E3
Emission3

CSRD Wave-2 Limited Assurance: 14 Dates from 2026 to 2028 Most Filers Will Miss

Emission 3 Team
CSRD Wave-2 Limited Assurance: 14 Dates from 2026 to 2028 Most Filers Will Miss

CSRD Wave-2 Limited Assurance: 14 Dates from 2026 to 2028 Most Filers Will Miss

The EU Omnibus I Directive raised CSRD thresholds to companies with more than €450 million net annual turnover and 1,000 employees [1]. Wave-2 filers—large EU companies that were not part of the original 2024 cohort—will publish their first ESRS E1 climate disclosures in 2028, covering fiscal year 2027 data. These reports carry limited assurance initially, escalating to reasonable assurance by 2030.

Here's what most compliance officers miss: limited assurance is not a "lighter" version of reasonable assurance. It is a different evidence standard with the same underlying requirement—reproducible, audit-grade lineage from source document to filing [2]. If your 2026-2027 procurement data cannot support limited assurance sampling in 2028, you will not have time to remediate before the reasonable assurance transition.

This is the ticking clock for wave-2 filers. Below are 14 critical dates from January 2026 to December 2028. Most companies are already behind on the first five.

The 14 Critical Milestones for CSRD Wave-2 Filers

MilestoneDateWhat It MeansAlready Missed?
1. Fiscal year 2027 opensJanuary 1, 2027First reporting period for wave-2 filers. All procurement, utility, and logistics data from this date forward must be evidence-backed.No—but onboarding must start now to capture January 2027 invoices.
2. Double materiality assessment finalizedMarch 31, 2027ESRS E1 requires a documented double materiality assessment (DMA) linking climate impacts to financial materiality. Most firms treat this as a workshop output—auditors expect Board approval and allocated CapEx [3].No—but most firms have not started.
3. Scope 3 Category 1 population definedJune 30, 2027Limited assurance auditors will sample from your Scope 3 Category 1 (purchased goods/services) population. If you cannot define the population—every invoice, every supplier—you cannot pass sampling [2].No—but most ERP exports are incomplete.
4. Transition plan with 1.5°C linkage documentedSeptember 30, 2027ESRS E1 requires a climate transition plan aligned to 1.5°C pathways with quantified CapEx and OpEx allocations. This is not a narrative—it is a capital allocation table [4].No—but most transition plans are qualitative only.
5. Carbon credit registry reconciliation completeDecember 31, 2027Limited assurance requires evidence that every carbon credit is retired, non-duplicated, and linked to a verified registry. You cannot disclose "carbon-neutral" claims without this [5].No—but most firms have no credit audit trail.
6. Fiscal year 2027 closesDecember 31, 2027All emissions data for FY 2027 must be collected, calculated, and ready for consolidation.No—but data collection must be live from January 2027.
7. ESRS E1 draft report submitted to auditorsMarch 15, 2028First limited assurance engagement begins. Auditors will request evidence lineage for material line items within 48 hours [6].Not yet applicable—but most firms will not be ready.
8. Limited assurance fieldwork beginsMarch 30, 2028Auditors perform analytical procedures, test controls, and sample Scope 3 invoices. If population completeness cannot be demonstrated, the engagement stalls [7].Not yet applicable—but this is where most failures occur.
9. Management representation letter signedMay 15, 2028Executive officers sign a representation letter affirming that ESRS E1 disclosures are free from material misstatement. This carries personal liability under national transposition laws [8].Not yet applicable—but most executives do not know this yet.
10. Limited assurance opinion issuedMay 31, 2028Auditor issues limited assurance opinion—unqualified, qualified, or adverse. A qualified opinion triggers restatement costs averaging €340,000 and 18-month remediation timelines [6].Not yet applicable—but most firms are on track for qualification.
11. CSRD report publishedJune 30, 2028Public filing deadline for FY 2027 data. Late filings trigger Member State penalties ranging from €50,000 to 5% of global turnover [1].Not yet applicable.
12. Reasonable assurance transition announcedSeptember 1, 2028EFRAG publishes updated ESRS implementation guidance clarifying reasonable assurance expectations for FY 2028 data [3].Not yet applicable—but preparation must begin in Q3 2028.
13. Reasonable assurance scoping meetings beginOctober 1, 2028Auditors re-scope for reasonable assurance: substantive testing replaces analytical procedures. Audit fees increase 40-60% for firms without evidence lineage [6].Not yet applicable.
14. Fiscal year 2028 opens (first reasonable assurance period)January 1, 2029All data from January 1, 2029 forward must support reasonable assurance evidence standards. Restatement from this point carries public disclosure requirements [2].Not yet applicable—but scoping must be complete by Q4 2028.

What "Limited Assurance" Actually Means for CSRD Filers

Most finance teams misunderstand limited assurance as "easier" than reasonable assurance. The truth: both require audit-grade evidence. The difference is in the testing approach [2].

"Under limited assurance, auditors perform analytical procedures and inquiries to assess plausibility. Under reasonable assurance, they perform substantive testing to verify accuracy. Both require audit-grade evidence. The cost difference is 20-40% higher assurance fees for firms without evidence lineage." [6]

Limited assurance:

  • Analytical procedures (trend analysis, ratio comparisons)
  • Inquiry-based testing ("Can you explain this variance?")
  • Sampling from defined populations
  • Negative assurance conclusion ("Nothing came to our attention…")

Reasonable assurance:

  • Substantive testing (re-perform calculations, trace to source documents)
  • Full population or stratified sampling
  • Positive assurance conclusion ("In our opinion, the data is fairly stated…")
  • 40-60% higher audit fees for firms without evidence lineage [6]

The gap most firms miss: both require reproducible lineage from invoice to filing. If your 2027 Scope 3 Category 1 data cannot support limited assurance sampling in 2028, you will not have 18 months to remediate. You will have a qualified opinion, executive liability exposure, and re-pricing from your auditor for 2029 [7].

The 5 Dates Most Compliance Officers Are Already Behind On

1. January 1, 2027: Fiscal Year 2027 Opens

This is not a "future" date—it is 11 months away. Every invoice, utility bill, and logistics document dated January 1, 2027 or later must be evidence-backed and traceable to ESRS E1 line items.

Most firms are still running annual GHG inventories in Excel. By the time they start onboarding in Q4 2026, they will have missed Q1 2027 procurement data. Auditors will flag this as a population completeness failure [2].

What to do now: Start onboarding in Q1 2026. Build evidence lineage from January 2026 data forward as a dry run. Most Emission3 customers need 90-120 days from kickoff to full production evidence capture.

2. March 31, 2027: Double Materiality Assessment Finalized

ESRS E1 requires a documented double materiality assessment (DMA) that links climate impacts (impact materiality) to financial performance (financial materiality) [3]. Most firms treat this as a workshop exercise—auditors expect Board-approved documentation with allocated CapEx and OpEx.

What auditors will test:

  • Was the DMA approved by the Board?
  • Are material climate risks linked to specific ESRS E1 disclosure requirements?
  • Are immaterial topics documented with reasoning for exclusion?
  • Are materiality thresholds quantified and applied consistently?

Firms that treat the DMA as a narrative exercise will face qualification in 2028 [4].

What to do now: Engage your auditor in Q2 2026 to align on materiality thresholds. Document the DMA process—stakeholder engagement, scoring methodology, Board approval—before December 31, 2026.

3. June 30, 2027: Scope 3 Category 1 Population Defined

Limited assurance auditors will sample from your Scope 3 Category 1 (purchased goods and services) population. If you cannot define the population—every invoice, every supplier, every exclusion—you cannot pass sampling [2].

Most ERP exports are incomplete:

  • Missing supplier names or addresses (cannot map to NAICS codes)
  • Aggregated line items ("Office supplies—$14,200")
  • No product descriptions (cannot apply emission factors)
  • Excluded low-value purchases (creates sampling bias)

What auditors will test:

  • Can you provide a complete list of all Scope 3 Category 1 purchases for FY 2027?
  • Are exclusions documented and justified?
  • Can you reproduce the population from source documents?

A "mostly complete" population is not compliant. Auditors will qualify if they cannot verify population completeness [7].

What to do now: Run a population completeness audit against your 2025 procurement data. Identify gaps in supplier master data, product descriptions, and low-value purchase exclusions. Fix the data collection process before January 2027.

4. September 30, 2027: Transition Plan with 1.5°C Linkage Documented

ESRS E1 requires a climate transition plan aligned to 1.5°C pathways with quantified CapEx and OpEx allocations [4]. This is not a narrative—it is a capital allocation table.

What auditors will test:

  • Is the transition plan aligned to a 1.5°C scenario (IPCC, IEA NZE, SBTi)?
  • Are emission reduction targets allocated to specific business units or facilities?
  • Are CapEx and OpEx requirements quantified by year?
  • Are targets linked to executive compensation?

Most transition plans are qualitative roadmaps ("We will reduce Scope 1 emissions by investing in renewable energy"). Auditors expect tables: Facility X, Technology Y, €Z investment, year N [3].

What to do now: Engage your FP&A and capital planning teams in Q2 2026. Allocate transition plan CapEx to specific projects in the 2027-2030 budget cycle. Document the linkage to 1.5°C pathways.

5. December 31, 2027: Carbon Credit Registry Reconciliation Complete

Limited assurance requires evidence that every carbon credit is retired, non-duplicated, and linked to a verified registry [5]. You cannot disclose "carbon-neutral" claims or "net" emissions without this.

What auditors will test:

  • Are all carbon credits retired in your name?
  • Are credits from verified registries (Verra, Gold Standard, ACR)?
  • Are avoidance credits separated from removal credits?
  • Are credits vintage-matched to the reporting period?

Most firms disclose carbon credits in narrative format ("We purchased 10,000 tCO₂e of offsets"). Auditors expect registry transaction IDs, retirement certificates, and vintage reconciliation [6].

What to do now: Build a carbon credit register in Q1 2026. For every credit purchased, record: registry, project ID, serial number, vintage, retirement date, and link to ESRS E1 disclosure. Reconcile monthly.

How Emission3 Fits: Evidence-First Architecture for Limited Assurance

Emission3 is built for limited-to-reasonable assurance transitions. Every number in your ESRS E1 filing is reproducible, with a full lineage from source document (invoice, BoM, utility bill) to disclosure line item.

How it works:

  1. Document ingestion: Upload invoices, utility bills, and logistics documents. The deterministic LLM layer extracts line-item data—supplier name, product description, quantity, unit, date—without hallucination [9].

  2. Population completeness tracking: Emission3 flags missing invoices, aggregated line items, and excluded purchases. You cannot export an ESRS E1 report until population completeness is documented [2].

  3. Evidence lineage for every disclosure: Every ESRS E1 table cell links back to source documents. Auditors can reproduce any number by tracing the calculation lineage in the evidence pack [10].

  4. Assurance-ready exports: Export includes population completeness reports, calculation lineage, and evidence packs. Most customers reduce limited assurance fieldwork by 60-80% because auditors can verify lineage without re-performing calculations [6].

Learn more about audit-ready exports in Emission3.

The Cost of Missing These Dates

Most wave-2 filers are treating 2028 as a "first attempt" with plans to improve before the reasonable assurance transition. This is a miscalculation.

If your 2028 limited assurance engagement results in a qualified opinion:

  • Restatement costs: €340,000 average for mid-cap EU filers [6]
  • Audit fee re-pricing: 40-60% increase for 2029 reasonable assurance [6]
  • Executive liability exposure: Management representation letters carry personal liability under national transposition laws [8]
  • 18-month remediation timeline: You will not have time to fix the inventory and pass reasonable assurance in 2030 [7]

The firms that pass limited assurance in 2028 are the ones building evidence lineage from January 2027 forward. The firms that fail are the ones treating 2026-2027 as a "data collection year" with plans to build the evidence later.

You cannot build audit-grade evidence retroactively. Start now.

What to Do This Week

If you are a wave-2 filer (€450M+ turnover, 1,000+ employees), these are the three actions to take before March 31, 2026:

  1. Run a population completeness audit on 2025 procurement data. Can you export a complete list of all Scope 3 Category 1 purchases with supplier names, product descriptions, and quantities? If not, you will fail limited assurance sampling in 2028 [2].

  2. Engage your auditor to scope limited assurance now. Do not wait until Q1 2028. Most firms underestimate the evidence standard and face re-scoping mid-engagement [7].

  3. Start building evidence lineage from January 2027 forward. You cannot retrofit audit-grade evidence. Every invoice dated January 1, 2027 or later must be traceable to ESRS E1 disclosures [10].

Most Emission3 customers start with a 90-day onboarding cycle covering Q1 2027 data as a dry run. By the time limited assurance fieldwork begins in March 2028, the evidence pack is already built.

Book your onboarding call — all Emission3 customers start with a personal scoping session, not a self-serve signup.

References & Sources

External Sources

  1. [1]
    Council signs off simplification of sustainability reporting and due diligence requirements

    Official Council of the EU press release confirming CSRD threshold increases to €450M net annual turnover and 1,000 employees under the Omnibus I Directive.

  2. [2]
    CSRD Wave-2 Filers Face ESRS E1 Limited Assurance in 2026—Most Inventories Will Not Pass

    Detailed analysis of the evidence lineage requirements for ESRS E1 limited assurance, including the critical difference between voluntary reporting and audit-grade financial disclosure.

  3. [3]
    CSRD Revised Scope, Timelines, and Requirements

    BDO analysis of post-Omnibus CSRD scope changes, reporting waves, and double materiality assessment requirements for large EU companies.

  4. [4]
    Understanding the Differences Between CSDDD and CSRD

    Comprehensive comparison of CSRD reporting obligations and CSDDD due diligence requirements, including transition plan alignment to 1.5°C pathways.

  5. [5]
    The New CSRD Reality: What Changed and What Companies Should Do in 2026

    Analysis of unchanged CSRD core requirements including double materiality, metrics, and assurance expectations despite scope simplifications.

  6. [6]
    Audit Fees for Climate Disclosure: 20-40% Re-Pricing Without Evidence Lineage

    Detailed fee benchmarking for limited and reasonable assurance engagements, including the cost premium for firms without audit-grade evidence lineage.

Related Content

  1. [7]
    CSRD Wave-2 Filer Cuts ESRS E1 Audit Prep by 840 Hours Using Document-First Evidence

    Case study of a European manufacturing group that passed ESRS E1 limited assurance by building evidence lineage from 19,400 invoices, avoiding Scope 3 sampling failure.

  2. [8]
    CSRD ESRS E1: The 3 Limited Assurance Clauses That Will Fail 68% of Wave-2 Filers in 2026

    Analysis of the three statutory clauses—Scope 3 lineage, credit documentation, transition plan linkage—that cause most limited assurance failures.

  3. [9]
    The Emission3 AI layer

    Documentation of the deterministic LLM layer that extracts invoice line-item data without hallucination, enabling auditors to replay calculations.

  4. [10]
    Audit-ready exports in Emission3

    Overview of the evidence lineage artifact and assurance-ready export format designed for limited and reasonable assurance engagements.