Cloud, Data Centres and IT Sustainability Reporting for SMEs

For IT consultancies, SaaS companies, and tech service providers, digital infrastructure is usually the largest environmental impact — typically more material than office electricity or business travel. Cloud computing, virtual servers, and data storage all consume real energy through remote data centres, and CSRD-reporting customers will ask for that data alongside workforce and governance metrics.

This guide is for small and growing businesses (SMEs) in the IT, SaaS and professional services sector. Under the 2026 Omnibus revision, CSRD applies directly only to undertakings with more than 1,000 employees and more than €450 million net turnover, so almost every IT SME falls below the threshold. The Voluntary Sustainability Reporting Standard for SMEs (VSME) is the practical way to respond to enterprise customer questionnaires; the Omnibus value-chain cap stops in-scope clients from demanding more than VSME requires.

The guide covers cloud and on-premise data-centre reporting (Parts 1–3) and the wider ESG topics IT clients ask about — workforce, business conduct, and remote-work energy (Part 4).

TL;DR

• Most IT/SaaS environmental impact is digital, not physical — cloud and data-centre energy typically dwarf office and travel emissions.
• On-premise = Scope 2. Direct electricity for owned/leased servers goes in your VSME B3 disclosure as Scope 2.
• Cloud (AWS, Azure, GCP, OVH, Scaleway, Hetzner, IONOS) = Scope 3. Use provider sustainability dashboards; estimate where data is missing (e.g. 2.5 kWh per GB-year for storage).
• PUE (Power Usage Effectiveness) is not mandatory but strengthens an efficiency narrative when available.
• Wider ESG topics matter for IT clients: VSME B8–B10 (workforce, training, diversity), B11 (anti-corruption), and ESRS G1 mappings for data-protection / GDPR alignment.

Why Digital Infrastructure Matters Most for IT SMEs

Digital services may be “in the cloud,” but their energy demand is very real. Servers, cooling systems, and networks in data centres contribute directly to energy consumption and carbon emissions, and for SaaS and IT-heavy SMEs, cloud usage often represents a material part of total Scope 2 or 3 emissions.

Three reasons CSRD-reporting clients push hard on this data:

1. Materiality — for an IT supplier, infrastructure energy is usually the only environmental disclosure with material values. Workforce and governance still matter, but they do not consume megawatt-hours.
2. Scope 3 attribution — your customer’s CSRD disclosure includes Scope 3 Category 1 (purchased services). They need a number from you.
3. Procurement criteria — public-sector and regulated-sector buyers increasingly award contracts on disclosed sustainability data, often using ISO 14001 certification or carbon-intensity figures as a filter.

This makes a credible, reusable VSME disclosure a competitive asset, not just a compliance document.

Part 1 — On-Premise vs Cloud: What Goes Where

Your reporting depends on who operates the servers.

For most SMEs using third-party cloud services, the impact falls under Scope 3 — purchased services. It remains relevant to disclose if material.

On-Premise Data Centres

For on-premise infrastructure, reporting is relatively direct. Typical data points:

• Total electricity consumption (kWh or MWh)
• Energy source (grid mix, renewable contracts if applicable)
• Scope 2 emissions using national or supplier emission factors
• Whether figures are location-based or market-based

Where metering is limited, estimates based on server load or utility bills are acceptable, provided assumptions are documented. A common heuristic for office-based businesses: IT equipment typically uses 30–40% of total office energy.

Cloud-Hosted Infrastructure

Most SaaS companies rely on hyperscale providers. In this case:

• Energy consumption is usually estimated, not measured
• Emissions are typically treated as Scope 3
• Transparency of methodology matters more than precision

Companies should explain which providers are used, which regions host workloads, and what data sources or dashboards are relied upon. CSRD allows estimates where direct measurement is not feasible.

Part 2 — PUE (Power Usage Effectiveness) and Efficiency Narrative

PUE is a key efficiency metric for data centres and is often referenced in CSRD narratives.

PUE formula: total data centre energy ÷ IT equipment energy. A PUE of 1.0 would mean perfect efficiency (no overhead); typical hyperscale PUE values are 1.1–1.2, smaller colocation facilities range 1.4–1.8, and older on-premise server rooms can run above 2.0.

What to disclose:

• Whether PUE data is available
• Source of the PUE figure (operator-reported, provider regional average)
• How PUE is used internally (monitoring, vendor selection, targets)

You are not expected to calculate PUE independently. For cloud providers, company-wide or regional average PUE figures are sufficient. PUE is not a mandatory VSME or CSRD disclosure — but if available, it strengthens your efficiency narrative under VSME B2 (Practices, policies and future initiatives).

Part 3 — Getting Energy and Emissions Data from Cloud Providers

Most major providers now publish sustainability data relevant to CSRD reporting.

Provider Sources

• AWS — average carbon intensity (gCO₂e per kWh) by region; the AWS Customer Carbon Footprint Tool gives account-level monthly emissions
• Microsoft Azure — the Emissions Impact Dashboard (EID) publishes account-specific Scope 1, 2 and 3 figures
• Google Cloud — Carbon Footprint reports per project, plus regional grid emission factors and renewable energy use
• OVHcloud — annual environmental report and per-rack PUE / carbon intensity figures
• Scaleway — energy mix and carbon intensity per data centre, French nuclear-heavy grid generally yields low gCO₂e per kWh
• Hetzner, IONOS — annual sustainability or environmental reports

If your provider publishes a customer-specific emissions report, download and use the total annual tCO₂e directly. Otherwise, estimate based on usage.

Estimating Cloud Emissions Without Provider Data

Where account-specific data is unavailable, estimate from usage:

• Number of users
• Storage (GB/month)
• Compute time (hours/month)

Worked example. 10 users × 100 GB cloud storage × 12 months × 2.5 kWh per GB-year = 3,000 kWh (3 MWh). Using an EU average grid factor of 0.25 kg CO₂e per kWh = 0.75 tCO₂e.

Reliable emission factor sources used in the EU:

• DEFRA / BEIS (UK) — annual updates
• ADEME Base Carbone (France)
• IEA — country-level grid emission factors for electricity

Document your methodology clearly: which factor source, which year, which assumptions. Auditors and customer ESG teams look at methodology, not just headline numbers.

Reporting Under VSME B3

Create a disclosure table that captures IT-related energy use and emissions:

Narrative example:

“Cloud and hosting services account for ~8% of total energy-related emissions. We are migrating workloads to providers powered by 100% renewable energy by 2027.”

Under VSME B2 — Practices, policies and future initiatives, briefly describe how you manage digital sustainability:

“We assess cloud providers based on their energy efficiency and renewable sourcing. Preference is given to ISO 14001-certified and carbon-neutral data centre operators. Internal data storage is being consolidated to reduce duplication and energy use.”

Optional: IT Equipment Lifecycle Emissions

If your firm replaces laptops or servers regularly, you may optionally disclose embodied emissions using manufacturer data (Scope 3 — Category 2 capital goods).

10 laptops × 300 kg CO₂e each = 3 tCO₂e (one-time impact, amortised over 3 years).

This information supports VSME B7 (resource use and circular economy) when paired with hardware reuse, refurbishment or recycling data.

Part 4 — Wider IT Services ESG: Workforce, Business Conduct, Remote Work

For IT and tech SMEs, environmental data is only part of what enterprise customers ask for. The rest concentrates on workforce and business conduct — VSME B8–B11 and the equivalent ESRS S1 (Own workforce) and ESRS G1 (Business conduct) topics.

Energy: Office and Remote Work

• Office electricity and heating — kWh per year, % renewable; map to VSME B3
• Renewable share — note whether your electricity comes from a green energy contract; this is a quick credibility win
• Remote work energy — typical estimate is 2–3 kWh per home-working employee per day; describe digital efficiency measures (video call optimisation, shared workspaces) under VSME B2. For full guidance, see how to include remote workers in CSRD metrics.

Own Workforce (VSME B8–B10 / ESRS S1)

A concise narrative example:

“Our 25-person consultancy in Copenhagen employs 12 women and 13 men. All staff have access to flexible and remote work and complete a minimum of 20 training hours per year. The company applies the Danish IT Industry collective agreement.”

Business Conduct (VSME B11 / ESRS G1)

VSME B11 specifically asks for convictions and fines for corruption and bribery. State explicitly if there are none. Many enterprise clients will additionally ask about:

• Anti-bribery and conflict-of-interest policies
• GDPR compliance and cybersecurity governance (often the largest “G” topic for IT firms)
• Subcontractor due diligence — confirmation that your subcontractors comply with local labour and environmental laws

Even small companies can summarise these in a single page of policy references — this is usually enough for procurement teams.

How to Compile Your IT/SaaS VSME Report

Once you have data across infrastructure and the wider ESG topics, the steps below produce a single document that answers most enterprise customer questionnaires.

Step 1: Map your IT footprint

List every external service that stores or processes data on your behalf, plus any owned or leased infrastructure.

• Cloud platforms (AWS, Azure, Google Cloud, OVH, Scaleway, Hetzner, IONOS)
• Data hosting and storage providers
• Managed IT service providers
• External CRM, ERP, or file storage systems
• Owned servers, colocation racks, office IT equipment

Record what each provides (storage, compute, networking) and who manages it.

Step 2: Collect available energy and emissions data

Pull provider sustainability dashboards (AWS Customer Carbon Footprint Tool, Azure Emissions Impact Dashboard, Google Cloud Carbon Footprint). Save screenshots or exports with dates, and note the methodology each provider documents.

For on-premise or office IT, pull electricity invoices and (where available) sub-metering for IT equipment.

Step 3: Estimate where data is missing

Use the formulas in Part 3 (2.5 kWh per GB-year for storage, EU average 0.25 kg CO₂e per kWh, ~30–40% of office energy attributable to IT). Document each assumption in a methodology note. CSRD and VSME both allow estimates provided the method is transparent and consistent year-on-year.

Step 4: Pull workforce and conduct data

From HR and payroll: headcount mix, training hours, collective-bargaining coverage. From your legal/compliance log: any convictions or fines (or an explicit “none” statement). From policies: GDPR, anti-bribery, cybersecurity.

For pure-remote teams, add a remote-work narrative under B2 (a reasonable estimate using ~2.5 kWh per home-worker per day is acceptable, with a note on assumptions).

Step 5: Compile a VSME PDF and update annually

A typical IT services VSME Basic statement is 4–10 pages. Cross-check totals with utility invoices and provider exports before publishing. Most enterprise customers expect annual updates and will accept the same document with minor refreshes year-on-year — that is the value of this approach over per-questionnaire responses.

Aligning Cloud and Data Reporting with CSRD and ESRS

This alignment means the same VSME document can be referenced by enterprise clients filing under ESRS without rework on either side.

Practical Tips for IT and SaaS Teams

• Use cloud dashboards and billing reports — they often include sustainability metrics by default
• Ask suppliers for energy or carbon reports — many provide them on request
• Track progress: switch workloads to providers in low-carbon regions or with renewable contracts
• Include IT hardware reuse, refurbishment or recycling in your B7 disclosure
• Mention sustainability practices in client proposals and tender responses (renewable electricity contract, ISO 14001 alignment, GDPR compliance)
• Keep reporting simple and consistent — use the same methodology each year so trends are real, not artefacts of method changes

Frequently Asked Questions

Do small IT or SaaS businesses need to report under CSRD?

No. Under the 2026 Omnibus revision, CSRD applies only to undertakings with more than 1,000 employees and more than €450 million net turnover. Most IT and tech service providers fall below that threshold and use VSME voluntarily to respond to enterprise client questionnaires. The Omnibus value-chain cap also prevents in-scope clients from demanding more than VSME requires from sub-1,000-employee suppliers.

How do I estimate cloud emissions if my provider does not give me data?

Estimate from usage: number of users, storage (GB/month), and compute time (hours/month). Standard factors used by EU SMEs include 2.5 kWh per GB-year for storage and 0.25 kg CO₂e per kWh for EU-average grid electricity. Many cloud providers (AWS, Azure, Google Cloud, OVH, Scaleway) now also provide customer-specific emissions reports — check the dashboard before estimating.

Are cloud emissions Scope 2 or Scope 3?

Cloud emissions are typically reported as Scope 3 — indirect emissions from purchased services where you do not own or control the infrastructure. If you operate your own server room or colocation racks, the energy consumed there counts as Scope 2 (purchased electricity). Hybrid setups split between the two.

Is PUE mandatory to report?

No. PUE is not a mandatory VSME or CSRD disclosure. It is a recognised efficiency metric and, when available from your provider or operator, strengthens the efficiency narrative under VSME B2. Hyperscale provider PUE figures (typically 1.1–1.2) are sufficient — you are not expected to calculate PUE independently.

What is the biggest sustainability focus for IT companies?

For IT and SaaS SMEs, the two priorities are usually energy efficiency (offices and digital infrastructure) and workforce policies (diversity, training, flexible work). Environmental data tends to be the only category with material numbers, but workforce and governance are typically the categories enterprise clients scrutinise hardest in procurement.

How do I choose low-carbon cloud providers?

Look for providers that: use 100% renewable energy or have published renewable-energy commitments; are ISO 14001-certified; provide transparent customer-specific carbon reports; and operate in low-carbon-grid regions. EU-based providers (Scaleway, OVHcloud) often benefit from low-carbon national grids (French nuclear in particular). Document your selection criteria in VSME B2.

Can this be managed without specialist software?

Yes. Most IT and SaaS SMEs manage data centre disclosures using provider dashboards and a single spreadsheet workbook. The key is consistent documentation: same boundaries, same factor sources, same methodology each year.

What if we have only remote staff?

Estimate average home office energy use at around 2–3 kWh per employee per day. Describe digital efficiency measures (video call optimisation, shared workspaces, paperless processes) under VSME B2. The focus is transparency, not precision. For full guidance, see how to include remote workers in CSRD metrics.

Key Terms

• CSRD — Corporate Sustainability Reporting Directive (EU 2022/2464); revised by Omnibus I in March 2026.
• Omnibus I — EU directive in force from 18 March 2026 that narrowed CSRD scope and capped supplier-data demands at the VSME level.
• VSME — Voluntary Sustainability Reporting Standard for SMEs (Basic B1–B11; Comprehensive C1–C9). Adopted as a Commission recommendation on 30 July 2025.
• ESRS — European Sustainability Reporting Standards used under CSRD.
• PUE — Power Usage Effectiveness; data-centre efficiency metric. Lower is better; typical range 1.1 (hyperscale) to 2.0+ (older on-premise).
• Scope 1 emissions — Direct GHG emissions (fuel combustion, owned vehicles).
• Scope 2 emissions — Indirect GHG emissions from purchased electricity, heat or cooling.
• Scope 3 emissions — Indirect value-chain emissions, including outsourced cloud and SaaS services.
• Data centre — Facility used to house servers and networking equipment.
• Cloud computing — On-demand digital storage and processing via remote servers.
• MWh — Megawatt-hour, a unit of energy (1 MWh = 1,000 kWh).
• tCO₂e — Metric tonnes of carbon dioxide equivalent (standard emission unit).
• ESRS S1 — CSRD topical standard covering own workforce.
• ESRS G1 — CSRD topical standard covering business conduct (anti-bribery, governance, data protection).

Conclusion

For IT, SaaS and tech service SMEs, sustainability reporting is mostly about digital infrastructure (Parts 1–3) plus a manageable workforce and governance layer (Part 4). The 2026 Omnibus revision and value-chain cap mean a single VSME-aligned document now answers most enterprise customer questionnaires you will receive, and the underlying data — provider dashboards, electricity invoices, HR records, policy summaries — is data your business already holds.

With consistent documentation and a five-step compilation process, sustainability reporting becomes a reusable asset rather than a recurring scramble — and a credible disclosure can be a meaningful selling point in tenders that reward responsible-supplier criteria.

Cloud services and data centres often fall under Scope 3. See our Scope 3 categories guide for SMEs to identify the categories most relevant to your IT operations.