ESG reporting software in the DACH comparison: selection criteria for CSRD and ESRS

The Corporate Sustainability Reporting Directive (Directive (EU) 2022/2464) requires around 15,000 companies in Germany to report in accordance with the European Sustainability Reporting Standards (ESRS) from the 2025 financial year, and the scope of the audit will be gradually increased to reasonable assurance by 2028 in accordance with Section 324b HGB-E. Anyone who continues to maintain ESG data in Excel and SharePoint not only risks failure reports from the auditor, but also duplication of work in every audit round, every supplier information and every investor inquiry. ESG reporting software is intended to close this gap, but the market is fragmented, the selection criteria have become more technical than many purchasing departments expect, and the providers' sales decks look very similar.

This comparison is aimed at sustainability officers, CFOs, compliance officers and ESG project managers in the DACH region who need to make a reliable tool decision in 2026. It describes which functional blocks are required for ESRS-compliant reporting, how providers differ structurally, what role EU data residency and ISO 27001:2022 play, which cost items are regularly underestimated and why software alone is not enough if the environmental officer or ESG officer is not operationally connected. Others run compliance like a filing cabinet. We run it like software. The article provides a practical comparison grid with seven tough questions that every ESG software must answer in 2026.

The obligation to report on sustainability in Germany arises from the CSRD Implementation Act, which converts Directive (EU) 2022/2464 into Sections 289b ff. HGB and §§ 315b ff. HGB. In Austria, implementation takes place via the Sustainability and Diversity Improvement Act, in Switzerland via Article 964a-c OR with the draft ordinance on climate-related reporting. All three regimes require reports according to the ESRS or comparable standards, a double materiality analysis and an external audit with initially limited assurance according to ISAE 3000 (Revised). There are also industry-specific requirements, for example for financial institutions from the Disclosure Regulation (EU) 2019/2088 (SFDR) and for emissions-intensive companies from the EU Taxonomy Regulation (EU) 2020/852.

For the software, this means specifically: It must map the twelve ESRS (two cross-sector, five environmental, four social, one governance) as a data model, which contains around 1,144 quantitative and Manage qualitative data points and document each value with source, timestamp and processor. The deadline expires as soon as we become aware of it, also in the ESG context: If you do not record supplier data promptly, you will lose audit trails that can no longer be reconstructed later. In addition, there are requirements from the Supply Chain Due Diligence Act (LkSG), which applies in Germany to companies with 1,000 or more employees, and from financial years after January 1, 2028 from the Corporate Sustainability Due Diligence Directive. Anyone looking for a platform here should consider the environmental protection officer and the ESG/sustainability officer as operational anchors, not just the reporting engine. Pure accounting software is not enough; What is needed is a workspace that bundles measures, documents and orders in an audit trail and serves reporting obligations from at least three regimes in parallel. In addition, the ESRS is expected to be expanded to include sector-specific standards in 2026, further increasing the number of data points for energy, mining, agriculture and financial services.

The DACH market for ESG reporting software can be sorted into four clusters, which differ significantly in terms of origin, data depth and breadth of integration. First: Carbon accounting specialists such as Plan A, Sweep, Tanso or Greenly, who start with Scope 1, 2 and 3 and retrofit ESRS modules. They impress with precise emission factor databases, but are often weaker in the social and governance part of the ESRS. Second: ESG platforms such as VERSO, Cority, Sphera or Position Green, which historically come from EHS or sustainability consulting and offer broad ESRS coverage. Here the carbon accounting is solid, but rarely as low as that of specialists.

Third: GRC suites such as SAP Sustainability Control Tower, Workiva or Diligent, which manage ESG as a module within a compliance platform. These are attractive for corporations with an existing SAP or Oracle landscape because master data, financial data and reporting logic are already consolidated. Fourth: Consulting-driven solutions with an Excel add-on character, often under the name of a Big Four brand. They are cheap to start with, but rarely scale beyond the first reporting cycle. For medium-sized companies with 250 to 5,000 employees, clusters one and two are most often relevant because they can be deployed more quickly. Important: None of these solutions replaces the appointment of an internal or external environmental officer in accordance with Section 59 BImSchG or a waste officer in accordance with Section 59 KrWG if the plant or quantity thresholds are exceeded. The software is documented and the person responsible is responsible. The appointment certificate, signed, filed, verifiable, remains the basis of all ESG governance, even if the beautiful dashboard suggests otherwise. Anyone who chooses cluster three should also check whether the ESG module is really productive or is still being sold in roadmap status. A rule of thumb from the DACH procurement process: If the provider cannot show a live demo client with real ESRS data points, the module is probably not yet ready.

The double materiality analysis according to ESRS 1 is the heart of every CSRD report. Suitable software must record inside-out and outside-in assessments separately, document stakeholder workshops and store the materiality matrix in a versioned manner. If you can only upload an Excel table here, you don't have any software, but rather a file server with branding. Specifically, check: Can IROs (Impacts, Risks, Opportunities) be maintained as separate objects with threshold values, probability of occurrence and outcome? Is there a link to the data points of the respective ESRS standards so that every material impact automatically triggers the associated reporting obligations?

The second test dimension is the data model. ESRS requires around 1,144 data points, around 270 of which require XBRL tagging from the European Single Electronic Format (ESEF). The software must know all data points as fields, prepare tagging and allow multiple comparisons across financial years, including restatement logic if numbers need to be corrected retroactively. The third dimension is the audit trail: Every value with source, source system, creator, releaser and timestamp, every change versioned, every justification in the comment field. The auditor calls, the evidence is ready. The fourth dimension is the connection to the 25 officer roles that supply ESG data: Hazardous substances officer for chemicals, data protection officer for employee data, compliance officer for governance metrics, hygiene officer for food and pharmaceutical production. A platform without this role logic produces reports that fall apart in the audit as soon as the auditors ask about responsibilities, appointment certificates and reporting lines, which is regularly the opening question of the audit in the second pilot year. Fifth dimension, often overlooked: action management. ESRS requires not just status quo, but transition plans, goal setting and progress measurement. The software must manage measures with those responsible, budget, deadline and impact indicator and automatically provide target/actual comparisons when moving into the next reporting cycle, without having to maintain separate project management software in parallel.

ESG data is not just sustainability data, it includes supplier information, employee numbers, location data, energy consumption per system and key financial figures. This means that they fall under the GDPR and, depending on the size of the company, under the NIS 2 Directive (Directive (EU) 2022/2555), which is enacted in Germany via the NIS 2 Implementation Act and directly affects around 29,500 companies. The software selection therefore has a hard IT security component that has nothing to do with the pure reporting functionality, but can cause any procurement procedure to fail.

Three criteria are non-negotiable. First: EU data residency with contract guarantee, ideally in the DACH region. According to Schrems II, providers that mirror data in US regions can only be used with considerable additional effort, which in practice often requires a transfer impact assessment. Second: Certification according to ISO/IEC 27001:2022 with a current Statement of Applicability, which covers the 93 controls including the eleven new Annex A controls (e.g. Threat Intelligence, Information Security for Cloud Services, Data Masking, Data Leakage Prevention). Third: NIS 2 suitability if the company is one of the approximately 29,500 affected organisations in Germany. The software must be able to feed incidents that disrupt ESG reporting processes into the 24-hour early warning and 72-hour follow-up reporting path. Fines of up to 10 million euros or 2% of group sales affect not only energy suppliers, but also food manufacturers, logistics companies, chemical companies and healthcare providers. CIVAC operates its workspace exclusively in EU data centres, is certified according to ISO/IEC 27001:2022 and delivers the 24/72 reporting path as a standard process, not as a customizing project with an additional charge. Audit-proof, documented, § 32 BSIG-proof. There is also a practical detail: subcontractor transparency. Many providers use US hyperscalers as sub-providers without this being stated in the main contract. Request a complete subcontractor register including processing activities and check whether backup and disaster recovery systems are also located in the EU. Otherwise, the GDPR risks do not shift, they just hide in the second line of the supply chain.

ESG data rarely arises where it is reported. Energy consumption comes from building management and the energy management system according to ISO 50001, personnel key figures from the HRIS, supplier data from the purchasing system and LkSG risk portal, financial key figures from the ERP, whistleblower reports from the internal reporting office according to HinSchG, quantities of hazardous substances from the hazardous substances register, waste quantities from the disposal cockpit. ESG reporting software without clean connectors becomes a manual re-typing machine, and this is exactly where the errors that the auditor finds arise because target values ​​from the ERP and actual values ​​from the report do not match.

Therefore, check three integration layers. First: standard connectors to SAP S/4HANA, Microsoft Dynamics 365, Oracle Fusion, Workday, Salesforce, ideally with certified interfaces and reference customers in the DACH region. Second: Generic APIs (REST, GraphQL) with webhooks and bulk import, so that niche systems such as a dedicated hazardous materials register, an energy management system according to ISO 50001 or a BImSchV system register can also be connected. Third: Document management with versioning so that uploaded invoices, delivery notes or audit reports do not disappear in the free email folder and the auditor can open the original source of each value within seconds. Only on this basis can appointment certificates, for example for the hazardous substances officer or the waste officer, be linked to the data points for which they are responsible. Audit proof, documented, ESRS proof. Anyone who only attempts this mapping during the audit period will lose several hours of research time per data point, sometimes 1,144 data points, sometimes several business areas and subsidiaries. The supplier interface is also important: ESRS E1, S1 and S2 require third-party data that is rarely available in a cloud system. A mature ESG software therefore provides a supplier portal in which suppliers enter their own data directly, with multilingual capabilities, reminder levels and progress displays. Anyone who continues to collect supplier data via email Excel accepts manual transfer errors in the audit source path.

List prices for ESG reporting software in the DACH region in 2026 typically range between 18,000 euros per year for medium-sized companies and 250,000 euros per year for corporate platforms. This range is not very meaningful as long as the total cost of ownership is not recorded. Three items are regularly underestimated and exceed the original budget once implementation begins.

First: implementation costs. Data model connection, role concept, initial filling, supplier communication and training often cost one and a half to three times as much as the first annual licence. Anyone who receives a fixed price offer without data point mapping should ask whether the mapping is part of the implementation or must be ordered separately. Second: consulting costs for materiality analysis, gap analysis and audit preparation. These are additional costs, often for the same consultancy that sold the software, and are in the six-figure range per reporting year. Third: officer costs. If the company moves systems or quantities that require reporting, the appointment of an environmental officer, hazardous materials officer or waste officer is mandatory; Classic market prices are 4,500 to 18,000 euros per year per role, plus hourly rates of 180 to 320 euros for audit support. CIVAC combines both worlds: workspace licence for the internal representative or officer-as-a-service by appointed external parties, with an SLA of two working days instead of two to six weeks. Licence the workspace for your internal representatives, or have our representatives order it. Both models are contained in a contract that includes the appointment certificate, reporting and audit templates, without a separate consulting mandate or daily rate negotiation in the moment of crisis. Fourth, often overlooked TCO item: exit costs. Anyone who changes providers has to export the data model, history and documents, often in proprietary formats. Request a contractually guaranteed data export clause with ESEF-XBRL-compliant output and a maximum notice period of four weeks. Otherwise, the second reporting cycle will be more expensive than the first due to pure lock-in.

The CSRD report is subject to audit, initially with limited assurance in accordance with ISAE 3000 (Revised). From financial years beginning after January 1, 2028, the EU Commission should present the standard for reasonable assurance, which brings the audit depth closer to that of an annual financial statement audit according to ISA 200 ff. What this means for the software is that it has to document today in the way that the auditor will ask in three years, and not just when the question has been asked. Anyone who subsequently rebuilds the data model and the audit trail will lose at least one reporting cycle.

Specifically, this means five requirements. First: Full data lineage for every value, from ESEF tagging to the source system to the original receipt, with a clickable path. Second: role and approval workflow with a four-eyes principle for critical data points, especially Scope 3 emissions, supplier key figures and diversity information. Third: Versioning of methods and assumptions so that changes in the second reporting year remain traceable and restatements are clearly documented. Fourth: A complete logbook of the materiality analysis, including the non-material topics with justification, because ESRS 1 explicitly requires that the exclusions also be documented. Fifth: An interface to the responsible representative's appointment certificate so that the auditor can see who is responsible for the data and whether the person has been formally appointed. Others run compliance like a filing cabinet. We run it like software. From 490 ready-to-use audit templates, materiality analysis, IRO assessment, ESRS data point matrix and audit Q&A can be generated directly instead of having to build them from scratch before each audit, and this demonstrably saves several weeks in the first round of audits. An observation from real audits in 2025: Auditors are increasingly asking for samples at the document level, no longer just for control evidence. Software that opens each value to the original document with a click significantly shortens the testing time and reduces the number of findings. On the other hand, if you have to manually reconstruct each sample from email attachments and SharePoint folders, you will receive findings for process deficiencies, even if the numbers are correct in terms of content.

Instead of a provider table that becomes outdated after three months, a robust comparison grid with seven questions that every ESG software must be able to answer in 2026 helps. Anyone who answers even one of these evasively will sort themselves out of the shortlist. The questions come from real procurement procedures in the DACH region and cover the areas of data, security, ESRS depth, roles and service levels.

Firstly: Which data centre is the data located in, and which EU member states are contractually guaranteed as the location? Secondly: Is there a current ISO/IEC 27001:2022 certification and which Annex A controls are excluded from the Statement of Applicability? Third: Which ESRS data points are mapped natively, which via custom fields, which not at all? Ask for the mapping table before signing the contract, not after. Fourth, how is the dual materiality analysis technically supported and is there a versioned IRO register linked to data points? Fifth, what standard connectors exist to the ERP, HR and EHS systems running in the company, and which ones are promised for the next roadmap phase without existing today? Sixth: How is the appointment of environmental, ESG or waste officers documented, and can the appointment certificate be stored in the system and linked to the responsible data points? Seventh: What SLAs apply to incident reports within the meaning of the NIS 2 guideline, and how are the 24h and 72h deadlines represented? Software that clearly answers these seven questions is a candidate for the shortlist. Anyone who evades costs more in the audit than they save in licence price, and this applies regardless of company size and industry. It is also worth doing a reality check about reference customers: ask for two to three DACH references from your own industry and make 30-minute calls without the provider being present. Ask specifically about implementation time, findings in the first test cycle and support response times in day-to-day business. The answers regularly differ significantly from the marketing statements and determine whether the platform survives its own reporting cycle.

ESG reporting software is only half the answer. The other half are the people who must be formally appointed according to BImSchG, KrWG, WHG, GefStoffV, CSRD and LkSG so that reports and measures are legally secure. CIVAC is therefore not pure software, but rather a compliance platform and officer-as-a-service in one contract. The workspace represents 25 representative roles, 93 controls according to ISO/IEC 27001:2022 and 490 audit templates. The EU data residency and the 24/72 reporting path according to NIS-2 are part of the standard, not extra charge options. Appointment certificates, reporting lines and audit trails are in the same interface as ESRS data points, IRO registers and materiality analysis.

There are two clear paths for ESG managers. Way one: You already have an internal environmental or sustainability officer and need a workspace that bundles ESRS data points, IRO registers, appointment certificates and audit trails. Way two: You want an external, appointed environmental protection officer, ESG/sustainability officer or waste officer with a clear reporting line, instead of another advisory body with no responsibility. Licence the workspace for your internal representatives, or have our representatives order it, or combine both according to roles. Turn reading into a mandate.: Write to info@civac.de or use the contact form, describe the systems, locations and scope of the report that are subject to reporting. The appointment certificate, reporting line and workspace access are available within two working days, not two to six weeks. This shifts the selection decision from the pure tool question to the operational question of who is responsible for, checks and releases which data points. Three pieces of information are sufficient for initial contact: industry and locations, estimated number of employees and information as to whether the company is already subject to CSRD or reports voluntarily. Based on this, CIVAC creates a proposal that brings together the workspace licence, possible officer orders, EU data residency and 24/72 NIS-2 reporting path in one document, instead of negotiating four contracts with four suppliers.