Preparing for CSRD Wave 2: What Mid-Size Companies Need to Know About AI-Powered Reporting

By Wingston Sharon | March 2025

CSRD Wave 1 companies — large public-interest entities — filed their first reports under the new standards in early 2025. The lessons from those early filings are now filtering through the market, and they're not entirely encouraging for the companies that come next.

Wave 2 begins with FY2025 reporting: large EU companies with 250+ employees that weren't already in Wave 1, plus large non-EU companies meeting certain thresholds. Reports under CSRD are due approximately six months after the financial year end, meaning FY2025 reports will be due in mid-2026. If your organization is in scope and you haven't started, you are already behind on the preparation timeline that the reporting actually requires.

This article covers what Wave 2 companies need to do now, what Wave 1 experience tells us about the common mistakes, and where AI tools genuinely help versus where vendors are overselling.

Who Is Actually in Wave 2

CSRD Wave 2 scope as currently structured:

• Large EU companies not already covered by Wave 1: those meeting at least two of the three thresholds — 250+ employees, €40M+ net turnover, €20M+ balance sheet total — for two consecutive years
• Large non-EU companies with significant EU market activity (net EU turnover >€150M) with EU subsidiaries or branches above certain thresholds
• Listed SMEs have an optional delayed start and face a simplified ESRS (LSME standards)

If you're reading this and you employ more than 250 people in the EU, assume you are in scope and work backwards from there. The exact legal determination requires checking your specific jurisdiction's transposition and your company's structure, but the default assumption for mid-size EU companies should be: you're in scope.

What CSRD Wave 2 Companies Actually Need to Report

CSRD requires reporting under the European Sustainability Reporting Standards (ESRS). The standards cover:

• Cross-cutting standards: ESRS 1 (general requirements) and ESRS 2 (general disclosures) — required for all companies
• Topical standards: Climate (E1), Pollution (E2), Water (E3), Biodiversity (E4), Resource use (E5), Own workforce (S1), Workers in the value chain (S2), Affected communities (S3), Consumers (S4), Business conduct (G1) — required only where material

The materiality point is critical and widely misunderstood. Not every company needs to report on every standard. The CSRD uses a double materiality framework: an issue is material either if it has a material impact on the company's financial performance (financial materiality) or if the company's activities have a material impact on society/environment (impact materiality). Both directions count.

The double materiality assessment is the first real work of CSRD preparation, and it determines the scope of everything else. Get this wrong and you either under-report (regulatory risk) or over-report (enormous unnecessary data collection burden).

What Wave 1 Experience Shows

I have been following Wave 1 reporting closely, and several patterns stand out:

Mistake 1: Starting the double materiality assessment too late.

The double materiality assessment requires stakeholder engagement — not just internal management judgment but documented input from suppliers, employees, customers, and affected communities. This takes time. Wave 1 companies that started their materiality assessment in late 2023 for FY2024 reporting found themselves doing rushed stakeholder consultations that didn't hold up to scrutiny. For Wave 2 companies with FY2025 reporting, the materiality assessment should be underway now, not starting in autumn 2025.

Mistake 2: Treating materiality assessment as a one-time checkbox.

The materiality assessment isn't just process gatekeeping. It determines your entire reporting scope. Companies that rushed through it to get to the "real work" of data collection then discovered they had either scoped themselves into reporting standards they couldn't support with data, or out of standards that their auditors (and the regulation) expected them to cover.

Mistake 3: Underestimating value chain data gaps.

ESRS standards require data from the value chain — suppliers, contractors, distribution partners. Many Wave 1 companies discovered that their supply chain data collection infrastructure was essentially nonexistent. Asking suppliers for emissions data when you've never done so before is not a quick process: it requires outreach, explanation, follow-up, and data quality checking. For companies with complex supply chains, this is a 12-18 month effort, not a 3-month sprint before the reporting deadline.

Mistake 4: Scope 3 emissions without a methodology decision.

ESRS E1 (climate) requires Scope 3 emissions reporting. There are multiple accepted methodologies (spend-based, activity-based, supplier-specific data), and they produce very different numbers. Wave 1 companies that hadn't made a clear methodology decision before data collection started ended up with inconsistent data that was difficult to aggregate and harder to defend under audit.

The Data Collection Challenge

The most practical constraint on CSRD preparation for mid-size companies is data: where does it exist, in what format, who owns it, and how do you aggregate it reliably?

A realistic inventory of data types needed for common ESRS disclosures:

For most mid-size companies, the data for CSRD reporting is spread across four to eight different internal systems with no existing integration. Consolidating it into a reportable format is the core operational challenge of CSRD — not understanding the standards, but actually having the data those standards require.

The 6-18 month lead time I mentioned earlier refers specifically to this: getting the right data systems talking to each other, establishing new data collection processes where none exist (particularly for value chain data), and running at least one full reporting cycle before the audit-ready submission.

Where AI Tools Actually Help

I want to be specific here because the AI-for-ESG-reporting market is full of inflated claims, and I don't want to add to them.

Genuinely useful applications:

Gap analysis against ESRS standards. AI tools can compare your current disclosures (annual report, existing sustainability report, ad hoc documents) against the full ESRS requirements and produce a structured gap list. This is tedious work that AI handles well. The output is a list of required disclosures you are currently not making, organized by standard. This is a useful starting point for planning.

Automated data collection from internal systems. AI can help write the integrations and data pipelines that pull information from HR systems, finance systems, and EHS platforms into a centralized reporting dataset. This is engineering work, but it's a real time-saver versus building integrations manually.

Consistency checking across report sections. A final CSRD report may be 100+ pages. AI tools can systematically check for internal inconsistencies: does the headcount number in the S1 section match the number referenced in the strategy section? Does the climate transition plan reference the same baseline year as the emissions data? These are the kinds of errors that slip through human review and are embarrassing when auditors catch them.

Terminology and standards mapping. AI can help translate between different ESG reporting frameworks (GRI, TCFD, SASB) and the ESRS standards. If you have existing GRI-aligned disclosures, an AI tool can tell you which ESRS data points those disclosures may already satisfy and what additional data points remain.

Where AI tools fall short (despite vendor claims):

Value chain supplier engagement. Getting your suppliers to provide emissions data requires relationship management, follow-up, capacity building, and often helping smaller suppliers understand what you're asking for. No AI tool does this for you. It requires human communication.

Double materiality assessment. The qualitative judgment of what is and isn't material to your specific business, in your specific sector, given your specific stakeholder relationships, requires human analysis and stakeholder engagement. AI can help you structure the process and document the output, but it cannot do the strategic judgment that a defensible materiality assessment requires.

Auditor interaction. Your CSRD report will be audited (limited assurance initially, reasonable assurance eventually). Auditor relationships, responding to audit queries, and explaining methodology decisions are human activities.

Qualitative narrative writing. The strategy section, the governance description, the explanation of your approach to material topics — these require people who understand your business to write them. AI-generated corporate narrative is detectable and tends to be generic in ways that attentive auditors and analysts will notice.

Be specifically skeptical of: Any vendor claiming their tool will "automate CSRD compliance" or "generate your CSRD report." CSRD compliance requires organizational processes, data infrastructure, and verified data. No tool generates that.

A Practical 12-Month Checklist

April–June 2025 (Now):

• [ ] Confirm in-scope status and identify legal entities affected
• [ ] Appoint internal CSRD lead with cross-functional authority (finance, HR, operations, legal)
• [ ] Commission or begin double materiality assessment — this needs to start now
• [ ] Map current data systems against required ESRS data points
• [ ] Identify your most significant data gaps (especially value chain emissions)

July–September 2025:

• [ ] Complete double materiality assessment and document results
• [ ] Begin value chain supplier outreach program for emissions data
• [ ] Establish data collection processes for priority ESRS standards
• [ ] Select reporting tool or platform (or decide to build internally)
• [ ] Begin internal training for data owners across relevant departments

October–December 2025:

• [ ] Run first full data collection cycle for FY2025 (Q1–Q3 data)
• [ ] Identify auditor and begin pre-audit dialogue about methodology choices
• [ ] Test AI gap analysis tools against your draft disclosures
• [ ] Document your double materiality assessment formally for auditor review
• [ ] Resolve any material data gaps with documented methodology decisions

January–March 2026:

• [ ] Full-year FY2025 data collection complete
• [ ] Draft report complete
• [ ] Internal review and consistency checking
• [ ] Auditor limited assurance engagement
• [ ] Final report publication (due approximately mid-2026 for FY2025)

The Uncomfortable Truth About Timeline

Mid-size companies sometimes assume they have an advantage over Wave 1 because they can "learn from the large companies." That is partially true for understanding what the standards require. It is not true for the operational challenge of building data infrastructure.

The Wave 1 companies that filed well had started their internal processes in 2022–2023, eighteen months to two years before their first report. Mid-size companies in Wave 2 who are starting now in early 2025 for FY2025 reporting have the same 12-18 month window — but it's already running.

The companies that will struggle are those that treat CSRD as a reporting project (produce a document) rather than a data and process transformation (build the infrastructure that makes the document possible to produce reliably, year after year, under audit).

If you are working through CSRD Wave 2 preparation and want to discuss where automation can genuinely help, reach out at hello@agentosaurus.com.