Regulation, Reporting & Disclosure Frameworks

For most of the data-center industry's history, efficiency and carbon numbers were marketing artifacts: a PUE on a slide, a renewable-energy press release, a sustainability PDF nobody audited. That era has ended. Across the EU, the UK, parts of Asia-Pacific and a growing patchwork of US states, the same numbers are now legally mandated, methodologically prescribed, externally assured, and in some cases publicly ranked. A metric you cannot measure to an auditor's satisfaction is no longer a missed opportunity. It is a finding, a qualified opinion or a withheld permit, so reporting has moved upstream into the design decision.

The regime map, current to 2026, runs from the hardest and most data-center-specific obligation, EU EED Article 12 and its rating scheme, up through the corporate disclosure frameworks (CSRD/ESRS, ISSB, the stayed SEC rule now proposed for rescission). Below those sits the standards backbone that makes any of it measurable (ISO/IEC 30134, EN 50600, ASHRAE, GHG Protocol), and beside them the US and other-region patchwork. The chapter ends on the operational question: how to build one audit-ready reporting program that survives assurance, instead of parallel spreadsheets that drift apart. Which framework you fall under depends on where you sit and how big you are.

Two different reporting regimes apply to the same building, and conflating them is the most common program-design error. The facility-KPI layer asks operational questions about one data center: its PUE, WUE, ERF and REF, how much energy and water the site consumed, and its installed IT capacity. This is the EED Article 12 layer, the ISO/IEC 30134 layer and the EN 50600 layer: narrow, physical, per-site and densely prescribed. The corporate-inventory layer asks enterprise-wide climate and ESG questions of a reporting entity: your Scope 1/2/3 greenhouse-gas emissions, transition risks and double-materiality impacts. This is the CSRD/ESRS, ISSB and SEC layer: broad, financial, consolidated at group level, and concerned with the whole business, of which the data centers are one line item.

The layers have different boundaries, metrics, audiences and audit regimes, yet they must reconcile. Your EED-reported site energy must roll up consistently into your CSRD Scope 2 inventory, and your per-site WUE must hold up inside the group's water-impact disclosure. Operators who instrument for one layer and bolt on the other find at audit time that the numbers do not tie out. The EED boundary includes the cooling plant, but the energy bill finance used for Scope 2 was metered somewhere else, so the same hall has two irreconcilable consumption figures. Design one measurement spine whose boundaries are defined once and feed both layers. → metric definitions in Chapter 15.1; carbon accounting mechanics in Chapter 15.3.

The recast Energy Efficiency Directive (EU) 2023/1791, applied to data centers by Delegated Regulation (EU) 2024/1364, is the world's first horizontal, mandatory, data-center-specific reporting regime. It bites hardest because its metrics are the facility KPIs an engineer already lives by. Any data center in the EU with an installed IT power demand of ≥500 kW must report to a central European database. By AI standards the threshold is low: a single modern training hall, a mid-size colocation suite or even a large enterprise room clears it. The reporting set runs to roughly 31 data points per site: energy consumption, IT power, floor area, waste-heat utilization, water use, and the core KPI quartet of PUE, WUE, ERF (energy reuse factor) and REF (renewable energy factor).

The cadence is already running. The first report (for FY2023) was due 15 September 2024; from 2025 onward, reports covering the preceding calendar year are due 15 May annually. In July 2025 the Commission published its first analysis, of the 2024 reporting round (2023 data). The dataset exists and is being studied.

Delegated Regulation 2024/1364 was the opening move toward a common Union rating scheme. The Commission adopted the scheme on 21 September 2026, and it now sits in Parliament and Council scrutiny, extended into January 2027. If neither objects, every reporting site gets a public electronic label: an A-to-G grade for PUE and for WUE, plus a flag for whether the site is ready for waste-heat reuse. The database would build the label from the site's own submission by 15 August 2027, then every year after. Sites below 500 kW could opt in. The same day, the Commission launched a consultation on minimum performance standards. It closes 14 December 2026, and a legislative proposal is planned for Q2 2027. If the scheme clears scrutiny, the number you report today becomes a public grade in 2027, and the same data would support a later pass/fail line.

The engineering consequence is concrete and often underestimated. EED-grade KPIs need sub-metering at boundaries most facilities were never instrumented for. A defensible ERF needs metered, separately accounted waste-heat export. A defensible REF needs auditable renewable-energy attribution at the site. A defensible WUE needs the prescribed record of total water input at the data-center boundary, measured to EN 50600-4-9 WUE Category 2: every volume used for environmental, power, security and IT functions, not just cooling-plant makeup and not an estimate from the utility bill. The rating act (C(2026) 3472), if it clears scrutiny, would move the graded WUE to freshwater input and the measurement method to Category 1. Retrofitting that metering into an energized hall is disruptive and expensive, so the EED threshold belongs on the design-basis sheet, not the compliance team's later to-do list. → KPI engineering in Chapter 15.1; waste-heat/ERF mechanics in Chapter 15.5.

Run the applicability test twice. Germany's EnEfG § 3(24) uses at least 300 kW of non-redundant nominal electrical connection capacity across the defined data-center boundary. The EED's 500 kW threshold uses installed IT power. Do not substitute one denominator for the other. The pending bill would change the German test to ≥500 kW installed IT power, so keep both calculations on file until it is decided. Record the boundary drawing, rated loads, commissioning cohort and legal entity before assigning the § 11 duties (Act of 13 November 2023). For the reuse exception, retain the offer, its date and the evidence § 11(3) requires, including heat-transfer infrastructure held ready where that route applies; a network's silence is not permission to dismantle it. The heat-pump electricity exclusion is limited to plant used solely to upgrade waste heat. Mixed-purpose plant needs a documented allocation.

The reporting record starts at the meter. Assign each KPI an owner, boundary, time interval, unit, meter identifier, calibration record and retained raw reading. Reconcile tenant IT meters to the hall total, then reconcile shared cooling and power services to the facility import and export meters.

Public registers show how filings go wrong. In September 2026 Germany's Environment Agency checked the 319 records in the national register, which omits many large operators. About 12% put IT connection capacity at or above the site total, and about 4% reported exporting more heat than the electricity they used. Screen every record before filing: reject it if IT capacity exceeds total capacity, if exported heat exceeds energy input, or if PUE comes out below 1.0. Keep reserved connection capacity separate from measured load, because those records used only about 35% of their connection capacity on average.

A missing tenant feed stays a quantified data gap with its estimation method, owner and closure date; it must never silently become zero consumption. Keep the filed annual record immutable and version any correction with the reason and approver. Corporate consolidation can allocate the same site energy differently from the facility filing. The bridge between the two totals must show the allocation, not force them to match by overwriting a meter. → definitions in Chapter 15.1, inventory ownership in Chapter 15.3.

France uses a separate national test. L236-2, effective 1 October 2025, reaches installed power of at least 1 MW. The December 2025 implementing decree takes the SIRET establishment as the unit and sets ERF ≥0.20. A ministerial order may raise the floor to 0.40, but 0.20 is the minimum that applies today. Where the transition provision applies, an establishment whose building-permit application was filed before 1 January 2026 must transmit the required analysis by 1 October 2027. A technical-economic exception needs that analysis, and any feasible partial recovery still matters. Price the accepted heat in Chapter 15.5; a national threshold does not create a buyer.

Above the facility layer sit the corporate disclosure frameworks, and 2025–2026 has been the most turbulent two-year window this space has seen, which is a planning fact in its own right. The three reference regimes pull in different directions, and their stability differs as much as their content.

EU CSRD / ESRS is the most demanding and the most distinctive. It mandates double materiality: you report both how climate affects your business (financial materiality) and how your business affects the climate and environment (impact materiality), across the full ESRS standard set. Limited assurance is required, but the escalation to reasonable assurance is no longer in the law. Directive (EU) 2026/470 replaced Article 26a(3) of Directive 2006/43/EC, removing the Commission's mandate to adopt reasonable-assurance standards and moving the limited-assurance standards themselves to 1 July 2027. For data-center operators this means full Scope 1/2/3 inventories, energy mix, water and transition-plan disclosure, externally checked.

CSRD's scope is now a moving target. The Omnibus I package (Directive (EU) 2026/470, published in the Official Journal on 26 February 2026) sharply narrowed who must report: the final thresholds require >1,000 employees and >€450M net turnover, and you must exceed both. The "stop-the-clock" directive (Directive (EU) 2025/794) postponed reporting for later waves by two years. The Commission adopted revised ESRS on 3 July 2026. They cleared Parliament and Council scrutiny, and the Official Journal published them on 21 September 2026: Delegated Regulation (EU) 2026/1563, an amendment to 2023/2772. The revision takes effect on 10 November 2026 and is mandatory for financial years starting on or after 1 January 2027. A company whose 2026 financial year is already running may stay on the 2023 standards, add the new reliefs, or adopt the revision fully; it must say which it chose. The net: CSRD is durable in direction but volatile in scope and timing. Engineer the measurement capability, but check your own entity's in-scope status against the current Omnibus thresholds, not a 2024 assumption.

ISSB (IFRS S1/S2) is the emerging global baseline. It is not a single mandate but a standard that jurisdictions adopt, endorse or align to one by one; Australia, Brazil, Mexico, the UK and many others are at various stages of making it law. IFRS S2's climate disclosures cover governance, strategy, risk and metrics, including Scope 1/2/3 and, where material, internal carbon pricing. They are the convergence point most multinationals are standardizing on, because building once to ISSB lets you map into many national regimes. The ISSB has also been simplifying, amending S2 in 2025 to reduce GHG-disclosure complexity, which points to a pragmatic rather than maximalist trajectory.

The US SEC climate rule shows how fast a federal mandate can collapse. It was adopted in March 2024, never implemented, abandoned in litigation, and on 29 May 2026 formally proposed for full rescission (comment period to 3 August 2026). The 2024 rule remains stayed, and as of mid-October 2026 the SEC had taken no final action on the rescission, so for US-listed data-center operators the state regimes now carry the practical weight. The lesson for program design: do not build to the most politically contingent framework. Build to the durable measurement substrate (a clean GHG inventory, audit-grade KPIs) that satisfies whichever framework survives.

None of the frameworks above defines itself. "Report your PUE" means something only because a standard fixes the measurement boundary, the averaging window and the inclusion rules. Without that, every operator reports a flattering number computed a different way, and nothing is comparable or auditable. The standards backbone makes the regulatory layer enforceable, and it is where the engineer's reporting responsibility lives.

ISO/IEC 30134 is the KPI definition series. PUE, REF, ITEEsv, ITEUsv, ERF, CER, CUE and WUE are each pinned to a numbered part with a prescribed boundary and measurement category (PUE categories 1–3, for example, by metering granularity and averaging window). When the EED says "report PUE," its delegated regulation specifies the EN measurement methodology and Annex definitions, and an ISO/IEC 30134 revision does not silently amend that filing method. EN 50600 / ISO/IEC 22237 is the full-facility standard family that defines the boundaries those KPIs are measured across: what counts as IT load, what counts as facility overhead, where the meter sits. It layers Availability and Protection classes on top. ASHRAE TC 9.9 supplies the thermal and liquid-cooling operating ranges (the A1–A4 air classes and the W17, W27, W32, W40, W45 and W+ liquid classes) that underpin efficiency claims and the setpoint decisions that move PUE. The GHG Protocol (Corporate Standard plus the Scope 2 Guidance) defines how site energy becomes a carbon number, the layer where the facility KPIs meet the corporate inventory.

Adopt the standard's boundary definitions as your single source of truth, or accept that your numbers will not survive assurance. An auditor checking an EED submission or a CSRD inventory checks it against ISO/IEC 30134 and GHG Protocol methodology. Suppose your internal dashboards compute category-3 PUE (advanced, metered at the IT-equipment input) but the reported number was a category-1 basic figure measured at the UPS output. Disclosed and reconciled, the difference is acceptable. It becomes an audit finding when the filing or a contract required a different category, or when the description misstates where the meter sits. The fix is architectural, not clerical: define boundaries once against the standards, instrument to that boundary, and let every framework draw from the same measured values. → the post-PUE metric stack and its definitions in Chapter 15.1; standards cross-reference in Appendix A.

For a data center on a carbon-intensive grid, Scope 2 (purchased electricity, steam, heat and cooling) can dominate the operational emissions inventory. The methodological choice that governs it is in active revision, which makes it the most consequential carbon-accounting decision an operator faces. Today's GHG Protocol Scope 2 Guidance requires dual reporting wherever contractual instruments are available: a location-based figure from grid-average emissions, and a market-based figure built from renewable-energy contracts and unbundled RECs/GOs that meet its quality criteria. The market-based figure is how a facility powered mostly by a fossil grid can report a low or zero Scope 2 number on the strength of annual certificate matching. The first revision consultation proposed hourly matching and deliverability (geographic) criteria while retaining dual reporting. The 29 July 2026 process update targets publication of the consolidated GHG Protocol–ISO corporate standard in Q4 2028. Those proposals are not the current standard.

The revision is also moving toward separate statements. The GHG Protocol's 23 September 2026 summary of its Actions and Market Instruments request for information (open 31 March–15 June 2026) covered more than 400 respondents, 84% of whom backed a multi-statement structure. Beside the physical inventory, 87% backed a market-based statement for contracts and certificates, and 80% a GHG Impact statement for what an action such as an additional PPA actually changes. A non-GHG indicators statement drew only 33%. If adopted, buying a certificate and claiming an emissions impact would be reported and evidenced as separate things. The draft is due out for consultation in Q2 2027.

The consequence is larger than any procurement deal. A facility that comfortably reports near-zero market-based Scope 2 on annual matching can see its reported emissions rise sharply under hourly matching, because annual RECs do not cover the night-time and low-wind hours when the grid is dirtiest and the data center still draws full power. That is the gap 24/7 carbon-free-energy (CFE) programs target. Google's CFE Score methodology and its 100%-by-2030 goal expose the hourly gaps that annual matching hides, though a company program does not set what the revised standard will require. If an hourly method is adopted, reported emissions can rise with no physical change to the facility, and procurement will have to supply attributes that meet the new criteria. Build hourly-resolution energy and emissions data now, because the consultation proposals already show the measurement resolution the final standard may require. → 24/7 CFE and clean-power procurement mechanics in Chapter 15.3.

With the SEC rule stayed since 2024 and now proposed for full rescission, the US mandatory-disclosure burden has migrated to a state patchwork, and California leads it. SB 253 requires companies doing business in California with >$1B in revenue to disclose Scope 1/2 and, from 2027, Scope 3. The Office of Administrative Law approved CARB's initial regulation on 12 October 2026. Under it, first Scope 1/2 reports are due 10 November 2026, with no assurance required on that first report. SB 261 requires >$500M-revenue companies to publish a climate-related financial-risk report aligned to TCFD/ISSB. The trigger is doing business in the state, not domicile, so a data-center operator with national customers is captured by California wherever its halls sit. Both laws face legal challenge, and SB 261's deadline is currently enjoined. The state mandates are real but contested, and further state data-center bills on energy, water and tax-linked reporting keep arriving, so operators must track a moving map rather than design against a settled rule.

Washington has also turned CSRD's reach into a trade question. In August 2026 the US Mission to the EU filed a comment letter saying the Omnibus still left US concerns about CSRD and CSDDD only partly addressed. Unless a solution was found, it warned, "the United States will take any actions necessary to address unreasonable burdens on U.S. commerce." It asked the EU to limit reporting and due-diligence duties on US businesses and to treat the US as a negligible-risk jurisdiction. For a US group with EU subsidiaries, CSRD scope now turns on US–EU trade talks as well as on EU legislation.

A state regime now reaches data-center operators directly. Pennsylvania's Executive Order 2026-05 (18 August 2026) applies to projects above 25 MW peak demand that file with the state environmental department (DEP) after that date. Such a developer can sign a project-specific GRID Consent Order and Agreement and get rolling DEP review. In return it agrees to serve its load with new or incremental generation located in the project's own PJM Locational Deliverability Area, and to meet clean-firm minimums of 10% from 2027, rising to 14.5% from 2030 and 32% from 2035. It must also report its energy, water and wastewater data. A developer that does not sign must first obtain local approvals and water authorizations, and only then does DEP review begin. On either track, DEP issues no permit until local approvals are in hand (→ Chapter 3.9).

Beyond the US and EU, the convergence point is ISSB. The UK, Australia, Brazil, Mexico, Singapore, Japan and others are adopting or aligning to IFRS S1/S2 on their own timelines. A multinational's cleanest strategy is therefore to build its corporate inventory to the ISSB baseline and map down into each national regime, instead of keeping a different inventory per country. The facility-KPI layer is globalizing too. ISO/IEC 30134 and EN 50600 are international standards, so the EED's PUE/WUE/ERF/REF quartet is becoming the de facto worldwide vocabulary for site efficiency even where reporting is not yet mandatory; Singapore's Green Mark and its tropical-PUE standard, and various national efficiency codes draw on the same backbone. The practical implication: the metrics you instrument for the EU are largely the metrics every regime will eventually ask for, so building to the strictest current regime is also the lowest-total-cost global strategy.

The synthesis of everything above is operational: how do you build one program that satisfies the facility layer, the corporate layer and external assurance without drifting parallel datasets? Use a single measurement spine with defined data lineage, designed against the standards and instrumented at scoping time. Four pillars carry it.

• Boundaries defined once, against the standards. Fix what is IT load, what is facility overhead, where each meter sits and what calendar window you average over, using ISO/IEC 30134 and EN 50600 definitions. Never let two reports compute the same quantity two ways. This is the most common cause of failed assurance.
• Instrumentation to the boundary, at design time. Sub-meter for category-3 PUE (IT-equipment-input metering). Meter total site water input for the prescribed EU WUE boundary, including tower makeup and other site uses. Account separately for heat export (ERF), and tag energy by source (REF). Retrofitting metering into a live hall is the expensive failure mode; provisioning it at scoping is cheap. The EED threshold and the sub-metering plan belong on the design-basis document.
• Hourly-resolution energy and emissions data. Capture interval consumption (ideally hourly) with grid-region emissions factors now, so an adopted move from annual to hourly matching can reuse measured data. Meter data cannot supply what you do not own, though: certificate ownership, deliverability proof and tenant data rights still have to be contracted.
• Audit-grade data lineage and controls. Every reported number must trace from a calibrated meter through a documented calculation to the disclosure, with the controls an assurance provider will test (calibration records, estimation methodology for any gaps, sign-off). Limited assurance applies under CSRD, and Directive (EU) 2026/470 removed the escalation to reasonable assurance. California SB 253 still phases toward it, and any reasonable-assurance engagement tests the controls rather than just the totals, so build the controls regardless.

Getting this right buys leverage beyond compliance. A single audited spine feeds the EED submission, the CSRD/ISSB inventory, the California filing, the customer ESG questionnaire, the green-financing covenant and the permitting narrative from one source of truth, under the assurance regime that lenders and regulators increasingly require. Getting it wrong costs the reverse: restated numbers, qualified opinions and financing friction. And as the EED rating scheme grows into minimum performance standards (a legislative proposal is planned for Q2 2027), a measured deficiency becomes a pass/fail line. Reporting is now part of the asset's license to operate. → efficiency-metric engineering in Chapter 15.1; the energy/setpoint levers those metrics measure in Chapter 15.2.