024, your first CSRD-compliant sustainability statement must accompany your FY2025 management report. That report is filed in the spring of 2026 — and the underlying data collection, double materiality assessment, and target-setting all need to be completed before December 31, 2025.

What "First Report" Actually Requires

Many teams think CSRD compliance means producing a longer version of the sustainability section in their annual report. That misreads the scope significantly. The CSRD sustainability statement is governed by the European Sustainability Reporting Standards (ESRS), and for climate specifically by ESRS E1 (Climate Change). A Wave 2 company's first report must include:

• A completed double materiality assessment documenting which ESRS topics are material (both from impact and financial perspectives) and the methodology used to reach those conclusions
• Full Scope 1, Scope 2 (both market-based and location-based), and — if climate is material — Scope 3 greenhouse gas inventory following GHG Protocol methodology, expressed in metric tonnes CO₂ equivalent
• Disclosure of at least one GHG reduction target with a base year and trajectory consistent with the Paris Agreement (ESRS E1-4)
• An energy consumption and energy mix disclosure covering renewable vs. non-renewable sources in MWh (ESRS E1-5)
• Physical and transition climate risk assessment connected to a scenario analysis (ESRS E1-2 and E1-3)
• iXBRL-tagged data points per the EFRAG taxonomy, embedded in the electronic version of the management report

The iXBRL tagging requirement alone is something many sustainability teams discover late. It means the sustainability statement cannot be a separately formatted PDF — it must be machine-readable and tagged against the ESRS XBRL taxonomy, which in turn requires either specialist software or external support.

The Base Year Problem for Mid-Caps

Consider Veltmann Industrials GmbH, a 680-employee automotive parts manufacturer in Stuttgart. They crossed the Wave 2 size thresholds in FY2022 and fall squarely in the first Wave 2 cohort (first CSRD report on FY2025 data). In early 2024, their sustainability manager began assessing readiness. The result was uncomfortable: while they had a rough Scope 1 figure from their natural gas invoices (approximately 4,200 tCO₂e annually) and a location-based Scope 2 estimate from their electricity supplier, their Scope 3 inventory was essentially blank.

The GHG Protocol requires that a base year be selected and maintained consistently. ESRS E1-4 requires that the GHG reduction target reference a base year, and EFRAG's implementation guidance recommends selecting a base year no later than 2021 or the first year data is available. For companies like Veltmann, this means retroactively reconstructing Scope 3 Category 1 (purchased goods and services) and Category 4 (upstream transportation) figures from procurement records going back three or four years — a task that is laborious when done manually from invoice PDFs but tractable when procurement data is ingested and matched against emission factors programmatically.

The Assurance Requirement and Its Staging

CSRD introduces mandatory external assurance of the sustainability statement — a departure from the voluntary verification that characterized most prior sustainability reports. The assurance requirement is phased:

• Phase 1 (Wave 1 and Wave 2 first reports): Limited assurance only. The assurer concludes that nothing has come to their attention to indicate the sustainability statement is not prepared in accordance with ESRS. This is a lower bar than reasonable assurance but still requires documented evidence.
• Phase 2 (later years, subject to European Commission review): The Commission may upgrade requirements to reasonable assurance, which involves testing of evidence and greater scrutiny of data sources, calculation methodologies, and emission factor choices.

Even limited assurance changes the operational requirements substantially. Auditors performing limited assurance will ask for: the emission factor databases used (DEFRA, ecoinvent, GaBi, or supplier-specific PCFs), evidence that activity data was correctly classified by GHG Protocol category, documentation of Scope 3 boundary decisions, and justification for any omitted categories. Companies that have been producing voluntary sustainability reports without this audit trail will need to rebuild their data lineage from scratch.

A Word on What "Assurance Readiness" Is Not

We're not saying that existing sustainability reports are worthless for CSRD — prior GHG Protocol-aligned inventories are a solid starting point and can provide the base year data that ESRS E1-4 requires. What changes is the evidentiary standard: a number sitting in a spreadsheet without source documentation, or a Scope 3 figure estimated with an undocumented spend-based method, will not satisfy a limited assurance engagement. The data lineage — from raw source record through emission factor application to final tCO₂e figure — must be traceable and consistently documented.

Timeline Risks That Teams Consistently Underestimate

Based on working with sustainability teams across European manufacturing and logistics companies, three timeline risks come up repeatedly:

1. Double materiality assessment takes longer than budgeted. EFRAG's implementation guidance on double materiality assessment describes a stakeholder consultation process, analysis of both impact and financial materiality perspectives, and documentation of the scoring rationale. Teams frequently allocate four to six weeks and discover it requires four to six months when done properly — especially when climate risk scenarios need to be aligned with EU Taxonomy environmental objectives.
2. Scope 3 Category 1 data collection is the longest lead-time item. Contacting significant suppliers to request product carbon footprint data typically takes three to five months when done through manual questionnaires. Starting this outreach in Q3 of the reporting year leaves insufficient time to reconcile discrepancies before year-end data lock.
3. The iXBRL tagging step requires specialist knowledge. Most sustainability teams have no in-house XBRL expertise. This either requires bringing in an external service provider (six- to eight-week lead times are typical in peak season) or using software that automates tagging against the ESRS taxonomy.

Practical Preparation Sequence for Wave 2 Companies

For a Wave 2 company with FY2025 as their first reporting year, the minimum preparation sequence looks like this:

• Q1–Q2 2025: Complete double materiality assessment; identify which ESRS topics require full disclosure vs. limited disclosure; engage auditor early to align on scope and evidence expectations
• Q1–Q3 2025: Establish base year emissions inventory (Scope 1, 2, and material Scope 3 categories); if base year is 2021 or 2022, reconstruct historical data from procurement and energy records
• Q2–Q3 2025: Begin supplier data collection for Category 1 and Category 4; initiate internal survey for Category 6 (business travel) and Category 7 (employee commuting) if material
• Q4 2025: Close FY2025 data collection; finalize emission factor choices and document methodology; prepare ESRS E1 disclosure draft
• Q1 2026: Limited assurance engagement; iXBRL tagging; integration with management report

The companies that will struggle most in 2026 are those that treat CSRD preparation as a documentation exercise rather than a data architecture problem. The sustainability statement is only as defensible as the underlying activity data, and building that data infrastructure retroactively — after the filing deadline — is not an option the Directive provides.