A Cognitud Field Guide · 2026 Edition · IX Chapters

How enterprise leaders convert compliance into competitive advantage.

“CSRD Wave 2 is filing. ISSB is the disclosure baseline in twenty-plus jurisdictions. India’s BRSR Core is fully in force.”

Updated23 July 2026Read14 minChaptersIXEdition2026ByCognitud Advisory

ISection I

The 2026 landscape

The last eighteen months have compressed a decade of regulatory development into one filing cycle. Sustainability disclosure is no longer a voluntary parallel to financial reporting — it is being absorbed into it. Same timelines. Same audit committees. Same assurance regime. Same executive accountability.

Three shifts sit under this compression. First, the frameworks converged. ESRS (EU), IFRS S1/S2 (ISSB) and BRSR Core (India) now share enough common measurement infrastructure that a well-designed data layer feeds all three. Second, the scope re-sorted: nature-related risk via TNFD and transition-plan disclosure became explicit line items, while human-rights due diligence under CS3D narrowed sharply to a few thousand of the largest groups. Fewer companies are directly regulated than in 2024 — but those that are, are pulling data from a value chain that extends well past the regulatory perimeter. Third, the audience broadened — ESG data now feeds not only investors but also customers with CSRD-covered procurement, lenders with green-loan pricing, insurers with climate-underwriting models, and regulators with cross-border data-sharing agreements.

For enterprise leaders, the question is no longer whether to comply. It is whether the compliance capex you're about to spend also builds a competitive advantage.

Cognitud Advisory

IISection II

The regulatory matrix

Five regulatory tracks cover the large majority of the disclosure obligations our clients face in 2026. Below is what applies, where, and by when.

RegimeRegionStatus in 2026Who it covers

CSRD / ESRS

European Union

Wave 1 reporting;
Wave 2 deferred to 2028

EU companies with 1,000+ employees and €450M+ net turnover. Non-EU parents with €450M+ EU turnover plus an EU subsidiary or a branch above €200M. Listed SMEs removed from mandatory scope. Double materiality retained.

ISSB S1 & S2

Global

Adopted or referenced
in 30+ jurisdictions

Adoption confirmed in Australia (FY 2025 large groups), Japan (SSBJ from FY 2027), UK (UK SRS S1 and S2 issued 25 February 2026, currently voluntary; the FCA has proposed making them mandatory for listed companies), Singapore, Malaysia, Brazil, and others.

BRSR Core

India

In force;
verification perimeter widening

BRSR: top 1,000 listed companies by market cap. BRSR Core assessment or assurance: top 500 for FY 2025-26, top 1,000 for FY 2026-27. Value-chain ESG disclosure voluntary; where made, covers partners at 2%+ of purchases or sales, and may be limited to 75% by value.

US SEC + California

United States

SEC rescission proposed;
SB 253 live, SB 261 enjoined

The SEC has formally proposed rescinding its climate disclosure rules, which never took effect. California SB 253 (>$1bn revenue) requires Scope 1 & 2 reporting in 2026 and Scope 3 from 2027. SB 261 (>$500M revenue) is under a Ninth Circuit injunction and is not being enforced pending appeal.

CS3D

EU + non-EU with EU activity

Applies from
26 July 2029

EU groups with more than 5,000 employees and more than €1.5bn net worldwide turnover; non-EU groups generating more than €1.5bn in the EU. Human-rights and environmental due-diligence obligation across the value chain. Maximum fines capped at 3% of global net turnover.

IIISection III

The compliance calendar

Same map, arranged temporally. The three-year window that determines whether your programme is on the front foot or the back foot.

2026

The first-filing year

CSRD Wave 2

The scoping year — no filing. Wave 2's first report has moved to 2028 on FY 2027 data. What 2026 requires instead: re-test entity-by-entity applicability against the new 1,000-employee / €450M thresholds, refresh double materiality against the amended ESRS, and answer the data requests arriving from Wave 1 customers already in scope.

California SB 253 (Scope 1 & 2)

First reports due 10 November 2026 under CARB's proposed deferral from the original 10 August date, for companies above $1bn revenue doing business in California. No assurance required in year one; limited assurance from 2027. CARB has signalled enforcement discretion for good-faith first-year filings.

California SB 261

Enforcement suspended. The Ninth Circuit preliminarily enjoined SB 261 in November 2025; oral argument was heard in January 2026 and a ruling is pending. CARB will set an alternate reporting date once the appeal resolves. The injunction does not affect SB 253.

BRSR Core assurance

Assessment or assurance of the nine BRSR Core attributes applies to the top 500 listed entities by market capitalisation for FY 2025-26. Providers need not be chartered accountants; SEBI has confirmed the requirement is profession-agnostic.

ISSB nature standard

ISSB confirmed in November 2025 that it will undertake nature-related standard-setting using TNFD's framework as the primary foundation. The exposure draft is targeted for October 2026 to coincide with CBD COP17, with a final standard expected in 2027.

2027

The scope expands

California SB 253 - limited assurance begins

Limited assurance becomes mandatory for SB 253 filings from 2027, alongside first-year Scope 3 disclosure. Assurance-provider capacity in the US market is thin; engagement conversations belong in 2026, not 2027.

ISSB in Japan

SSBJ standards take effect for large groups from FY 2027. Effectively means ISSB in the world's third-largest capital market.

BRSR Core assurance broadens

The verification perimeter reaches the top 1,000 listed entities for FY 2026-27, the final step in SEBI's glide path.

2028

The next-tier catches up

CSRD Wave 3

Originally 2027, extended by the Omnibus package. Listed SMEs and specific non-EU groups with EU activity enter scope.

IVSection IV

The five-pillar system

The programmes we see hitting escape velocity share the same five load-bearing elements. Missing any one compromises the value of the other four. Read them as a system, not a checklist.

01Foundation

Governance & double materiality

A board-endorsed double materiality assessment, refreshed annually, mapped to both impact and financial materiality. Cognitud connects material issues to strategic priorities, investment decisions and enterprise risk, ensuring the assessment informs both reporting and capital allocation.

Field note. If your materiality assessment lives only in the sustainability report and nowhere in the strategic plan, it is a compliance artefact, not a governance one.

02Data spine

Measurement infrastructure

One source of truth for GHG (Scopes 1, 2 & 3) mapped to GHG Protocol categories with year-on-year methodology consistency. Nature-dependency mapping via TNFD LEAP sits alongside.

Field note. For most non-financial corporates, Scope 3 is 70–90% of the total footprint. Cognitud recommends staging in three phases: category screening, primary data on 2–3 material categories, then progressive supplier engagement.

03Filing engine

Disclosure & assurance-readiness

Reporting that satisfies both letter and spirit of the applicable regime — CSRD/ESRS, ISSB S1/S2, BRSR Core — with an audit trail that can survive limited and eventually reasonable assurance from day one.

Field note. Most of our client engagements start here because most companies inherited disclosure infrastructure designed for a voluntary reporting era.

04Trajectory

Target-setting under SBTi

Near-term (typically 2030) and long-term (2050) targets validated against the SBTi Corporate Net-Zero Standard. Version 1.3.1 is the applicable framework for validation throughout 2026; Version 2.0, published 11 June 2026, opens for submissions in Q1 2027 and becomes mandatory for all submissions from 1 February 2028. Financial institutions follow the SBTi Financial Institutions Net-Zero Standard, published July 2025.

Field note. A target is only as credible as the marginal-abatement-cost curve (MACC) that supports it. Cognitud sequences MACC development BEFORE target commitment, not after.

05Return on programme

Value creation

Sustainability-linked products, sustainability-linked financing, operational-efficiency programmes financed from carbon-price internalisation, licence-to-operate improvements. Cognitud designs every sustainability programme with a commercial pathway.

Field note. Value-creation ESG requires a CFO in the room, not just a CSO. This pillar is what separates a compliance cost centre from a strategic investment.

The order isn't 'pick two'. Every pillar reinforces the ones below it, and gets its own credibility from the ones above it.

Cognitud Advisory

VSection V

Sector plays

Same five pillars, applied differently by sector. Cognitud’s practice maps the pillars against the structural realities each industry actually faces.

VISection VI

What goes wrong

A hundred-plus engagements later, the failure modes rhyme. Five recur.

Two separate reports for CSRD and ISSB

Companies with EU and non-EU obligations spin up parallel workstreams. Expensive, and produces internally inconsistent numbers. Build ONE measurement layer, then map it out to both regimes.

An SBTi commitment before the MACC exists

Committing to 42% by 2030 and then discovering the marginal abatement cost is prohibitive erodes credibility publicly and internally. Cognitud sequences the abatement-cost curve first, target commitment second.

Long-tail Scope 3 on spend proxies only

Fine at screening, a problem at target-setting. Reasonable-assurance auditors are increasingly rejecting materially high Scope 3 categories that never move off spend proxies into primary data.

A materiality assessment that never leaves sustainability

A double materiality assessment is a governance instrument, not an ESG artefact. If it doesn't inform capital allocation, risk registers, or strategic planning, it is window dressing.

Standing up disclosure infrastructure six months before first filing

The audit trail matters. Companies that stand up infrastructure six months before first filing spend that year firefighting. Assurance-ready infrastructure is a 12-18 month build.

VIISection VII

The 90-day blueprint

A 90-day quick-start is not a substitute for a 12-18 month build. It is how you buy the credibility, calendar visibility and board attention that the longer build needs. Three windows, three specific deliverables each.

Days 0–30

Applicability + baseline

  • Regime applicability map by legal entity
  • First-pass double materiality register
  • Scope 1 & 2 inventory on FY 2025 data

Days 31–60

Materiality + Scope 3 screening

  • Stakeholder-engaged double materiality complete
  • All 15 Scope 3 categories screened
  • 2–3 material Scope 3 categories identified + governance charter drafted

Days 61–90

Disclosure + target framing

  • Assurance-readiness gap analysis vs applicable regime
  • SBTi framing draft (commitment held for months 4–6, after MACC)
  • 12-month roadmap + steady-state operating model to board

VIIISection VIII

Frequently asked

Every answer below is duplicated in this page’s structured data (schema.org FAQPage), so answer engines like Google’s AI Overviews, ChatGPT and Perplexity can quote it directly.

What is CSRD Wave 2 and who has to comply in 2026?

Wave 2 companies publish their first CSRD report in 2028, covering financial year 2027. The Stop-the-Clock Directive, adopted in April 2025, deferred Wave 2 by two years from its original 2026 date. Scope then narrowed separately: Omnibus I (Directive (EU) 2026/470, in force 18 March 2026) replaced the old two-of-three test with a cumulative threshold of more than 1,000 employees and more than €450 million net turnover, removing roughly 85% of originally scoped companies. Listed SMEs are out of mandatory scope and are instead pointed toward voluntary VSME reporting. Wave 1 companies continue reporting on the original timeline, with a transition exemption available for those now below the new thresholds.

How do ISSB S1 and S2 differ from ESRS?

IFRS S1 (general sustainability) and S2 (climate) issued by the ISSB in June 2023 use single (investor-focused) materiality, while ESRS uses double materiality — meaning ESRS also requires disclosure of the company's impact on the environment and society, not only what affects financial performance. ISSB is being adopted as the baseline in Australia, Japan (SSBJ), Singapore, Malaysia, UK (UK SRS S1 and S2 issued 25 February 2026, currently voluntary; the FCA has proposed making them mandatory for listed companies) and 15+ other jurisdictions. The two frameworks are being deliberately aligned so the ESRS climate module can satisfy ISSB S2 as an interoperable disclosure.

What is BRSR Core and which Indian companies does it apply to?

BRSR Core is the independently verified subset of nine ESG attributes within India's Business Responsibility and Sustainability Report framework, covering GHG emissions, water, waste, energy, gender diversity, wages, inclusive development, fairness to customers, and openness of business. SEBI's glide path runs top 150 for FY 2023-24, top 250 for FY 2024-25, top 500 for FY 2025-26 and top 1,000 for FY 2026-27. SEBI's circular of 28 March 2025 replaced "assurance" with "assessment or assurance" and confirmed that providers need not be chartered accountants. Value-chain ESG disclosure is now voluntary; where a company reports it, the value chain covers upstream and downstream partners at 2% or more of total purchases or sales, and disclosure may be limited to 75% by value.

What is CS3D and how does it relate to CSRD?

The Corporate Sustainability Due Diligence Directive (CS3D) adopted in 2024 requires large EU and non-EU companies with EU activity to conduct human-rights and environmental due diligence across their value chains. It is separate from CSRD (which is disclosure) but the two are complementary: CS3D creates the substantive due-diligence obligation, and CSRD requires disclosure of how the company discharges it. Both were amended by Omnibus I (Directive (EU) 2026/470, in force 18 March 2026). CS3D application moved to 26 July 2029, thresholds rose to 5,000 employees and €1.5bn turnover, the maximum-fine floor was replaced with a 3% cap, and the obligation to adopt and implement a climate transition plan was removed — though transition-plan disclosure obligations continue to sit under CSRD.

How does Scope 3 measurement work in practice?

Scope 3 covers 15 categories of indirect emissions across the upstream and downstream value chain — for most non-financial corporates, Scope 3 is 70-90% of total footprint. GHG Protocol requires all 15 to be screened (typically with spend-based proxies), with primary data required on the two-to-three categories that dominate. Financial institutions follow the PCAF (Partnership for Carbon Accounting Financials) methodology for financed emissions. Assurance-ready Scope 3 requires a category-by-category methodology statement, not a single number.

What does SBTi Net-Zero v1.2 require?

Version 1.3.1 remains the applicable framework for target validation throughout 2026. It requires validated near-term targets (typically 2030) and long-term targets (typically 2050); near-term scope 3 coverage is set at a minimum of 67% of value-chain emissions, rising to at least 90% for long-term targets. Residual emissions are neutralised via permanent carbon removals, not avoidance offsets. Version 2.0, published 11 June 2026, is a major revision and can be used for submissions from Q1 2027, becoming mandatory from 1 February 2028; companies setting or renewing targets during 2026 should proceed under 1.3.1. Financial institutions follow the SBTi Financial Institutions Net-Zero Standard, published July 2025.

What is TNFD and is nature disclosure mandatory?

The Taskforce on Nature-related Financial Disclosures published its final v1.0 recommendations in September 2023, following the TCFD four-pillar structure (Governance, Strategy, Risk & Impact, Metrics & Targets) applied to nature. As of 2026 TNFD adoption is voluntary and more than 730 organizations, representing over $22 trillion in assets under management, have committed to TNFD-aligned reporting - up from roughly 416 a year earlier. ISSB has begun scoping a mandatory nature standard, and ESRS E4 (Biodiversity & Ecosystems) already imposes similar disclosure on CSRD-covered EU entities. Cognitud recommends TNFD LEAP (Locate, Evaluate, Assess, Prepare) as the entry point regardless of jurisdiction.

What is double materiality?

Double materiality — adopted by CSRD/ESRS — requires disclosure of both the sustainability topics that affect the company's financial performance (financial materiality) AND the topics on which the company has a material impact on environment or society (impact materiality). It is broader than ISSB's investor-focused single-materiality view. A robust assessment produces two overlapping ranked lists and is refreshed at least biennially.

How long does an assurance-ready ESG programme take to stand up?

For an enterprise starting from a low baseline, expect 12-18 months: months 1-3 for governance, applicability and materiality; months 4-9 for measurement infrastructure and first internal reporting cycle; months 10-18 for assurance-readiness, disclosure integration with financial reporting timelines, and moving from compliance to value creation. Programmes that only start six months before their first filing typically spend that year firefighting rather than improving.

IXSection IX

Take action

This playbook is deliberately structural — every chapter connects to a Cognitud solution area or a client case study. Pick the pillar closest to where you are, or start a conversation.

Start the work

Send us your applicable regime and disclosure baseline.

We’ll come back within a week with a 90-day scoping proposal shaped to your specific deadline — the same blueprint outlined in Section VII, calibrated to what you already have.

Talk to Cognitud

Written and maintained by Cognitud’s advisory practice. Updated whenever a material change occurs in the disclosure landscape. Last update: 23 July 2026. Send corrections or suggestions.