CSRD timeline 2026: what to do each quarter

If you’re reporting on FY 2025 data in 2026 — typical wave 2 cadence — the work spans the whole year. Here’s the rhythm that consistently lands a clean report in time.

Q1 — Double materiality assessment

Finish your DMA in the first quarter. Everything downstream depends on it:

Lock the stakeholder engagement plan.
Score all ESRS topics on impact and financial materiality.
Set thresholds and select material topics.
Get board / audit committee sign-off on the final list.

Why early: the DMA defines what data you need to collect. Starting data collection without it means you’ll collect data you don’t need and miss data you do.

Q1–Q2 — Data collection

In parallel with Q1, kick off data collection for the topics you already know will be material:

Run a gap analysis: 320 data points vs what exists in your systems today.
Prioritise high-materiality topics first.
Engage value chain suppliers (respecting the PSME cap for those under 1,000 employees).
Stand up the data infrastructure — single source of truth, audit trails, version control.

Plan for 6+ weeks here, often longer. Supplier data is the most common bottleneck.

Q2–Q3 — Drafting

Start writing once the DMA is locked and the first wave of data is in:

Structure the report around ESRS 2 (general disclosures) + the topical standards (E1–E5, S1–S4, G1) for material topics only.
Pull baselines and trend data for all quantitative metrics.
Begin XBRL tagging preparation in parallel (it doesn’t have to be perfect at this stage, but the data structure has to support it).
Cross-reference qualitative disclosures with policies, governance documents and minutes — each claim needs a source.

Q3 — Internal review

Before the auditor sees it:

QA every data point: source, calculation, version, sign-off.
Verify the audit trail is complete and reproducible.
Pre-brief your assurance provider on scope and methodology so the formal review goes faster.
Address obvious gaps now — Q4 is too late.

Q4 — Assurance and submission

Final stretch:

External auditors run their limited assurance review.
Resolve findings and produce the final version.
Convert to XBRL format and validate against the EFRAG taxonomy.
File with the national registry as part of the management report.

Common timing mistakes

Starting data collection before the DMA is done. You waste effort on non-material topics.
Treating XBRL as a last-minute conversion job. It’s a tagging exercise that’s easier if your data structure was designed for it.
Engaging auditors in Q4. They need to understand your methodology in Q3, not be surprised in December.
Trying to be perfect on day one. Start with the data you have. Improve year on year. Auditors expect progression, not perfection.

A note on Omnibus I

If you’re now out of scope due to the 2026 threshold change, you still benefit from running through Q1 and Q2 — most of the work has cross-framework value (CDP, EcoVadis, EINF, ISO 14001 all draw on the same underlying data).