Regulation, Reporting & Disclosure Frameworks

For most of the data-center industry's history, efficiency and carbon numbers were marketing artifacts: a PUE on a slide, a renewable-energy press release, a sustainability PDF nobody audited. That era is over. Across the EU, the UK, parts of Asia-Pacific, and a growing patchwork of US states, the same numbers are now legally mandated, methodologically prescribed, externally assured, and in some cases publicly ranked. The consequence is structural: a metric you cannot measure to an auditor's satisfaction is no longer a missed opportunity — it is a finding, a qualified opinion, or a withheld permit. Reporting has moved upstream into the design decision.

This chapter maps that landscape, current to 2026. We start where the obligation is hardest and most data-center-specific — EU EED Article 12 and its rating scheme — then move up the abstraction stack to the corporate disclosure frameworks (CSRD/ESRS, ISSB, the now-rescinded SEC rule), down to the standards backbone that makes any of it measurable (ISO/IEC 30134, EN 50600, ASHRAE, GHG Protocol), across to the US and other-region patchwork, and finally into the operational question that ties it together: how do you build a single, audit-ready reporting program that survives assurance instead of a stack of parallel spreadsheets that drift apart. The through-line: the framework you fall under is a function of where you sit and how big you are, not what you intend — and the cost of discovering that late is paid in retrofit instrumentation and restated numbers.

The first clarity to impose is that two fundamentally different reporting regimes apply to the same building, and conflating them is the most common program-design error. The facility-KPI layer asks operational efficiency questions about a specific data center: what is its PUE, WUE, ERF, REF; how much energy and water did this site consume; what is its installed IT capacity. This is the EED Article 12 layer, the ISO/IEC 30134 layer, the EN 50600 layer — narrow, physical, per-site, and densely prescribed. The corporate-inventory layer asks enterprise-wide climate and ESG questions of a reporting entity: what are your Scope 1/2/3 greenhouse-gas emissions, your transition risks, your double-materiality impacts. This is the CSRD/ESRS, ISSB, and SEC layer — broad, financial, consolidated at the group, and concerned with the whole business, of which the data centers are one line item.

The fork matters because the two layers have different boundaries, different metrics, different audiences, and different audit regimes — yet they must reconcile. Your EED-reported site energy must roll up consistently into your CSRD Scope 2 inventory; your per-site WUE must be defensible inside the group's water-impact disclosure. Operators who instrument for one and bolt on the other discover at audit time that the numbers do not tie out: the EED boundary includes the cooling plant but the energy bill the finance team used for Scope 2 was metered at a different point, and now there are two irreconcilable consumption figures for the same hall. The discipline is to design one measurement spine whose boundaries are defined once and feed both layers. → metric definitions in Chapter 15.1; carbon accounting mechanics in Chapter 15.3.

The recast Energy Efficiency Directive (EU) 2023/1791, operationalized for data centers by Delegated Regulation (EU) 2024/1364, is the world's first horizontal, mandatory, data-center-specific reporting regime — and it is the one that bites hardest because its metrics are exactly the facility KPIs an engineer already lives by. Any data center with an installed IT power demand of ≥500 kW operating in the EU must report to a central European database. The threshold is low by AI standards: a single modern training hall, a mid-size colocation suite, even a large enterprise room clears it. The reporting set runs to roughly 31 data points per site — energy consumption, IT power, floor area, waste-heat utilization, water use, and the core KPI quartet: PUE, WUE, ERF (energy reuse factor), and REF (renewable energy factor).

The cadence is now established, not theoretical. The first report (for FY2023) was due 15 September 2024; from 2025 onward, reports covering the preceding calendar year are due 15 May annually. The Commission published its first analysis of the 2024 submissions in July 2025 — meaning the dataset exists, is being studied, and is the empirical basis for the next, sharper step. Because Delegated Regulation 2024/1364 is explicitly framed as the first step toward a common Union sustainability rating scheme — electronic labels and, eventually, minimum performance standards keyed to the collected KPIs — the reporting obligation is not the endpoint. It is the data-collection phase before the regulator sets a floor. The strategic read: today's voluntary number is tomorrow's pass/fail line.

The engineering consequence is concrete and frequently underestimated. EED-grade KPIs demand sub-metering at boundaries most facilities were never instrumented for. A defensible ERF needs metered, separately-accounted waste-heat export; a defensible REF needs auditable renewable-energy attribution at the site; a defensible WUE needs metered makeup water at the cooling plant, not an estimate from the utility bill. Retrofitting that metering into an energized hall is disruptive and expensive — which is why the EED threshold belongs on the design-basis sheet, not the compliance team's later to-do list. → KPI engineering in Chapter 15.1; waste-heat/ERF mechanics in Chapter 15.5.

Above the facility layer sit the corporate disclosure frameworks, and 2025–2026 has been the most turbulent two-year window this space has ever seen — which is itself a planning fact. The three reference regimes pull in different directions, and their stability differs as much as their content.

EU CSRD / ESRS is the most demanding and the most distinctive. It mandates double materiality — you report both how climate affects your business (financial materiality) and how your business affects the climate and environment (impact materiality) — across the full ESRS standard set, with limited assurance required from the outset and reasonable assurance on the roadmap. For data-center operators this means full Scope 1/2/3 inventories, energy mix, water, and transition-plan disclosure, externally checked. But CSRD's scope is now a moving target: the Omnibus I package, finalized through 2025 and published in the Official Journal on 26 February 2026, sharply narrowed who must report — raising the threshold toward ≥1,000 employees and >€450M turnover — and the "stop-the-clock" directive (EU 2025/7942) postponed reporting for later waves by two years. EFRAG's simplified ESRS, with Commission adoption targeted for mid-2026 and application from FY2027, is in flight. The net: CSRD is durable in direction but volatile in scope and timing — engineer the measurement capability, but verify your specific entity's in-scope status against the current Omnibus thresholds rather than a 2024 assumption.

ISSB (IFRS S1/S2) is the emerging global baseline. Rather than a single mandate, it is a standard being adopted, endorsed, or aligned-to jurisdiction by jurisdiction — Australia, Brazil, Mexico, the UK, and many others are at various stages of making it law. IFRS S2's climate disclosures (governance, strategy, risk, metrics including Scope 1/2/3 and, where material, internal carbon pricing) are the convergence point most multinationals are standardizing on, precisely because building once to ISSB lets you map into many national regimes. The ISSB has been actively simplifying — amending S2 in 2025 to reduce GHG-disclosure complexity — signaling a pragmatic, not maximalist, trajectory.

US SEC climate rule is the cautionary tale. Adopted March 2024, never implemented, abandoned in litigation, and on 29 May 2026 formally proposed for full rescission (comment period to 3 August 2026). For US-listed data-center operators, the federal climate-disclosure mandate is effectively a dead letter as of 2026 — which paradoxically pushes the binding US obligation down to the state level, where California's rules now do the work the SEC rule was meant to. The lesson for program design: do not build to the most politically contingent framework; build to the durable measurement substrate (a clean GHG inventory, audit-grade KPIs) that satisfies whichever framework survives.

None of the frameworks above are self-defining. "Report your PUE" only means something because a standard fixes the measurement boundary, the averaging window, and the inclusion rules — otherwise every operator reports a flattering number computed a different way, and nothing is comparable or auditable. The standards backbone is what makes the regulatory layer enforceable, and it is where the engineer's reporting responsibility actually lives.

ISO/IEC 30134 is the KPI definition series: PUE, REF, ERF, ITEE, ITEU, and CER are each pinned to a numbered part with a prescribed boundary and measurement category (e.g. PUE categories 1–3 by metering granularity and averaging window). When the EED says "report PUE," it means the ISO/IEC 30134 definition, not your marketing PUE. EN 50600 / ISO/IEC 22237 is the full-facility standard family that defines the boundaries those KPIs are measured across — what counts as IT load, what counts as facility overhead, where the meter sits — and layers Availability and Protection classes on top. ASHRAE TC 9.9 supplies the thermal and liquid-cooling envelope (the A1–A4 air classes, the W17–W45 liquid classes) that underpins efficiency claims and the setpoint decisions that move PUE. And the GHG Protocol (Corporate Standard plus the Scope 2 Guidance) defines how site energy becomes a carbon number — the layer where the facility KPIs meet the corporate inventory.

The choice is decisive: adopt the standard's boundary definitions as your single source of truth, or accept that your numbers will not survive assurance. An auditor checking an EED submission or a CSRD inventory is checking it against ISO/IEC 30134 and GHG Protocol methodology. If your internal dashboards compute PUE category-1 (annualized, fully sub-metered) but your reported number was a category-3 spot estimate, that is a finding. The fix is architectural, not clerical: define boundaries once against the standards, instrument to that boundary, and let every framework draw from the same measured values. → the post-PUE metric stack and its definitions in Chapter 15.1; standards cross-reference in Appendix A.

For a data center, Scope 2 — purchased electricity — is overwhelmingly the largest emissions line, and the single methodological choice that governs it is in active revision, which makes it the most consequential carbon-accounting decision an operator faces. Under today's GHG Protocol Scope 2 Guidance, operators may report a market-based figure that credits annual renewable-energy contracts and unbundled RECs/GOs against total consumption — the mechanism by which a heavily fossil-grid-powered facility can report a low or zero Scope 2 number on the strength of annual certificate matching. The revised standard the GHG Protocol is steering toward (expected to finalize around 2027) moves decisively toward hourly and deliverability (geographic) matching: a renewable credit only offsets consumption that occurred in the same hour and the same deliverable grid region.

The consequence is larger than any procurement deal. A facility comfortably reporting ~zero market-based Scope 2 on annual matching can see its reported emissions rise sharply under hourly matching, because annual RECs do not cover the night-time and low-wind hours when the grid is dirtiest and the data center still draws full power. This is precisely the gap that 24/7 carbon-free-energy (CFE) programs target — Google's CFE Score methodology and its 100%-by-2030 goal exist because the operator already concluded that annual matching would not survive the methodological shift. The strategic read for any operator: the way you procure clean power and the way you will be required to account for it are converging, and an annual-REC strategy that looks fully decarbonized today may report materially worse tomorrow without a single physical change to the facility. Build the hourly-resolution energy and emissions data now, because the methodology that will demand it is already drafted. → 24/7 CFE and clean-power procurement mechanics in Chapter 15.3.

With the SEC rule rescinded, the US mandatory-disclosure burden has migrated to a state patchwork, and California leads it. SB 253 requires companies doing business in California with >$1B in revenue to disclose Scope 1/2 (first reports now due 10 November 2026 after CARB's postponement) and Scope 3 from 2027; SB 261 requires >$500M-revenue companies to publish a climate-related financial-risk report aligned to TCFD/ISSB. The trigger is doing business in the state, not domicile — so a data-center operator with national customers is captured by California regardless of where its halls sit. Both laws are under legal challenge (SB 261's deadline is currently enjoined), making the US a study in volatility: the federal mandate is gone, the state mandates are real but contested, and a patchwork of further state data-center bills (energy, water, and tax-linked reporting) is proliferating. The operator's job is to track a moving map, not a settled rule.

Beyond the US and EU, the convergence point is ISSB. The UK, Australia, Brazil, Mexico, Singapore, Japan, and others are adopting or aligning to IFRS S1/S2 on their own timelines, which is why a multinational operator's cleanest strategy is to build its corporate inventory to the ISSB baseline and map down into each national regime, rather than maintaining a different inventory per country. The facility-KPI layer is also globalizing: ISO/IEC 30134 and EN 50600 are international standards, so the EED's PUE/WUE/ERF/REF quartet is becoming the de-facto worldwide vocabulary for site efficiency even where reporting is not yet mandatory — Singapore's Green Mark and tropical-PUE standards, and various national efficiency codes, draw on the same backbone. The practical implication: the metrics you instrument for the EU are largely the metrics every regime will eventually ask for, so building to the strictest current regime is also the lowest-total-cost global strategy.

The synthesis of everything above is operational: how do you build one program that satisfies the facility layer, the corporate layer, and external assurance without maintaining drifting parallel datasets? The answer is a single measurement spine with defined data lineage, designed against the standards and instrumented at scoping time. The discipline has four pillars.

• Boundaries defined once, against the standards. Fix what is IT load, what is facility overhead, where each meter sits, and what calendar window you average over — using ISO/IEC 30134 and EN 50600 definitions — and never let two reports compute the same quantity two ways. This is the single most common cause of failed assurance.
• Instrumentation to the boundary, at design time. Sub-meter for category-1 PUE, metered makeup water for WUE, separately-accounted heat export for ERF, and source-tagged energy for REF. Retrofitting metering into a live hall is the expensive failure mode; provisioning it at scoping is cheap. The EED threshold and the sub-metering plan belong on the design-basis document.
• Hourly-resolution energy and emissions data. Capture interval (ideally hourly) consumption with grid-region emissions factors now, so the migration from annual to hourly Scope 2 matching is a query, not a re-instrumentation project. The methodology that demands it is already drafted.
• Audit-grade data lineage and controls. Every reported number must trace from a calibrated meter through a documented calculation to the disclosure, with the controls an assurance provider will test (calibration records, estimation methodology for any gaps, sign-off). Limited assurance is here under CSRD; reasonable assurance is on the roadmap, and reasonable assurance tests the controls, not just the totals.

The reward for getting this right is leverage, not just compliance. A single audited spine feeds the EED submission, the CSRD/ISSB inventory, the California filing, the customer ESG questionnaire, the green-financing covenant, and the permitting narrative from one source of truth — and it does so under the assurance regime that lenders and regulators increasingly require. The penalty for getting it wrong is the inverse: restated numbers, qualified opinions, financing friction, and — as the EED rating scheme matures into minimum performance standards — a measured deficiency that becomes a pass/fail line. Reporting is now part of the asset's license to operate. → efficiency-metric engineering in Chapter 15.1; the energy/setpoint levers those metrics measure in Chapter 15.2.