How to comply with the CSRD in 2026: execution guide and timeline

After Directive (EU) 2026/470, known as Omnibus I, the CSRD only applies to EU companies with more than 1,000 employees on average and more than 450 million euros in net turnover. Member States have until 19 March 2027 to transpose it, and the first report under the revised ESRS covers financial year 2027, published in 2028.

This guide does not explain what the CSRD is. It explains how the project runs: the real timeline, the eight phases, the minimum team and which parts can be automated. If you need the conceptual framework first, start with the guide to the corporate sustainability reporting directive and the breakdown of the differences between the CSRD and the ESRS.

Who is in scope of the CSRD after the Omnibus I Directive?

Directive (EU) 2026/470 was published in the Official Journal of the European Union on 26 February 2026 and entered into force on 18 March 2026. It amends both the CSRD and the due diligence directive, and it sharply reduces the number of companies that have to report. The test is no longer two out of three accounting thresholds: a company has to exceed both criteria at once, headcount and turnover.

The directive also sets the transposition deadline at 19 March 2027 and splits off the due diligence timetable, transposed by 26 July 2028 and applied from 26 July 2029. The political path of the negotiation is unpacked in the analysis of the Omnibus package.

CSRD timeline up to the FY2027 report

These are the dates that shape any reporting project as of August 2026.

The operational reading is uncomfortable but simple: the year you have to report starts in January 2027. That year of data has to be captured as it happens, not rebuilt afterwards. A project that starts in 2027 is already late for its own data.

What changed in the revised ESRS adopted in July 2026?

The Commission adopted the revised ESRS on 3 July 2026. Mandatory datapoints fall by more than 60 % and total datapoints by more than 70 % against the first version of the standards. The Commission estimates a reduction of around 30 % in reporting cost per company. What matters for the project is what survives and what does not.

• Double materiality stays. Both impact and financial materiality still have to be assessed, so the upfront analysis is not saved.
• A large share of the mandatory narrative detail disappears and the volume of tables shrinks.
• Reporting generic sector level opportunities is no longer allowed. Only opportunities the company is actively pursuing or has built into its strategy can be disclosed.
• Companies reporting for the first time in FY2027 may omit anticipated financial effects for the first two years and the quantification of those effects for four years.
• The assurance level stays at limited assurance. There is no move to reasonable assurance.

If your team already worked with the earlier version, the guide to what the ESRS are and the one on how to implement the ESRS in your company are still the starting point for the content map.

What applies in Spain while the CSRD is not transposed?

Spain has not yet transposed the CSRD. The draft Law on Corporate Sustainability Information, approved by the Council of Ministers on 29 October 2024, is still going through parliament. That does not leave Spanish companies without obligations.

• Law 11/2018 and the non financial statement remain the applicable rules in Spain.
• The joint statement from the CNMV and the ICAC dated 19 November 2025 confirms that wave 1 entities must publish sustainability information for FY2025 and recommends applying the European standards under the EU transitional framework. For everyone else it suggests voluntarily considering the ESRS or the VSME standard.
• Independent assurance still applies, referencing the ICAC technical standards and the international standard ISSA 5000.
• Royal Decree 214/2025 requires the same companies that file a non financial statement to calculate their carbon footprint and to publish a reduction plan. Scopes 1 and 2 are mandatory, scope 3 voluntary, and the reduction plan needs a horizon of at least five years from financial year 2025. Registration in the MITECO registry remains voluntary for private companies.

The practical conclusion is that the European rollback does not remove the duty to measure in Spain. The detail sits in the post on carbon footprint registry obligations under Royal Decree 214/2025.

The eight phases of a CSRD reporting project

A full reporting cycle runs in eight phases. The first three happen before the reporting year starts, because they determine which data has to be captured during that year.

1. Boundary and consolidation. Decide which entities are included and under which consolidation criterion, aligned with the statutory accounts. This is also where the organisational boundary approach for emissions is set, and it has to be consistent with the accounting perimeter.
2. Double materiality assessment. Identify impacts, risks and opportunities, score them, set materiality thresholds, document the process and validate it with the board. The output is a closed list of topics and datapoints to report.
3. Gap analysis against the revised ESRS. Test every material datapoint against what the company already measures. You end up with three buckets: data available and reliable, data available but untraceable, data missing.
4. Data governance. Assign an owner to each indicator, define the source, the refresh frequency and the validation control. Without this phase the report turns into a heroic email hunt in March.
5. Collection and consolidation. Connect the real sources: energy and fuel invoices, ERP, procurement systems, supplier questionnaires, logistics data. This phase runs all year and it is where software changes the cost of the project.
6. Calculation and quality control. Apply emission factors, compute indicators, review variances against the prior year and document assumptions and estimates. Anything estimated has to be justified in writing, because the assurance provider will look at it.
7. Drafting, digital tagging and approval. Write the statement, tag it in the required electronic format, integrate it into the management report and take it to board approval.
8. External assurance. An independent provider issues a limited assurance report. Assurance is not a final formality: the provider asks for evidence throughout, and the earlier it joins, the fewer surprises appear.

Who runs each phase and when?

The minimum viable team for a first edition is usually one project owner with heavy dedication, one contact per function with partial dedication, an executive sponsor able to unblock data, and external support for materiality and assurance. When the project hangs on one person without internal sponsorship, it stalls in phase five.

Which parts of the report can be automated and which cannot?

The profitable automation sits in collection and calculation, not in judgement. This is the realistic split.

If scope 3 is the part that worries you most, the practical reference is the breakdown of the 15 scope 3 categories of the GHG Protocol, because it determines what you ask suppliers for and in which order.

What if your company drops out of scope but customers keep asking for data?

Omnibus I introduces a value chain cap. A company in scope of the CSRD cannot require companies with fewer than 1,000 employees in its value chain to provide more information than the voluntary SME standard contains, and that limit cannot be overridden by contract. Due diligence works in a similar way, with the criterion that information is only requested when it cannot reasonably be obtained by other means.

The voluntary standard has two modules, a basic one and a more comprehensive one, and the Commission adopted its delegated act on 3 July 2026, the same day as the revised ESRS. For an SME supplier, getting ready with that standard is today the most efficient answer to large customer questionnaires. Both angles are covered in the posts on simplified standards for SMEs and on how the CSRD reaches SMEs in the supply chain.

Mistakes that derail a CSRD project

• Starting with the writing. Drafting chapters before materiality is closed means rewriting everything.
• Treating materiality as a one afternoon workshop. It sets the scope of the whole project and it is the first thing the assurance provider reviews.
• Collecting data in March. A year of consumption, kilometres and waste cannot be accurately rebuilt twelve months later.
• Different boundaries in finance and sustainability. If the sustainability statement does not consolidate like the accounts, the mismatch shows up in assurance.
• Not documenting estimates. Estimating is acceptable. Failing to explain how you estimated is not.
• Waiting for the Spanish transposition. The data capture calendar does not depend on when the law appears, only on when the reporting year begins.

Frequently asked questions about CSRD compliance in 2026

Is the CSRD still in force after the Omnibus package?

Yes. Directive (EU) 2026/470 does not repeal the CSRD, it amends it. It cuts the number of companies in scope, simplifies the standards and pushes back the timeline, but the reporting obligation still exists for companies above the new thresholds.

Which companies drop out of scope?

Those that do not exceed both 1,000 average employees and 450 million euros in net turnover, from FY2027 onwards. Watch out for a common misreading: wave 1 companies that fall below the new thresholds still have to report FY2025 and FY2026 unless their Member State exempts them when transposing the directive.

What assurance level does the sustainability statement need?

Limited assurance. The directive keeps that level and asks the Commission to adopt assurance standards before 1 July 2027. In Spain independent assurance is already required under the ICAC technical standards.

Can a MITECO carbon footprint calculation be used for the CSRD?

It works as the basis for scope 1 and 2 data, but it does not cover the statement. The CSRD requires material scope 3, targets, policies, actions and a set of social and governance indicators that the MITECO registry does not contemplate. The efficient route is to calculate once with full traceability and reuse the figures in both places.

What happens if Spain misses the transposition deadline?

Existing national obligations remain. Law 11/2018 still requires the non financial statement and Royal Decree 214/2025 still requires a carbon footprint calculation and a reduction plan. A late transposition also does not change the financial year from which the European standards have to be applied.

When should the project start if the first report covers 2027?

Before financial year 2027 begins. Boundary, materiality and gap analysis need to be closed so that data capture starts with the year, which is what allows the statement to be drafted in 2028 without reconstructing information.

Once a project reaches collection and consolidation, the difference between an orderly cycle and a chaotic one almost always comes down to the data: where it comes from, who validates it and whether it is traceable. You can see how that part is solved in Manglai's CSRD reporting solution.