From a story to a dataset

For years, sustainability reporting was a marketing exercise. A company published a glossy report full of selected photographs, rounded figures and carefully chosen anecdotes, and no auditor checked whether any of it was true. The Corporate Sustainability Reporting Directive (CSRDThe Corporate Sustainability Reporting Directive, the EU law requiring large and listed companies to report sustainability information that is mandatory, structured, verifiable and independently assured, on a par with financial reporting.), the EU law that began applying from the 2024 financial year onwards, ends that era. It requires large and listed companies to report sustainability information with the same rigour as financial information: structured, comparable, and independently checked. The shift is from persuasion to evidence.

What the CSRD actually demands

The directive does three things that voluntary reporting never did. First, it makes disclosure mandatory for companies in scope, not a nice-to-have. Second, it places sustainability information inside the management report, alongside the financials, so it carries the same legal weight. Third, and most importantly for a data team, it requires the information to be systematic and verifiable. You cannot report a carbon figure you cannot substantiate. Behind every number there must be a source, a method, and a trail an auditor can follow.

The ESRSThe European Sustainability Reporting Standards, the detailed standards that specify which sustainability data points a company must disclose and how they are defined, across environmental, social and governance topics.: the actual specification

The CSRD sets the obligation but does not, by itself, tell you what to report. That detail lives in the European Sustainability Reporting Standards (ESRS), a set of standards that function as the specification. They cover the environment, climate, pollution, water, biodiversity, then social topics such as your own workforce, workers in the value chain, and communities, and finally governance and business conduct. Each standard sets out specific data points a company must disclose. Think of the CSRD as the law that says 'report', and the ESRS as the schema that says 'report exactly these fields, defined this way'.

Who is in scope, and when

Scope widens in phases. The largest companies, and listed groups already reporting under earlier rules, started first. Other large companies followed, and listed small and medium-sized enterprises come later, with proportionate lighter standards. Non-EU parent companies with substantial EU activity are also drawn in over time. The phasing dates have been subject to political adjustment, so the practical lesson for a leader is not to memorise a single date but to establish which wave your organisation falls into and to treat the earliest plausible deadline as the planning horizon. Suppliers to in-scope companies feel the pull too, because their customers now need value-chain data from them.

Why assurance changes everything

The quiet revolution in the CSRD is assurance. The reported information must be independently checked, beginning with limited assurance and moving towards reasonable assurance over time. Once an auditor signs off, sustainability data is no longer a communications output; it is an audited asset with the same standard of proof as a balance sheet. That single requirement is what forces companies to stop estimating and start building real data systems, because you cannot assure a spreadsheet nobody can trace.

A common dictionary for the word 'green'

Before the EU TaxonomyA classification system that defines, activity by activity, what genuinely counts as environmentally sustainable, giving a common yardstick for comparing 'green' claims., any company could call itself sustainable and no one could easily contest it. The EU Taxonomy is a classification system that fixes this by defining, activity by activity, what actually qualifies as environmentally sustainable. To count, an activity must make a substantial contribution to at least one of six environmental objectives, such as climate change mitigation or the transition to a circular economy, while doing no significant harm to the others and meeting minimum social safeguards. It is, in effect, a shared dictionary that stops the word 'green' meaning whatever a marketing team wants it to mean.

What 'alignment' means

Companies in scope report the share of their turnover, capital expenditure and operating expenditure that is Taxonomy-aligned, meaning it meets those tests. An energy firm might report that thirty per cent of its revenue comes from aligned activities. That single figure lets a bank or investor compare two firms on a like-for-like basis rather than trusting a brochure. Alignment is deliberately hard to claim, because the whole point is to make greenwashing measurable and therefore harder.

The idea that reshapes materiality

In traditional financial reporting, something is 'material' if it could affect an investor's decisions. Sustainability reporting under the CSRDThe Corporate Sustainability Reporting Directive, the EU law requiring large and listed companies to report sustainability information that is mandatory, structured, verifiable and independently assured, on a par with financial reporting. uses a wider test called double materiality. A topic is material if it is significant in either of two directions, and a company must assess both. The two directions are impact materiality and financial materiality.

Two directions, one example

Impact materialityThe outward direction of double materiality: how the company's activities affect people and the environment, even where there is no direct effect on its own finances. looks outward: how does the company affect people and the planet? A factory discharging pollutants into a river has a material environmental impact even if that pollution never dents its profit. Financial materialityThe inward direction of double materiality: how sustainability matters affect the company's own value, cash flows and risk, such as rising carbon prices or a drought halting production. looks inward: how do sustainability matters affect the company's own value, cash flows and risk? Rising carbon prices, a drought that halts production, or a supplier region hit by flooding are financially material because they hit the balance sheet. Consider a beverage company reliant on a water-stressed region. Its heavy water use is an impact on the local community, that is impact materiality. The same water stress also threatens its ability to produce at all, that is financial materiality. Double materialityThe test used under the CSRD that treats a topic as material if it is significant in either direction: the company's impact on people and planet, or the financial effect of sustainability matters on the company. insists you report both, because ignoring either leaves the picture incomplete.

Why this expands the data you need

Single financial materiality lets a company report only what touches its own wallet. Double materiality forces it to gather evidence about its effect on the outside world too, and to trace risks flowing back in from far along the value chain. That means data on emissions, water, workers and suppliers that a firm may never have collected before. The materiality assessment is not a philosophical exercise; it is the step that determines the scope of the entire data-gathering effort, which is why leaders should treat it as a strategic decision, not a compliance footnote.

A report a machine can read

A traditional sustainability report was a document meant for human eyes: paragraphs, charts and a carbon figure buried on page forty. A regulator, investor or auditor who wanted to compare a hundred companies had to read a hundred documents by hand. The CSRDThe Corporate Sustainability Reporting Directive, the EU law requiring large and listed companies to report sustainability information that is mandatory, structured, verifiable and independently assured, on a par with financial reporting. ends this by requiring reports in a structured digital format. Instead of a figure that merely appears on a page, each data point is tagged, wrapped in a machine-readable label that says precisely what it is, for example 'total Scope 1 greenhouse gas emissions, in tonnes, for this reporting year'. A computer can then extract, compare and analyse that figure across every company automatically.

ESEFThe European Single Electronic Format, the EU's mandated structured digital format for annual reports, extended from financial statements to sustainability information. and XBRLeXtensible Business Reporting Language, the tagging language that attaches machine-readable labels to each reported figure so it is individually identifiable and comparable across companies., without the jargon

Two acronyms carry this. ESEF, the European Single Electronic Format, is the EU's mandated digital format for annual reports, already used for financial statements and now extended to sustainability information. XBRL, eXtensible Business Reporting Language, is the underlying tagging language that attaches those machine-readable labels to each number. You do not need to write XBRL any more than a driver needs to build an engine, but leaders should understand what it delivers: a report where every disclosed figure is individually identifiable, defined the same way across companies, and instantly comparable. The document and the data become the same thing.

What 'verifiable' really asks

Digital tagging makes data comparable; the assurance requirement makes it verifiable. To verify a figure, an auditor must be able to follow it backwards from the tagged number in the report to the calculation that produced it, to the raw records that fed the calculation, to the systems those records came from. If a company reports an emissions figure, it must be able to show the meter readings, invoices, or activity data behind it, and the method used to convert them. A number no one can trace is a number no one can assure. Verifiability is therefore a property of your data plumbing, not of your writing.

Why this changes the data itself

Here is the strategic point. 'Digital and verifiable' is often mistaken for a formatting requirement, something the design team handles at the end. It is the opposite. To produce tagged, traceable figures, the data must be structured, defined consistently, stored with its provenance, and reconcilable to source systems from the moment it is collected. You cannot bolt traceability onto a pile of loose spreadsheets after the fact. The requirement reaches all the way back to how the data is captured, which means it changes the data itself, not just the final document. That is why sustainability reporting has quietly become a data-infrastructure problem rather than a reporting one, and why it belongs with your engineering and data teams as much as with your sustainability team.

A cluster, not a single rule

It is tempting to treat the CSRDThe Corporate Sustainability Reporting Directive, the EU law requiring large and listed companies to report sustainability information that is mandatory, structured, verifiable and independently assured, on a par with financial reporting. as one isolated obligation for the sustainability team to handle. That view is a mistake, and an expensive one. The CSRD is one member of a cluster of EU regulations arriving in the same few years, each aimed at a different risk but each making the same underlying demand. Understanding them together is the difference between building one durable capability and paying five times for five overlapping projects.

The others in the cluster

NIS2 raises cybersecurity and incident-reporting duties for essential and important entities, and it demands governed evidence of your security posture. The Cyber Resilience Act requires that products with digital elements are secure by design and carry auditable records of their vulnerabilities and updates across their lifetime. DORA, the Digital Operational Resilience Act, obliges financial firms to prove they can withstand and recover from IT disruption, with detailed, evidenced controls and third-party oversight. The EU AI Act requires high-risk AI systems to keep documentation, logging and data records that show how they were trained and how they behave. Different targets, cybersecurity, product safety, financial stability, artificial intelligence, yet a single shared requirement runs through all of them.

The one thing they all demand

Strip away the subject matter and each of these laws asks for the same thing: trustworthy, governed, auditable data. NIS2 wants evidence you can trust about your security. The Cyber Resilience Act wants a traceable record of a product's security over time. DORA wants demonstrable, evidenced operational controls. The AI Act wants documented, logged, verifiable data about a model. And the CSRD wants structured, assured, traceable sustainability data. In every case the regulator is really asking the same underlying question: can you prove, from governed records, that what you claim is true? That is a data-governance question wearing five different costumes.

The DSI insight: security and sustainability converge

Here is the observation that reframes the whole landscape. Sustainability reporting and cybersecurity look like different worlds, one about carbon and workers, the other about breaches and firewalls, but under the regulation they are the same discipline. Both require data you can trust, with known provenance, controlled access, a clear owner, and an audit trail. The controls that make sustainability data assurable, define it once, capture it with its source, govern who can change it, log every change, are the very same controls that make security and operational data assurable. Security and sustainability are two faces of one data-governance problem. A company that builds a single trustworthy-data capability satisfies all of them at once.

The cost of silos

The strategic error, which many organisations are making right now, is to answer each regulation with a separate team, a separate consultant, a separate tool and a separate data pull. That approach multiplies cost, produces inconsistent numbers across reports, and builds nothing that lasts. The alternative is to recognise the convergence and invest once in governed data infrastructure that every one of these regulations can draw upon. The regulations are not five problems. They are one problem, asked five times, and the company that sees this pays for the answer once.

What a forcing function is

A forcing function is an external pressure that makes you do something you should have done anyway, but kept postponing. Deadlines are forcing functions; so are regulations. Left to their own devices, most companies never quite get around to building clean, governed, trustworthy data, because the payoff is diffuse and the work is unglamorous. The wave of EU regulation removes the choice. It sets a hard deadline behind a demand for exactly the kind of data foundation that ambitious firms have wanted for years and rarely funded. Seen this way, the regulation is not only a cost. It is the budget and the mandate to finally build the thing.

The data you are forced to build is the data you wanted

Consider what the regulations require: data defined consistently across the business, captured with its source, governed by clear ownership, traceable, and comparable over time. Now consider what a company needs to run itself well: to know its true energy costs and where to cut them, to see supply-chain risk before it bites, to answer an investor or a customer with confidence, to make decisions on evidence rather than on the loudest opinion in the room. These are the same data. The emissions data you gather for the CSRDThe Corporate Sustainability Reporting Directive, the EU law requiring large and listed companies to report sustainability information that is mandatory, structured, verifiable and independently assured, on a par with financial reporting. tells you where energy and money leak. The supply-chain data you gather for double materiality is the same data that flags a supplier about to fail. The governance you build to satisfy an auditor is the governance that lets you trust your own numbers.

Two mindsets, two very different returns

This is where leadership decides the outcome. The compliance mindset asks the narrowest possible question: what is the cheapest way to tick the box before the deadline? It hires a consultant to produce one report, extracts data by hand, and throws the scaffolding away afterwards, only to rebuild it next year. The asset mindset asks a different question: since we must build this anyway, how do we build it once, properly, so it keeps paying us back? It invests in infrastructure that produces the report as a by-product and serves the business every other day of the year. The first mindset treats the money as pure cost. The second earns a return on the same spend.

One foundation, many uses

The convergence from the previous lesson is what makes the asset mindset so powerful. A single governed-data foundation does not serve one purpose; it serves many. It produces the CSRD report, supplies the evidence NIS2 and DORA demand, feeds the documentation the AI Act requires, and, crucially, gives management trustworthy figures to steer by. The same investment answers the regulator and sharpens the strategy. That is the through-line of this whole module: the regulations are turning sustainability data into infrastructure, and infrastructure, unlike a report, keeps working long after the deadline has passed.

The choice in front of every leader

Every organisation in scope will spend money on this. The only real decision is whether that money buys a disposable compliance exercise or a durable asset. The regulation has already made the investment unavoidable. Wisdom is making it pay for itself, treating the mandate not as a tax to minimise but as the occasion to build the data foundation the business will run on for the next decade.