Compliance & CSRD
Directive (EU) 2022/2464 elevates environmental data to the rank of financial statements in the management report. Often produced by the information system without the traceability required by statutory auditors, we structure and secure this production chain to make it fully defensible.
Regulation
An evolving regulatory framework
The regulatory framework is evolving rapidly: the stop-the-clock directive (EU) 2025/794 postponed certain deadlines by two years, while the Omnibus package revises thresholds and requirements. Scoping depends on each company and its closing date, with non-postponed obligations arising from other texts.
CHALLENGES
Engagement framework and macro challenges
Your sustainability teams master the standard, but the required figures come from tools they do not run: Cloud billing, asset management or carbon references. Between the rule and the technical reality, a documented production chain is generally missing, and that is what auditors scrutinise. We intervene precisely on that missing link.
IMPACTS
The IT impacts of the directive
Engagement scope
Dimensions and stakes addressed in the field
Mapping the ESRS data points the digital estate is responsible for
Requirements translated into concrete obligations for the IT department: E1-5 for energy consumption split between fossil, nuclear and renewable sources, E1-6 for Scopes 1, 2 and 3, with Scope 2 to be published under both methods, location-based and market-based, E1-7 for the separate treatment of carbon credits, which cannot be deducted from gross emissions, E1-8 for the internal carbon price where one exists, E3 for water consumption, fed by facility WUE, E5 for hardware circularity. Every data point is tied to a source, an owner and a frequency.
Scope 3 categories 1 and 2: Cloud and hardware
The mechanism deserves to be stated explicitly, because it determines the quality of your own reporting: your Cloud provider's Scope 2, that is the electricity consumed by its data centres, constitutes your Scope 3 category 1. You therefore inherit its methodological choices, including its Scope 2 accounting method, its boundary and its allocation key between customers. A figure supplied market-based by the provider enters your reporting as is and stays invisible there to the reduction efforts made by your teams. Cloud spend belongs to category 1, purchased goods and services, and acquired hardware to category 2, capital goods. Two methods coexist: the spend-based approach, which applies an emission factor to the expenditure, and the activity-based approach, which starts from actual consumption. The first produces an absurd result in a Cloud environment, since any price negotiation shows up as an emissions reduction. We document the move from one to the other and the gap it creates in the historical series.
Double materiality applied to the information system
The materiality assessment must be conducted through both lenses: the impacts of your activities on the environment, and the risks that sustainability matters create for your activities. On the digital side, that covers exposure to grid connection constraints for data centres, dependence on regions under water stress, the anticipated cost of carbon and hardware availability. These elements also feed E1-9 on anticipated financial effects.
Value chain and supplier data quality
The disclosures cover the entire value chain, including hosting providers and managed service vendors. The three-year transitional relief allows an unavailability to be explained, provided the efforts made and the remediation plan are described, and it does not remove the need to carry them out. We formalise the data requirements to be written into contracts, tenders and supplier reviews, separating what can genuinely be obtained from what cannot.
Traceability, tagging and auditability
The disclosures must appear in a dedicated section of the management report, prepared in the single electronic reporting format, and be tagged so as to be machine readable. In practice, every figure must be traceable back to its extraction, with its methodology version, its emission factors and their vintage. We put that audit trail in place on IT-sourced data, and version the assumptions.
Related sectoral and national obligations
Annual data centre reporting under the Energy Efficiency Directive, ISO/IEC 30134 standards on facility indicators (PUE, WUE, renewable energy factor, heat reuse), the French general reference framework for eco-design of digital services, and eligibility conditions for the reduced electricity excise rate for data centre operators, conditional on energy efficiency and heat recovery commitments. These texts partly overlap with the CSRD and create measurement requirements which, for their part, have not been postponed.
Group consolidation and cross-entity consistency
Building a reference framework shared by all entities: the same emission factors and vintages, the same Scope 3 method, the same allocation key for shared infrastructure, the same collection calendar. Identification of exempt entities and of the mandatory mentions they must carry in their own management report. Preparation of the explanation of significant differences between the group profile and that of certain subsidiaries, required by the directive.
Trajectory and enforceable targets
Modelling information system consumption and emissions at five and ten years, incorporating usage growth, artificial intelligence load, the hardware renewal cycle and realistic efficiency gains. That projection is set against the absolute reduction targets published for 2030 and 2050. A target published without an underlying model becomes a commitment whose trajectory can neither be steered nor defended.
METHODOLOGY
Our methodology
- 01
Build the matrix
Mapping of sources, owning teams and the level of uncertainty for each expected data point, distinguishing what is measured from what is not yet produced and must be documented.
- 02
Industrialise production
Automation of extractions through versioned and traceable emission factors, ensuring a reproducible calculation able to replicate the previous reporting period identically.
- 03
Prepare for assurance
Building the file for auditors: boundary justification, reconciliation with supplier data and a targeted dry run on the key controls.
- 04
Turn into steering
Alignment of published indicators with operational and infrastructure trade-offs, turning the regulatory constraint into a genuine decision instrument.
WHAT THE CSRD ASKS OF IT
Five data points, five production chains to build
What the directive actually asks of the IT department comes down to five production chains, none of which is served by an annual export.
These five chains rest on the same underlying data. Building them separately, under the pressure of the reporting calendar, produces divergent figures between the sustainability statement, the IT dashboard and the answers given in tenders. Building them once, properly, costs less than reconciling them every year.
DELIVERABLES
Sample deliverables
- Matrix of IT-sourced ESRS data points, with source, owner, method, frequency and level of uncertainty
- Written, versioned methodology note that stands up to the assurance provider: boundary, emission factors and vintages, assumptions, treatment of estimates
- Reproducible calculation chain for consumption and emissions, historised and replayable on prior years
- Dual-method Scope 2 dataset and Scope 3 categories 1 and 2, with restatement of the reference year where the method changes
- Assurance review preparation file and dry-run review report
- Data requirements to be embedded in contracts, tenders and supplier reviews
- Mapping of the related applicable obligations (data centre reporting, eco-design frameworks, tariff conditions) and of their own deadlines
- Response material for customer, investor and public buyer questionnaires, aligned with the published figures
- Group-wide method reference: factors, vintages, boundaries, allocation keys, collection calendar, binding on every entity
- Five and ten year projection of information system consumption and emissions, set against the published absolute targets
- Position note on exempt entities, the associated mandatory mentions and the explanation of significant differences between subsidiaries
- Environmental data provision clauses for infrastructure, hosting and software as a service contracts, specifying boundary, granularity, method and frequency
KPIS
Steering indicators
- Share of IT-sourced ESRS data points covered by an automated calculation chain
- Share of published emissions based on activity data rather than on spend ratios
- Time to produce the complete dataset after the year end
- Number of points raised in assurance review and resolution rate from one year to the next
- Share of supplier contracts containing environmental data provision clauses
- Gap between published figures and internal steering figures
FAQ
Frequently asked questions
Continue reading
- Energy sources and location
The technical lever behind published indicators.
- FOCUS
Data normalisation, a prérequisite for auditable reporting.
- FinOps & IT Budgets
Linking indicators to budgets and legal entities.
- Cloud & AI Center of Excellence
The accountability chain across IT, finance and sustainability.