CSRD, GHG, ISSB, EU Taxonomy — A Plain-English Guide to Sustainability Standards

If you've been asked to "own ESG" at your company in the last two years, you've probably watched a procession of acronyms march across your calendar. CSRD. ESRS. IFRS S1. IFRS S2. GHG Protocol. EU Taxonomy. CDP. SBTi. CBAM. Each of them arrives with a slide deck, a consultant, and a suggested budget.

They multiplied because three things happened at once: investors started asking for climate data in a standardized form, the EU decided sustainability should be audited like financial statements, and regulators in different jurisdictions built their own versions of the same idea. The good news is these frameworks overlap far more than the marketing suggests. The better news is that understanding which ones actually apply to you — and how they connect — is the single biggest cost-saver available. Most companies are quoted for seven projects when they have two.

This guide is for the CFO, the new head of sustainability, or the board member who wants one clear article instead of seven. No jargon, one table, plain English.

The comparison table

Keep this table nearby. The rest of the article is the plain-English version of each row.

CSRD / ESRS — the EU's "audit your sustainability like your finances" project

CSRD (the Corporate Sustainability Reporting Directive) wants you to publish two things: how your business affects the environment and people, and how environmental and social changes affect your business. That second half is called double materiality, and it's the part everyone gets stuck on. An oil company has to report both its emissions (impact on the planet) and the risk that a €200/tonne carbon price wrecks its margins (impact on the business).

The specifics: around 1,100 data points across 12 ESRS topical standards, of which roughly 265 are mandatory and the rest are conditional. You tag the report in XBRL so machines can read it. You get a limited-assurance audit opinion from day one, moving to reasonable assurance later. The February 2025 Omnibus proposal narrowed the in-scope population by roughly 80% and deferred Wave 3 to FY2028, so check whether you're actually still in scope before panicking.

If you're a listed EU company with more than 500 employees, you're almost certainly filing.

GHG Protocol — the rulebook under all the others

The GHG Protocol isn't a disclosure framework. It's the accounting standard for measuring greenhouse gas emissions. Scope 1 is what comes out of your own chimneys and tailpipes. Scope 2 is the emissions from the electricity you buy. Scope 3 is everything else in your value chain — suppliers, employee commuting, the end-of-life of your products.

Nobody is going to fine you for not doing a GHG inventory. But you cannot credibly file CSRD, answer CDP, validate SBTi targets, or support ISSB climate disclosures without one. It is the common denominator. Every other framework on this list either requires it or strongly recommends it.

Think of GHG Protocol the way accounting firms think of GAAP: it's the bookkeeping method, not the tax return. You do the bookkeeping once and file the various returns from the same ledger.

IFRS S1 and S2 (ISSB) — the global sibling of CSRD

The International Sustainability Standards Board (ISSB) published two standards: S1 (general sustainability-related disclosures) and S2 (climate-specific disclosures). S2 is the one most companies start with because climate is concrete and the data exists.

The audience is investors, full stop. Where CSRD asks "how does your company affect the world," ISSB asks "what sustainability risks and opportunities affect your financial performance." That single-materiality focus makes ISSB a narrower ask than CSRD, and the two are deliberately designed to be compatible — you can satisfy S2 with a subset of what you already filed for CSRD.

Adoption is a jurisdiction-by-jurisdiction decision. As of early 2026: the UK, Japan, Hong Kong, Australia, Brazil, Canada, and Singapore have adopted or committed to IFRS S1/S2, with first filings typically starting FY2025 or FY2026. The US has not adopted ISSB; it has its own evolving SEC climate rule, which is a different story.

EU Taxonomy — the "is this economic activity actually green" classifier

The EU Taxonomy is a filter. It defines six environmental objectives (climate mitigation, climate adaptation, water, circular economy, pollution, biodiversity) and tells you which economic activities can be called "sustainable" under each one.

If you file CSRD, you must report what percentage of your revenue, capital expenditure, and operating expenditure is Taxonomy-aligned. To be aligned, an activity has to (a) substantially contribute to one of the six objectives, (b) Do No Significant Harm (DNSH) to the other five, and (c) meet minimum social safeguards.

In practice this means your CFO and sustainability lead sit down with the P&L, go line by line through revenue categories and major CapEx, and classify each one. For a cement producer, almost nothing is aligned today. For a wind-turbine manufacturer, almost everything is. Most industrials land somewhere in the middle, with a single-digit alignment number in year one that grows as the transition advances.

CDP — the annual questionnaire your biggest customer asked you to fill

CDP started as the Carbon Disclosure Project, a non-profit that ran an annual climate questionnaire. It now covers climate, water, forests, plastics, and biodiversity. Technically voluntary. In practice, if one of your largest customers (Walmart, Microsoft, L'Oréal) is a CDP signatory, they will ask you to respond, and your answer affects whether you stay on the preferred supplier list.

CDP aligned its 2024 questionnaire with IFRS S2, which is the most useful thing that happened in ESG disclosure in years. It means a company that has done its ISSB climate homework can copy-paste most of it into CDP. The data is the same; the form changed. This is a pattern — once you see it, you stop treating each framework as a separate project.

Response deadline is usually mid-July. Scoring is A to D-minus, public, and your customers watch it.

SBTi — validated targets, not disclosure

SBTi (Science Based Targets initiative) is different from the others. It doesn't ask you to disclose anything. It asks you to commit to emission reduction targets consistent with limiting warming to 1.5°C, and then it validates those targets.

The process: you submit a near-term target (typically 2030) and a net-zero target (typically 2050). SBTi reviews them against its sector methodology. Once validated, your targets appear on the SBTi website and your investors and customers treat them as credible in a way they wouldn't treat a self-declared goal.

You cannot validate targets without a GHG inventory covering Scopes 1, 2, and typically 3. That's the prerequisite. From there, SBTi runs on a 24-month clock: commit, submit, validate, publish.

CBAM — the carbon border tax that's actually a tax

CBAM (Carbon Border Adjustment Mechanism) is the odd one out. It's not a corporate disclosure framework. It's a tariff. If you import iron and steel, aluminum, cement, fertilizers, hydrogen, or electricity into the EU, you report the embedded emissions in those imports and — starting January 2026 — you buy CBAM certificates to cover them.

Quarterly reporting is already live. From 2026, actual emissions data becomes mandatory (no more default values), third-party verification is required, and financial obligations kick in. Penalties for inaccuracies run 10–50 EUR per tonne, and falsified data can trigger fines up to 3x the certificate price.

CBAM is standalone. It shares emission-factor data with your GHG inventory but operates at product level (per shipment, per CN code), not corporate level. If you're an EU importer of covered goods, this is a compliance obligation regardless of what else you report.

How they connect

This is the part most first-time sustainability leads miss. These aren't seven projects. They're one data layer with seven views on top.

CSRD includes EU Taxonomy. Not "alongside" — inside. If you file CSRD, you file Taxonomy disclosures in the same document. They are not separable engagements, and any consultant who quotes them as two should be asked why.

CSRD covers most of ISSB S1/S2. EFRAG and ISSB published a joint interoperability guidance that maps one to the other. A company that has done a serious CSRD filing is roughly 70% of the way to IFRS S2. The remaining 30% is mostly formatting and emphasis — ISSB wants it in financial-statement language, CSRD wants it in sustainability-statement language.

CDP is downstream of everything. If you already have a GHG Protocol inventory, ISSB-aligned climate disclosures, and SBTi-validated targets, answering CDP is a retrieval exercise. You are pulling from data you already produced. The companies that find CDP painful are the ones who haven't done the underlying work, so they treat the questionnaire as the work.

GHG Protocol is the bedrock. Every Scope 1/2/3 number reported under CSRD, ISSB, CDP, or SBTi uses GHG Protocol methodology. Compute it once, use it seven times.

CBAM stands alone. Different data model, different unit of analysis (product, not company), different filing cadence. Don't try to squeeze it into your corporate reporting architecture. Run it as its own track.

The overlap across the other six frameworks is somewhere between 60% and 80% of the underlying data. The paperwork differs. The data doesn't.

What to do first, by company profile

If you're a listed EU company with more than 500 employees: CSRD is the spine. Start with a materiality assessment and a GHG inventory. Taxonomy is embedded in CSRD. ISSB you'll get mostly for free. CDP answers write themselves from the CSRD data. SBTi is the target-setting layer on top — do it in year two, not year one.

If you're a US multinational with significant EU operations: the CSRD non-EU parent rule (Wave 3, FY2028) is on your horizon, not your doorstep. Today, start with a GHG Protocol inventory and an ISSB-aligned climate disclosure — those are what your investors want and what the SEC rule, when it settles, will look most like. CDP if a major customer requests it.

If you're a mid-cap outside the EU, listed in a jurisdiction that has adopted ISSB: IFRS S2 first, GHG inventory second, CDP third if investors ask. Skip CSRD unless you trip the non-EU threshold.

If you're an EU importer of covered goods (steel, aluminum, cement, fertilizers, hydrogen, electricity): CBAM is its own project and it's urgent. The definitive phase starts January 2026. Set up CBAM as a standalone workstream, probably run by procurement or supply chain, not by the corporate ESG team.

If you're a private, non-listed company below CSRD thresholds: you have no mandatory obligations. You have market ones. Customers will ask for CDP responses. Lenders will ask for an emissions inventory. Start with GHG Protocol and see what your largest counterparties actually need.

One architecture, seven forms

The thing worth remembering: these frameworks were designed by different bodies for different audiences, but they all ask for variations of the same underlying data — your emissions, your energy use, your policies, your targets, your supply chain, your revenue mix. The overlap is 60–80% once you stop looking at the forms and start looking at the fields.

That's why Formist — the AI-powered compliance platform built by WeCarbon — handles CSRD, GHG Protocol, ISSB, EU Taxonomy, CDP, SBTi, and CBAM under one subscription. You upload your data once — annual report, energy bills, procurement ledger, supplier declarations — and the Formist AI agent maps it to the fields each framework requires. The same Scope 1 number feeds six disclosures. The same supplier data feeds CBAM and CSRD Scope 3. Once you understand how the frameworks connect, this is the obvious architecture. A form-filler that reads your data once and writes every report.

Formist is built by WeCarbon, a climate-tech company with offices in Paris, Dubai, and Shanghai. It supports CSRD/ESRS, CBAM, GHG Protocol, EU Taxonomy, CDP, ISSB, SBTi, and 15+ other sustainability frameworks.