Your Sustainability Reporting Software Was Scoped for a Perimeter That Moved Four Times in 2026

Most buyer’s guides for sustainability reporting software compare features. That is the right question once you know which rules you are filing under. In 2026 that second part stopped being settled.

Four regimes changed who has to report, or what they have to report, inside ten months. If your platform was selected against a 2024 or 2025 reading of the rules, the shortlist was scored against a perimeter that has since moved.

This is not an argument for switching vendors. It is an argument for re-running one specific question before you renew, and it is a question none of the standard evaluation checklists ask.

What moved, and when

The European Union, twice. The Omnibus directive took effect on 18 March 2026 and narrowed CSRD to EU undertakings with more than 1,000 employees and more than 450 million euros in net annual turnover, both tests, not either (our briefing). Then on 3 July 2026 the Commission adopted the revised ESRS, which cut mandatory datapoints by 61 percent and total datapoints by more than 70 percent (our briefing). One change moved the population. The other moved the content for everyone still in it.

Taiwan, on 23 September 2026. The Financial Supervisory Commission and the Ministry of Environment jointly narrowed mandatory adoption of the IFRS Sustainability Disclosure Standards from about 1,970 listed companies to about 560. The replacement test has two limbs: paid-in capital of NT$2 billion or more, or, below that line, being on the environment ministry’s published list of emission sources that must inventory and verify. The FSC’s own split is 535 companies on capital and about 25 on the ministry’s list (iThome, 23 September 2026). The Taiwan Stock Exchange’s account adds that companies below both tests still disclose climate governance, climate risk management, and scope 1 and scope 2 (TWSE Market Insights, 2 October 2026).

California, with a deadline next week. SB 253 scope 1 and scope 2 reports are due on or before 10 November 2026. But a covered company that was not collecting that data, and not planning to, when CARB issued its enforcement notice on 5 December 2024 is not expected to submit emissions this cycle. CARB asks it for a statement of non-reporting on company letterhead instead (CARB guidance, 1 September 2026).

New Zealand, on assurance rather than disclosure. The XRB moved the scope 3 assurance adoption provision out to accounting periods ending before 31 December 2027, and stated in NZ SAE 1 that scope 1 and scope 2 assurance is unaffected (our briefing).

The pattern underneath

Look at the four tests together and one thing stands out. Only one of them is a clean financial threshold.

The EU test is two tests at once, and headcount is not a line your finance system owns. Taiwan’s second limb is an environmental registration: whether a ministry other than the securities regulator has designated you as an emission source. California’s lane is decided by what you were doing on a date almost two years before the filing. New Zealand’s relief is counted in calendar dates for assurance and in reporting periods for disclosure, which means the two can diverge for the same company in the same year.

So “am I in scope” is now a question with four different kinds of input: financial size, headcount, an environmental register, and a historical fact about your own data practice. A module list does not answer any of them. Neither does a mapping table from a standard to a disclosure.

And scope can now move toward you from a direction that has nothing to do with growth. A Taiwanese listed company under NT$2 billion in capital can be pulled into full IFRS S reporting because the environment ministry added it to an inventory list. Nothing about its size changed.

Five questions to re-run before you renew

These assume you have already done the feature work. If you have not, our audit-ready evaluation checklist and the six jobs to test in a demo cover that ground, and we have a named comparison for a Japanese group filing both CSRD and SSBJ.

1. Can the system tell you which regimes you are in, on which test? Not which standards it supports. Which tests apply to which of your entities, and what each one is keyed to. A platform that models scope as a licensing option rather than as a property of your legal entities cannot answer this, and it will not warn you when an entity crosses a line.

2. Does a datapoint survive its standard being rewritten? The ESRS cut is the stress test. Every datapoint wired to the 2023 set has to be re-checked against the 2026 one. If your mapping lives in a spreadsheet beside the platform rather than inside it, a 61 percent reduction in mandatory datapoints is not relief. It is a re-mapping project.

3. Can it produce a defensible nothing? California’s statement of non-reporting is a filing that contains no emissions and still has to be right. The evidence behind it is a negative: that you were not collecting, and not planning to collect, on a specific date. Most reporting systems are built to assemble numbers. Few are built to document the absence of one, and that is the artefact a covered company may need next week.

4. Does assurance scope track separately from disclosure scope? New Zealand has them on different clocks. Japan has the same structure in a different shape: SSBJ assurance lands on a later year than the data it will examine. If your platform treats “disclosed” and “assured” as one flag on one dataset, it will tell you a comfortable thing that is not true.

5. Does one dataset serve regimes you entered for different reasons? This is where the Taiwan case bites hardest. A company on the environment ministry’s inventory list is already producing verified GHG data for one ministry and now owes IFRS S disclosure to another. Japan has the same overlap between the mandatory GHG reporting system and SSBJ (our briefing). If the two filings are assembled from two datasets, you have bought the reconciliation problem that the software was supposed to remove.

Two labels worth checking on the datasheet

While you are re-running scope, re-run the vocabulary.

TCFD. A platform still selling a “TCFD module” in 2026 is selling a name, not a standard body. The TCFD disbanded in October 2023, having fulfilled its remit, and the Financial Stability Board asked the IFRS Foundation to take over monitoring companies’ progress on climate-related disclosures, with the first progress report in that role published in November 2024 (IFRS Foundation). The four pillars live on inside IFRS S2 and inside most national regimes built on it. That is fine. What is not fine is a product that maintains a TCFD mapping as a separate thing from its IFRS S2 mapping, because then you own two versions of the same disclosure and a reconciliation nobody asked for.

GRI. GRI is not an alternative to the standards above and not a substitute for any of them. It answers a different question, for a different audience, and a company can owe both. The useful test is not whether a platform supports GRI, but whether a single underlying figure can serve a GRI disclosure and an IFRS S2 one without being entered twice. We laid out how the three sets relate in GRI vs ISSB vs ESRS.

If you file in Japan

The Japanese buyer has the sharpest version of this problem, because the overlap is not between jurisdictions. It is inside one.

An SSBJ filer is usually already reporting GHG under the mandatory national system, often already answering an EU customer’s value chain questionnaire, and in a number of cases is a non-EU parent caught by CSRD Article 40a. Those are three different reporting perimeters, three different deadlines, and one set of meters.

Two things to check specifically. First, that assurance year and data year are modelled separately, because SSBJ’s assurance requirement lands on a later year than the data it will examine, and a system that cannot hold that distinction will report a year as finished when its evidence requirement has not started. Second, that the Japanese output is authored in Japanese rather than translated at the end. A sustainability statement that reads as a translation is a statement that will be rewritten by hand, which is the cost the software was bought to remove. We have written up the CSRD and SSBJ dual-filing calendar and Article 40a for Japanese headquarters.

What this does not mean

It does not mean the market has settled on a winner, and we are not going to claim otherwise about our own product. Several of the changes above cut work rather than added it, and the honest reading of the EU revisions is that a large number of companies now have less to file than they were quoted for.

It also does not mean last year’s procurement was wrong. It means the input that decided it has a date on it. A reporting perimeter is not a permanent fact about a company, and four regulators demonstrated that in one year.

The practical move is small. Write down, per entity, which regime applies and which test puts it there. Then ask whoever sold you the platform to show you where that lives in the system. If the answer is a slide, you have your answer.

Where to start

If you want the regulatory half settled before the software conversation, our free readiness checks run the current rules against your situation and take a few minutes: CSRD readiness check and SSBJ readiness check.

Socious Report turns one dataset into AI-drafted CSRD, SSBJ and ISSB reports, with an independent Socious Verify credential attached to the numbers rather than to the document.