‍

CSRD Deadlines & Penalties: Updated Timelines, Wave Overview, and Consequences of Non-Compliance

‍

The Corporate Sustainability Reporting Directive (CSRD) is not a single deadline — it is a phased rollout affecting different companies at different times, with penalties enforced at national level by each EU member state. Understanding exactly when your company is in scope, what has changed following the 2025 EU Omnibus package, and what non-compliance actually costs is essential for planning an effective compliance strategy.

‍

CSRD reporting waves: who reports when

‍

The CSRD was originally structured in four waves. Following the EU Omnibus "Stop-the-Clock" Directive adopted on 17 April 2025, the timelines for Waves 2 and 3 have been significantly revised.

‍

Wave 1 — Already reporting (unchanged)Large public-interest entities previously subject to the NFRD (500+ employees, listed in the EU). First reports published in 2025, covering FY 2024. Wave 1 is not affected by the Stop-the-Clock directive. "Quick fix" amendments adopted in July 2025 provide limited transitional relief for certain disclosures in 2025 and 2026 reporting.

‍

Wave 2 — Delayed by two years (post-Omnibus)Originally: large EU companies (250+ employees, €50M+ turnover or €25M+ total assets), first report in 2026 for FY 2025.

‍
Post-Omnibus: first report now due in 2028, covering FY 2027. For most Wave 2 companies, 2026 is a preparation year — not a reporting year. Note: under the proposed Omnibus content revisions (not yet final as of mid-2026), thresholds may increase further to 1,000+ employees and €450M+ turnover, which would significantly reduce the number of companies in scope.

‍

Wave 3 — Likely removed from mandatory scopeOriginally: listed SMEs, first report in 2027 for FY 2026.
Under Omnibus direction, listed SMEs are expected to be removed from mandatory CSRD scope entirely. These companies are encouraged to apply voluntary standards (VSME) to meet customer and value chain data requests.

‍

Wave 4 — UnchangedNon-EU companies with €150M+ (proposed: €450M+) net turnover in the EU and at least one EU subsidiary or branch meeting size thresholds. First reports due in 2029, covering FY 2028.

Important: Even companies not yet formally in scope face indirect CSRD pressure. Wave 1 companies in scope now must collect Scope 3 data from their suppliers — meaning smaller, out-of-scope suppliers increasingly receive data requests that require carbon-level responses.

‍

What the CSRD Omnibus changes, and what it doesn't

‍

The Stop-the-Clock directive delays timelines for Waves 2 and 3. It does not:

• Change penalties for companies already in scope
• Remove the obligation to report Scope 1, 2, and 3 emissions for Wave 1 companies
• Eliminate the need for GHG Protocol-aligned carbon accounting
• Reduce the Scope 3 data demands placed on supply chains by reporting companies

A value chain cap is expected under the Omnibus content revisions: companies will be limited in the data they can request from SME suppliers with fewer than 1,000 employees. However, voluntary cooperation with data requests will still be commercially important for supplier relationships.

‍

CSRD penalties: what non-compliance costs

‍

CSRD penalties are determined by individual EU member states, not by the directive itself. The directive requires that penalties be effective, proportionate, and dissuasive — but the amounts vary significantly:

‍

1. ‍Germany: Up to €10M or 5% of total annual turnover or twice the profits/losses avoided
2. ‍France: Up to €5M for the company; up to €500,000 and up to 5 years imprisonment for company directors
3. ‍Netherlands: Up to €4M or 4% of turnover
4. ‍Sweden: Up to €2M or 3% of turnover
5. ‍Poland: Up to €1M fixed fine
6. ‍Italy: Up to €5M
7. ‍Czechia: Up to 3% of assets for incomplete reports; up to 6% for failure to report

‍

Beyond direct fines, non-compliance carries additional consequences:

‍

• Exclusion from EU public procurement: companies in material breach of CSRD can be excluded from public tenders across the EU
• Restricted access to EU financing: EIB and other EU funding mechanisms increasingly require CSRD compliance
• Investor exclusion: institutional investors with SFDR obligations cannot hold non-compliant companies in Article 8 or 9 funds
• Reputational damage: national regulators may publish information about non-compliant companies
• Criminal liability: in cases of deliberate fraud or concealment, company directors may face criminal proceedings

National regulators have indicated a proportionate approach for first-time filers, focusing on systemic non-compliance (absence of report, materially incomplete reports, missing assurance) rather than minor technical errors. This is not a formal grace period, however, and cannot be relied upon as a compliance strategy.

‍

What CSRD requires for carbon data specifically

‍

CSRD's ESRS E1 standard — the climate standard — is considered material for the vast majority of in-scope companies. It requires:

‍

• Scope 1, 2, and Scope 3 emissions across all 15 categories
• A climate transition plan aligned with the Paris Agreement
• Disclosure of physical and transition climate risks
• GHG reduction targets and year-on-year progress

Meeting these requirements at audit level demands verified CO₂e data at material and process level — the same data foundation that underlies PCF calculations and LCA methodology. Companies investing in systematic PCF workflows and a robust CO₂e database are simultaneously building their CSRD data infrastructure.

‍

Want to build audit-ready carbon data for CSRD compliance?

‍

Explore our CO₂e database and PCF calculation tools, or contact our team to access the sustamizer® and generate ESRS-aligned emissions data across your full value chain.