Your First CSRD Report: A Practical Roadmap for 2026

As of July 2026, the picture is complete. The Omnibus package settled who has to report, and on 3 July 2026 the European Commission adopted the revised ESRS that settle how much. It changed a lot. It did not change the hard part. The good news: done right, your first CSRD report becomes a system you reuse every year. This guide is the plan we use with first-time reporters, built from the experience of practitioners who run CSRD reports themselves, not a summary of the regulation.

Are You Still in Scope?

Start here, because the Omnibus thresholds rule a lot of companies out. You are in scope if you are an EU company that meets both conditions: 1,000 or more employees, and more than €450 million in net turnover. Meeting only one does not count. Companies already reporting under Wave 1 continue under the transition rules, listed SMEs are now fully exempt, and companies that fall out of scope can still report voluntarily under VSME. For the full account of what the Omnibus changed, see our Omnibus explainer. If you are in scope, your first reporting year is FY 2027, published in 2028. That is the timeline this roadmap is built around.

What the Revised ESRS Mean for First-Time Reporters

The revised ESRS (also called ESRS 2026 or the simplified ESRS) were adopted by the European Commission on 3 July 2026 and apply mandatorily for financial years beginning on or after 1 January 2027 — exactly your first reporting year. Compared to the 2023 standards, they cut mandatory datapoints by more than 60 percent, to roughly 320, and the total datapoint count by more than 70 percent. Early application for FY 2026 is permitted once the delegated act enters into force. The act is now in its Parliament and Council scrutiny window; the application date stands. For first-time reporters the practical consequence is simple: you plan against one stable standard from day one, with no legacy version to unlearn.

CSRD 2026: Your Post-Omnibus Roadmap (PDF)
The companion to this guide: checklists, a project timeline, and a data-point reference for every step. Built for first-time FY 2027 reporters.
Download the CSRD 2026 Roadmap → (link to wire up in Webflow)

How to Read This Roadmap

The six steps are a planning framework, not a description of how the work actually unfolds. In practice the steps often loop. Materiality findings shift once data collection starts, and audit preparation sometimes sends you back. That back-and-forth is normal. What the roadmap gives you is a shared structure and a sequence you can put in a project plan.

The Six Steps to Your First Csrd Report

Step 1: Build Governance and Your Project Team

Your report is decided in the room you assemble, not the one you draft in. Bring Finance, Legal, and the Board in as active participants now, and stand up your documentation infrastructure before any data moves. The audit does not judge how well the report reads, it judges the process behind it, the internal controls and the traceability. That is a Step 1 decision, not a Step 5 fix.

Step 2: Run the Double Materiality Assessment

The double materiality assessment decides which of the roughly 320 mandatory datapoints in the revised ESRS your company actually reports. The Omnibus did not remove it, and the ESRS 2026 rewrite kept it at the center. What the revision did do is make the method lighter: a top-down approach starting from your business model is now explicitly endorsed, and qualitative analysis is sufficient where the conclusion is clear. The bottleneck is rarely the methodology anyway. It is cross-functional sign-off, and 21% of first-year qualified audit opinions in Central Europe traced back to double materiality process failures (Deloitte CE, October 2025). For the method itself, see our guide to the double materiality assessment.

Step 3: Map Your Data Architecture and the Gaps

Before you collect anything, map what already exists across EcoVadis, CDP, HR, finance, and operations. Then find the gaps against the data points that matter to you. A handful are systematically hard, including Scope 3 emissions and disaggregated workforce data, because they need ownership across departments that most companies do not have in place yet.

Step 4: Collect the data and Document as You Go

Collect data and build the audit trail in parallel, not one after the other. For every data point, record the source, the method, and who signed it off, because that is the first thing your assurance provider asks for. The cost of skipping it is real: 66% of Euro Stoxx 50 companies restated prior-year emissions and workforce data in Year 2, mostly because Year 1 methods were not solid enough (SRN, 2026).

Schedule a dry run before the main deadline, in the first half of 2027. It tests the full process while there is still time to fix what breaks.

Step 5: Draft the Report

If the first four steps went well, drafting is the shortest step. The revised ESRS also allow cross-references and appendices to cut duplication, which keeps the statement readable. Finance and Legal review their own sections, not just the sustainability team. One relief worth noting: XBRL digital tagging is postponed. It becomes mandatory only once ESMA's digital taxonomy is adopted as a regulatory technical standard, which will not happen in time for FY 2027 reporters. We explain why in our XBRL article.

Step 6: Pass the Audit and Limited Assurance

The audit reviews the process, not the prose. Limited assurance remains the standard. In the past, out of 126 Central European reports, 12 drew qualified opinions, mostly from documentation and double materiality gaps (Deloitte CE, October 2025). Two things first-timers miss: Big 4 auditors will not accept Excel-based documentation, and auditors can conduct site visits. If a number is missing or cannot be estimated, say so clearly. Transparency scores better than obfuscation.

Getting It Done without the Spreadsheet Overload

The roadmap is the plan. The harder question is how you run it across Finance, Legal, HR, and a dozen data owners without it collapsing into email threads and version conflicts.

This is the gap Sunhat closes, and our ESRS use case shows it end to end. You assign tasks and track responsibilities from day one. You run the full double materiality process with sign-off tracking. And Proof AI maps your existing EcoVadis, CDP, and internal data against the ESRS data points, so you see what is ready, what is similar, and what is missing. Source, methodology, and sign-off are recorded as collection runs, so the audit trail your assurance provider asks for is already there.

The path to an audit-ready report does not start with the report. It starts with knowing which of your data already exists, and where the real gaps are. We show you that right at the start.