Socious Report
Socious Work
Socious VerifyThe CSRD Legislative Timeline: How the Directive Was Built, Paused, and Cut Back
Most CSRD timeline pages answer a single question: which companies report, and when. That is a useful table, and we maintain one — the CSRD timeline and 2026 deadlines page exists for exactly that.
This page answers a different question. Not when your company reports, but what happened to the law itself: when it was adopted, when it entered into force, when the standards arrived, when it was paused, and when it was cut back. Four EU legislative instruments in four years, each of which changed the answer to the first question.
If you are trying to understand why the CSRD advice you received in 2023 no longer matches the CSRD advice you are receiving now, the arc below is the explanation.
November 2022 — adoption
The European Parliament adopted the Corporate Sustainability Reporting Directive on 10 November 2022, by 525 votes to 60. The Council of the EU approved it on 28 November 2022. The directive entered into force on 5 January 2023.
What the CSRD did structurally was replace the Non-Financial Reporting Directive, and it changed three things at once. It widened scope from roughly 11,700 companies under the NFRD to a far larger population. It made assurance mandatory rather than optional. And it replaced “report what you consider material, in a format of your choosing” with a single mandatory European standard set.
That third change is the one that mattered most operationally, and it had a gap in it: at adoption, the standards did not yet exist.
July 2023 — the ESRS arrive
The European Commission adopted the European Sustainability Reporting Standards as a delegated act on 31 July 2023.
This is the point at which CSRD stopped being a policy direction and became a data problem. The first ESRS set brought more than a thousand individual data points across environmental, social, and governance topics, drawn from systems that in most companies had never been asked to produce audit-quality output. Our ESRS versus ISSB and GRI comparison covers how that standard set relates to the other frameworks a global group is likely reporting into.
The obligation was legislated first and its specification arrived eight months later. Companies that began building against the directive’s text rather than waiting for the standards spent those eight months guessing. The EU ran the same order again in 2026 with the standards for non-EU parents, described below.
July 2024 — the transposition deadline that mostly was not met
A directive does not apply directly. Each member state has to write it into national law, and the CSRD set that deadline at 6 July 2024.
It was widely missed. The European Commission opened infringement proceedings, sending formal notices to 17 member states for failing to fully transpose the directive on time.
For a group operating across several EU countries, this produced a genuinely awkward year: the obligation was live at EU level, the national implementing rules were absent or partial in a large share of the jurisdictions where the group had entities, and the details member states control — filing formats, assurance provider eligibility, penalties — were unsettled. National variation in transposition, sometimes stricter than the directive itself, remains a live issue for anyone reporting in more than one member state.
April 2025 — “stop the clock”
On 16 April 2025 the EU published Directive (EU) 2025/794 in the Official Journal, and it entered into force the following day, 17 April 2025. Member states had until 31 December 2025 to transpose it.
Its content was narrow and consequential: a two-year postponement for the second and third waves of CSRD reporters. Companies that were due to report in 2026 on financial years starting from 1 January 2025, and those due to report in 2027 on financial years starting from 1 January 2026, all moved back by two years.
Wave one — the large public-interest entities already inside the NFRD, reporting on financial year 2024 — was not delayed and reported as planned.
Teams in waves two and three had, by that point, spent eighteen months building toward a deadline that then moved. Nothing about their underlying data requirement changed. Only the date did.
March 2026 — the Omnibus contraction
The substantive rewrite came next. Directive (EU) 2026/470, the first Omnibus directive, was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026. We covered its provisions in detail in our EU Omnibus and CSRD 2026 analysis.
The change that matters for the timeline is the scope gate. To fall inside the CSRD, a company must now exceed both 1,000 employees and €450 million in turnover. Under the original 2022 design the thresholds were far lower, and the population was on the order of 49,000 companies. Roughly 80% of them are now out of scope. Estimates of who remains cluster around 8,000 to 10,000 companies, and that remaining figure is a derived estimate rather than an official count.
Application moves to financial year 2027, with first reports in 2028. Member states have until 19 March 2027 to transpose the CSRD-related provisions.
So a company that was in scope under the 2022 directive, delayed under the 2025 directive, and removed under the 2026 directive has experienced three different legal answers to the same question in forty months, without changing its own behaviour at all.
The unfinished limb — non-EU parent groups
One part of the arc is still open, and it is the part Japanese and other non-EU headquartered groups should watch.
The CSRD reaches beyond the EU. A third-country group can be pulled in through its European presence, and the current shape of that test — as read by the major law-firm trackers following the Omnibus — turns on an EU subsidiary or branch above €200 million in net turnover combined with EU-level net turnover above €450 million for the ultimate parent across two consecutive financial years. Consolidated reporting at the ultimate parent level is set to apply to financial years starting on or after 1 January 2028.
The standards that non-EU parents will actually report against were due from the Commission by 30 June 2026. This is the least settled corner of the entire framework, and it is the corner most likely to move again. Treat any specific third-country threshold you read today, including the ones above, as current understanding rather than settled law, and confirm against the delegated act when it lands.
What the arc actually teaches
Read end to end, the pattern is not that Europe changed its mind about sustainability reporting. Both the pause and the contraction left the substance intact: the ESRS still ask what they asked, assurance is still required, double materiality still governs. What moved was who has to comply and by when.
Teams that built toward a filing — a deadline, a format, a template — lost work at each of the four steps above. Teams that built toward the underlying dataset lost almost none, because the operational facts a company reports on do not change when a directive is amended. Emissions, energy purchased, workforce composition, and supplier payments are the same numbers whether the recipient is the CSRD, the SSBJ in Japan, or the ISSB standards being adopted across Asia-Pacific.
For a Japanese group this is not hypothetical. A company with EU operations may have watched its CSRD obligation appear, slip, and then possibly vanish over four years, while its SSBJ obligation at home moved steadily toward the fiscal year ending March 2027 for the largest Prime-listed companies. One dataset had to serve both regardless of what Brussels decided in any given year.
Where to start
If you are unsure which side of the current CSRD gate your group sits on after the Omnibus, or what you would be unable to produce if the scope test moved again, the useful first step is a diagnostic rather than a project plan.
We built a free CSRD readiness check for that. It takes a few minutes, it does not require your data, and it tells you which parts of the obligation you could satisfy today and which you could not.
Sources: European Parliament and Council adoption records and the European Commission’s corporate sustainability reporting pages (2022 adoption, entry into force, ESRS delegated act); European Commission infringement notices to 17 member states (July 2024 transposition); Official Journal of the European Union, Directive (EU) 2025/794 (“stop the clock”); Official Journal of the European Union, Directive (EU) 2026/470 (Omnibus I), with scope and population figures as summarised by Consilium, PwC and ESG Today; law-firm Omnibus trackers including Latham & Watkins, Norton Rose Fulbright, Covington and Ropes & Gray (third-country provisions). Data-point count per EFRAG. Remaining in-scope company count is an estimate.