CSR & BRSR Compliance Timeline in India: Who Must Comply, and When

If you sit in a CSR, sustainability, ESG or company-secretary role, two separate rulebooks increasingly ask the same thing of you: independent, verifiable evidence from the field, not a self-reported number. One is the CSR regime under the Companies Act; the other is SEBI’s ESG-disclosure regime for listed companies. They have different triggers and timelines, and it helps to see them side by side. This is a plain-language reference — who is covered, what is required, and by when — followed by the part most teams underestimate: where the data actually has to come from.

CSR under Section 135 of the Companies Act

A company is covered by the CSR provisions if, in the immediately preceding financial year, it meets any one of these tests:

A covered company must spend 2% of the average net profit (computed under Section 198) of the three preceding financial years on CSR activities drawn from Schedule VII, govern it through a CSR committee and policy, and report it in the Board’s Report and Form CSR-2. Permitted activities include education, health, environmental sustainability, rural development, livelihoods and agroforestry — which is why so many farmer and agriculture programmes are run as CSR.

The independent impact-assessment trigger (Rule 8(3))

Beyond spending, large CSR has to be independently evaluated. Under Rule 8(3) of the CSR Rules, a company whose CSR obligation is ₹10 crore or more must have its large projects (outlay of ₹1 crore or more, completed not less than a year earlier) assessed for impact by an independent agency — one that is not the agency implementing the project. The assessment is annexed to the Board’s Report. The independence requirement is the key point: a programme cannot credibly grade its own homework.

SEBI BRSR & BRSR Core — the assurance glide path

Separately, SEBI requires the Business Responsibility and Sustainability Report (BRSR) from the top 1,000 listed companies by market capitalisation. On top of the full report, a focused set of KPIs — the BRSR Core — must carry independent reasonable assurance, phasing in by company size:

From FY2026-27, the framework also brings the value chain into scope — ESG data for upstream and downstream partners that each account for 2% or more of purchases or sales, on the BRSR Core attributes. SEBI sets and has revised these timelines and the exact basis (assessment vs assurance), so confirm the current position for your company against SEBI’s latest circulars.

Where the burden actually falls

Put the two regimes together and a pattern appears: the hardest requirements are the ones that need primary evidence from places a head office cannot reach. A CSR impact assessment of a farmer programme means visiting the farms. A BRSR value-chain KPI means getting real data out of a supplier with no ESG system. These are not desk tasks:

• CSR impact assessment — independent beneficiary, asset and outcome verification across the project footprint (Rule 8(3)).
• BRSR value-chain & social KPIs — primary data from suppliers, farms and communities that no ERP holds.
• Both — evidence that is geo-tagged, timestamped and auditable, so it survives an assessor’s or assurer’s scrutiny.

Where Anaxee fits

Anaxee runs an independent, tech-enabled field network across 540 districts, 11,000+ pincodes and 26 states — built to collect and verify exactly the data these rules now demand: geo-tagged, photo-backed, AI-checked, on a live dashboard. Whether the trigger is a Rule 8(3) impact assessment, a BRSR value-chain KPI, or a funder’s third-party monitoring, the field evidence is the same, and it is what Anaxee produces.

FAQ