SaaS companies face a distinct sustainability reporting challenge under CSRD. Unlike manufacturers or energy companies with large physical footprints, most SaaS companies have relatively small Scope 1 and 2 emissions — but potentially significant Scope 3 emissions from cloud infrastructure, hardware in the supply chain, and the energy consumed by customers running their software. Understanding where CSRD focuses sustainability reporting for SaaS businesses is the starting point for an efficient compliance approach.
Does CSRD Apply to SaaS Companies?
Wave 2 threshold test:
- 250 or more employees, and/or
- €40M or more net turnover, and/or
- €20M or more total assets
Meeting two of three criteria makes you a large company subject to Wave 2 (first report due for FY 2025, report published 2026).
Most SaaS companies above €40M ARR and with 250+ staff will be in scope for Wave 2. Fast-growing SaaS companies approaching these thresholds should prepare now — the 20-month transition period to prepare a CSRD-compliant report once you cross the thresholds is tight.
Most Material ESRS Topics for SaaS Companies
ESRS E1 — Climate Change (Almost Always Material)
Why it matters for SaaS: Even "asset-light" SaaS companies have a material climate footprint — it is just different in character from a manufacturer's:
Scope 2 (if you run your own data centres): Direct energy purchase for on-premises infrastructure.
Scope 3 Category 1 (cloud infrastructure): If you run on AWS, Azure, or GCP, the energy consumed by your workloads is a Scope 3 upstream emission. Cloud providers publish carbon footprint tools — use them.
- AWS Customer Carbon Footprint Tool
- Google Cloud Carbon Footprint
- Azure Emissions Impact Dashboard
Scope 3 Category 6 (business travel): For SaaS companies with distributed teams, business travel can be a significant emission source.
Scope 3 Category 11 (use of sold products): The energy consumed by customers running your software is a downstream Scope 3 emission. For data-intensive SaaS products, this can be significant — especially if customers run large data processing workloads on your platform.
Climate transition plan: For ESRS E1 compliance, a SaaS company's transition plan should address:
- Renewable energy procurement for cloud workloads (provider selection, renewable energy matching)
- Travel reduction policy
- Targets for Scope 3 Category 1 and 11 emissions
ESRS S1 — Own Workforce (Always Material)
SaaS companies have workforce-intensive operations. Key disclosures:
- Total headcount by gender and geography
- Voluntary turnover rate
- Health and safety (note: for office-based SaaS, physical H&S incidents are low, but mental health and work-life balance are increasingly expected disclosures)
- Pay equity — gender pay gap reporting
- Training hours per employee
- CEO pay ratio
Remote-first SaaS: Companies with large proportions of remote workers face a specific challenge: employee commuting emissions (Scope 3 Category 7) are near zero, but home office energy use (which some methodologies include) is complex to measure.
ESRS S4 — Consumers and End-Users (Often Material)
For B2B SaaS, this standard covers your customers:
- Product safety and quality — security incidents affecting customer data
- Data privacy — connection to GDPR compliance programme
- Accessibility
The GDPR/data privacy element is significant: ESRS S4 requires disclosure of material data privacy incidents. Companies with established GDPR programmes are well-positioned; this disclosure creates an accountability linkage between the sustainability report and the data protection programme.
ESRS G1 — Business Conduct (Frequently Material)
- Anti-corruption policies
- Payment practices (payment terms to suppliers)
- Political lobbying (if applicable)
The SaaS Sustainability Reporting Data Challenge
The main challenge for SaaS companies is not policy creation — most SaaS companies already have HR systems, cloud cost management tools, and internal reporting processes that generate the underlying data. The challenge is:
Scope 3 Category 1 attribution: Cloud providers report emissions at account or project level. Attribution of emissions to specific products or customer segments requires additional tooling.
Workforce data completeness: For distributed remote companies, employee data may be held in multiple systems (HRIS, payroll, equity platforms) across multiple jurisdictions.
Value chain emissions: Even with good internal data, supply chain emission factors for SaaS procurement categories (cloud APIs, software subscriptions, professional services) are still developing in methodology.
Practical Approach for SaaS CSRD Readiness
Q1-Q2 2025 (for Wave 2 companies):
- Complete double materiality assessment — confirm that E1, S1, and G1 are material (almost certainly)
- Pull cloud provider carbon data — request full-year 2024 data from your cloud providers
- Compile headcount and pay data for the year
- Document governance — who on the leadership team is responsible for sustainability
Q3-Q4 2025:
- Run Scope 3 Category 1 calculations using cloud provider data
- Calculate business travel emissions from expense data
- Draft transition plan — renewable energy procurement and travel reduction targets
Q1 2026:
- Draft ESRS 2 and E1 disclosures
- Engage assurance provider
- Prepare for ESEF tagging of quantitative disclosures