CSRD is coming for software teams. Here is what you need to report.

The EU Corporate Sustainability Reporting Directive (CSRD) came into force for large EU companies in 2024. If your company has more than 250 employees or €40M in revenue, you are likely in scope.

What CSRD requires

CSRD requires disclosure under ESRS E1, covering E1-6 (Gross Scopes 1, 2, and 3 GHG emissions) and E1-5 (Energy consumption). Scope 3 includes your value chain emissions , and auditors are increasingly asking about cloud compute and CI/CD as Category 3.3 (Upstream energy-related activities).

Why CI/CD is Scope 3

Your CI pipelines run on Azure, AWS, or GCP datacenters. That compute is Scope 3, Category 3.3 , upstream energy-related activities from purchased services. The GHG Protocol SCI spec formalises this. The Green Software Foundation SCI v1.0 is already referenced in draft ESRS E1 guidance.

What auditors will ask for

Based on conversations with KPMG and Deloitte sustainability practices: methodology documentation (how did you estimate CI emissions, what assumptions), year-over-year comparison (are emissions going up or down and why), audit trail (can the numbers be independently verified, is there a hash or signature), and materiality assessment (how significant is CI vs. other Scope 3 categories).

What EmitCI generates

EmitCI's ESG Report produces a PDF mapped to ESRS E1-6, SHA-256 integrity-verified for tamper-evidence, with year-over-year comparison and full methodology documentation. It is designed to hand directly to your ESG auditor.

Getting started

Measure your current baseline, set an org-level reduction goal, generate your first ESG report, and share the methodology with your auditors before they ask. The companies that will struggle with CSRD are the ones who wait until Q4 to reconstruct 12 months of data from memory.