Regulation, Reporting & Disclosure Frameworks

For most of the data-center industry's history, efficiency and carbon numbers were marketing artifacts: a PUE on a slide, a renewable-energy press release, a sustainability PDF nobody audited. That era has ended. Across the EU, the UK, parts of Asia-Pacific, and a growing patchwork of US states, the same numbers are now legally mandated, methodologically prescribed, externally assured, and in some cases publicly ranked. The consequence is structural: a metric you cannot measure to an auditor's satisfaction is no longer a missed opportunity — it is a finding, a qualified opinion, or a withheld permit. Reporting has moved upstream into the design decision.

The landscape, current to 2026, runs from the hardest and most data-center-specific obligation — EU EED Article 12 and its rating scheme — up through the corporate disclosure frameworks (CSRD/ESRS, ISSB, the stayed SEC rule now proposed for rescission), down to the standards backbone that makes any of it measurable (ISO/IEC 30134, EN 50600, ASHRAE, GHG Protocol), and across to the US and other-region patchwork — ending with the operational question that ties it together: how to build a single, audit-ready reporting program that survives assurance instead of a stack of parallel spreadsheets that drift apart. Which framework you fall under is a function of where you sit and how big you are, and the cost of discovering that late is paid in retrofit instrumentation and restated numbers.

Two fundamentally different reporting regimes apply to the same building, and conflating them is the most common program-design error. The facility-KPI layer asks operational efficiency questions about a specific data center: what is its PUE, WUE, ERF, REF; how much energy and water did this site consume; what is its installed IT capacity. This is the EED Article 12 layer, the ISO/IEC 30134 layer, the EN 50600 layer — narrow, physical, per-site, and densely prescribed. The corporate-inventory layer asks enterprise-wide climate and ESG questions of a reporting entity: what are your Scope 1/2/3 greenhouse-gas emissions, your transition risks, your double-materiality impacts. This is the CSRD/ESRS, ISSB, and SEC layer — broad, financial, consolidated at the group, and concerned with the whole business, of which the data centers are one line item.

The distinction matters because the two layers have different boundaries, different metrics, different audiences, and different audit regimes — yet they must reconcile. Your EED-reported site energy must roll up consistently into your CSRD Scope 2 inventory; your per-site WUE must be defensible inside the group's water-impact disclosure. Operators who instrument for one and bolt on the other discover at audit time that the numbers do not tie out: the EED boundary includes the cooling plant but the energy bill the finance team used for Scope 2 was metered at a different point, and now there are two irreconcilable consumption figures for the same hall. Design one measurement spine whose boundaries are defined once and feed both layers. → metric definitions in Chapter 15.1; carbon accounting mechanics in Chapter 15.3.

The recast Energy Efficiency Directive (EU) 2023/1791, operationalized for data centers by Delegated Regulation (EU) 2024/1364, is the world's first horizontal, mandatory, data-center-specific reporting regime — and it is the one that bites hardest because its metrics are exactly the facility KPIs an engineer already lives by. Any data center with an installed IT power demand of ≥500 kW operating in the EU must report to a central European database. The threshold is low by AI standards: a single modern training hall, a mid-size colocation suite, even a large enterprise room clears it. The reporting set runs to roughly 31 data points per site — energy consumption, IT power, floor area, waste-heat utilization, water use, and the core KPI quartet: PUE, WUE, ERF (energy reuse factor), and REF (renewable energy factor).

The cadence is already running. The first report (for FY2023) was due 15 September 2024; from 2025 onward, reports covering the preceding calendar year are due 15 May annually. The Commission published its first analysis of the 2024 submissions in July 2025 — meaning the dataset exists, is being studied, and is the empirical basis for the next, sharper step. Because Delegated Regulation 2024/1364 is explicitly framed as the first step toward a common Union sustainability rating scheme — electronic labels and, eventually, minimum performance standards keyed to the collected KPIs — the reporting obligation is not the endpoint. It is the data-collection phase before the regulator sets a floor: today's voluntary number becomes tomorrow's pass/fail line.

The engineering consequence is concrete and frequently underestimated. EED-grade KPIs demand sub-metering at boundaries most facilities were never instrumented for. A defensible ERF needs metered, separately-accounted waste-heat export; a defensible REF needs auditable renewable-energy attribution at the site; a defensible WUE needs metered makeup water at the cooling plant, not an estimate from the utility bill. Retrofitting that metering into an energized hall is disruptive and expensive — which is why the EED threshold belongs on the design-basis sheet, not the compliance team's later to-do list. → KPI engineering in Chapter 15.1; waste-heat/ERF mechanics in Chapter 15.5.

Above the facility layer sit the corporate disclosure frameworks, and 2025–2026 has been the most turbulent two-year window this space has ever seen — which is a planning fact in its own right. The three reference regimes pull in different directions, and their stability differs as much as their content.

EU CSRD / ESRS is the most demanding and the most distinctive. It mandates double materiality — you report both how climate affects your business (financial materiality) and how your business affects the climate and environment (impact materiality) — across the full ESRS standard set, with limited assurance required from the outset and reasonable assurance on the roadmap. For data-center operators this means full Scope 1/2/3 inventories, energy mix, water, and transition-plan disclosure, externally checked. But CSRD's scope is now a moving target: the Omnibus I package (Directive (EU) 2026/470, published in the Official Journal on 26 February 2026) sharply narrowed who must report — the final thresholds require >1,000 employees and >€450M net turnover, both exceeded — and the "stop-the-clock" directive (Directive (EU) 2025/794) postponed reporting for later waves by two years. The Commission adopted revised ESRS on 3 July 2026, but its official notice says they will apply only after publication in the Official Journal; verify that publication before treating the revision as legally operative. The net: CSRD is durable in direction but volatile in scope and timing — engineer the measurement capability, but verify your specific entity's in-scope status against the current Omnibus thresholds rather than a 2024 assumption.

ISSB (IFRS S1/S2) is the emerging global baseline. Rather than a single mandate, it is a standard being adopted, endorsed, or aligned-to jurisdiction by jurisdiction — Australia, Brazil, Mexico, the UK, and many others are at various stages of making it law. IFRS S2's climate disclosures (governance, strategy, risk, metrics including Scope 1/2/3 and, where material, internal carbon pricing) are the convergence point most multinationals are standardizing on, precisely because building once to ISSB lets you map into many national regimes. The ISSB has been actively simplifying — amending S2 in 2025 to reduce GHG-disclosure complexity — signaling a pragmatic, not maximalist, trajectory.

US SEC climate rule shows how fast a federal mandate can collapse. Adopted March 2024, never implemented, abandoned in litigation, and on 29 May 2026 formally proposed for full rescission (comment period to 3 August 2026). For US-listed data-center operators, the 2024 rule remains stayed and the May 2026 full-rescission proposal remains pending after the 3 August comment close; no final Commission action had occurred as of 24 August 2026. That uncertainty increases the practical importance of state regimes without erasing the pending federal rulemaking. The lesson for program design: do not build to the most politically contingent framework; build to the durable measurement substrate (a clean GHG inventory, audit-grade KPIs) that satisfies whichever framework survives.

None of the frameworks above are self-defining. "Report your PUE" only means something because a standard fixes the measurement boundary, the averaging window, and the inclusion rules — otherwise every operator reports a flattering number computed a different way, and nothing is comparable or auditable. The standards backbone is what makes the regulatory layer enforceable, and it is where the engineer's reporting responsibility actually lives.

ISO/IEC 30134 is the KPI definition series: PUE, REF, ERF, ITEE, ITEU, and CER are each pinned to a numbered part with a prescribed boundary and measurement category (e.g. PUE categories 1–3 by metering granularity and averaging window). When the EED says "report PUE," it means the ISO/IEC 30134 definition, not your marketing PUE. EN 50600 / ISO/IEC 22237 is the full-facility standard family that defines the boundaries those KPIs are measured across — what counts as IT load, what counts as facility overhead, where the meter sits — and layers Availability and Protection classes on top. ASHRAE TC 9.9 supplies the thermal and liquid-cooling envelope (the A1–A4 air classes, the W17–W45 liquid classes) that underpins efficiency claims and the setpoint decisions that move PUE. And the GHG Protocol (Corporate Standard plus the Scope 2 Guidance) defines how site energy becomes a carbon number — the layer where the facility KPIs meet the corporate inventory.

Adopt the standard's boundary definitions as your single source of truth, or accept that your numbers will not survive assurance. An auditor checking an EED submission or a CSRD inventory is checking it against ISO/IEC 30134 and GHG Protocol methodology. If your internal dashboards compute PUE category-3 (advanced — metered at the IT-equipment input) but your reported number was a category-1 basic figure measured at the UPS output, that is a finding. The fix is architectural, not clerical: define boundaries once against the standards, instrument to that boundary, and let every framework draw from the same measured values. → the post-PUE metric stack and its definitions in Chapter 15.1; standards cross-reference in Appendix A.

For a data center, Scope 2 — purchased electricity — is overwhelmingly the largest emissions line, and the single methodological choice that governs it is in active revision, which makes it the most consequential carbon-accounting decision an operator faces. Under today's GHG Protocol Scope 2 Guidance, operators may report a market-based figure that credits annual renewable-energy contracts and unbundled RECs/GOs against total consumption — the mechanism by which a heavily fossil-grid-powered facility can report a low or zero Scope 2 number on the strength of annual certificate matching. The first revision consultation proposed hourly matching and deliverability (geographic) criteria, while retaining dual reporting; feedback was published in July 2026 and a complete revised standard is planned for 2027. Those proposals are not the current standard.

The consequence is larger than any procurement deal. A facility comfortably reporting ~zero market-based Scope 2 on annual matching can see its reported emissions rise sharply under hourly matching, because annual RECs do not cover the night-time and low-wind hours when the grid is dirtiest and the data center still draws full power. This is precisely the gap that 24/7 carbon-free-energy (CFE) programs target — Google's CFE Score methodology and its 100%-by-2030 goal exist because the operator already concluded that annual matching would not survive the methodological shift. The strategic read for any operator: the way you procure clean power and the way you will be required to account for it are converging, and an annual-REC strategy that looks fully decarbonized today may report materially worse tomorrow without a single physical change to the facility. Build the hourly-resolution energy and emissions data now, because the consultation proposals already show the measurement resolution the final standard may require. → 24/7 CFE and clean-power procurement mechanics in Chapter 15.3.

With the SEC rule stayed since 2024 and now proposed for full rescission, the US mandatory-disclosure burden has migrated to a state patchwork, and California leads it. SB 253 requires companies doing business in California with >$1B in revenue to disclose Scope 1/2 (CARB's revised proposal sets 10 November 2026 for first Scope 1/2 reports, pending final OAL action) and Scope 3 from 2027; SB 261 requires >$500M-revenue companies to publish a climate-related financial-risk report aligned to TCFD/ISSB. The trigger is doing business in the state, not domicile — so a data-center operator with national customers is captured by California regardless of where its halls sit. Both laws are under legal challenge (SB 261's deadline is currently enjoined), making the US a study in volatility: the federal rule is stayed with rescission still proposed, the state mandates are real but contested, and a patchwork of further state data-center bills (energy, water, and tax-linked reporting) is proliferating. Operators must track a moving map here rather than design against a settled rule. The map moved again in Aug 2026: the SEC's comment window on full rescission of the 2024 climate rule closed 2026-08-03 with no final rule (a Commission vote is not scheduled; the rule stays stayed), and the US escalated CSRD/CSDDD into a trade fight — the White House said it would take 'any actions necessary' to shield US companies from 'unreasonable' EU sustainability-reporting rules, making the extra-territorial reach of CSRD a bilateral negotiation rather than only an EU legislative question. And a new state-level regime now captures data-center operators directly: Pennsylvania's Executive Order 2026-05 (Aug 2026) makes incremental-energy matching, a clean-firm ramp, water reporting, and a 'not critical load' curtailment status a permit condition for halls above 25 MW (Chapter 15.8).

Beyond the US and EU, the convergence point is ISSB. The UK, Australia, Brazil, Mexico, Singapore, Japan, and others are adopting or aligning to IFRS S1/S2 on their own timelines, which is why a multinational operator's cleanest strategy is to build its corporate inventory to the ISSB baseline and map down into each national regime, rather than maintaining a different inventory per country. The facility-KPI layer is also globalizing: ISO/IEC 30134 and EN 50600 are international standards, so the EED's PUE/WUE/ERF/REF quartet is becoming the de-facto worldwide vocabulary for site efficiency even where reporting is not yet mandatory — Singapore's Green Mark and tropical-PUE standards, and various national efficiency codes, draw on the same backbone. The practical implication: the metrics you instrument for the EU are largely the metrics every regime will eventually ask for, so building to the strictest current regime is also the lowest-total-cost global strategy.

The synthesis of everything above is operational: how do you build one program that satisfies the facility layer, the corporate layer, and external assurance without maintaining drifting parallel datasets? The answer is a single measurement spine with defined data lineage, designed against the standards and instrumented at scoping time. Four pillars carry it.

• Boundaries defined once, against the standards. Fix what is IT load, what is facility overhead, where each meter sits, and what calendar window you average over — using ISO/IEC 30134 and EN 50600 definitions — and never let two reports compute the same quantity two ways. This is the most common cause of failed assurance.
• Instrumentation to the boundary, at design time. Sub-meter for category-3 PUE (IT-equipment-input metering), metered makeup water for WUE, separately-accounted heat export for ERF, and source-tagged energy for REF. Retrofitting metering into a live hall is the expensive failure mode; provisioning it at scoping is cheap. The EED threshold and the sub-metering plan belong on the design-basis document.
• Hourly-resolution energy and emissions data. Capture interval (ideally hourly) consumption with grid-region emissions factors now, so the migration from annual to hourly Scope 2 matching is a query, not a re-instrumentation project. The methodology that demands it is already drafted.
• Audit-grade data lineage and controls. Every reported number must trace from a calibrated meter through a documented calculation to the disclosure, with the controls an assurance provider will test (calibration records, estimation methodology for any gaps, sign-off). Limited assurance is here under CSRD; reasonable assurance is on the roadmap, and reasonable assurance tests the controls, not just the totals.

Getting this right buys leverage beyond compliance. A single audited spine feeds the EED submission, the CSRD/ISSB inventory, the California filing, the customer ESG questionnaire, the green-financing covenant, and the permitting narrative from one source of truth — and it does so under the assurance regime that lenders and regulators increasingly require. The penalty for getting it wrong is the inverse: restated numbers, qualified opinions, financing friction, and — as the EED rating scheme matures into minimum performance standards — a measured deficiency that becomes a pass/fail line. Reporting is now part of the asset's license to operate. → efficiency-metric engineering in Chapter 15.1; the energy/setpoint levers those metrics measure in Chapter 15.2.