ASRS Group 2 Is Live: What We're Seeing in the First Month

Five days. That's how long ASRS Group 2 reporting has been live. Financial years starting on or after 1 July 2026 now carry mandatory climate disclosure obligations for mid-market entities — the ones with $200M+ revenue, $500M+ gross assets, or 250+ employees (meet two of three). And every NGER reporter not already in Group 1 got pulled in automatically through the registration pathway, whether they expected it or not.

We've been fielding calls since Monday. Some are calm, methodical, already running data through systems they set up months ago. But most calls sound more like this: "We thought we had more time."

You didn't. And that gap between companies who prepared and companies who assumed they'd figure it out later is already visible. In the first month of ASRS Group 2 reporting, we're watching real patterns emerge — patterns that will define who gets through this cleanly and who ends up in ASIC's review crosshairs.

The two-speed reality

The split is stark. Maybe 30% of the Group 2 companies we work with had their data pipeline, governance framework, and assurance engagement locked in before 1 July. They're not relaxed — nobody is relaxed about first-year mandatory reporting — but they're operational. They know where their data lives. They've already processed Q3 and Q4 FY26 utility bills. Their assurance provider has seen a draft methodology. Their board has been briefed.

Then there's the other 70%.

These are companies where ASRS was a recurring agenda item at quarterly meetings but never became an active workstream. Someone was "looking into it." A consultant produced a scoping proposal in March that sat in someone's inbox. The CFO assumed the sustainability manager was across it. The sustainability manager assumed the CFO had allocated budget. Nobody confirmed anything with anyone, and now it's July.

We had one company — a food manufacturer in Western Sydney, around 300 employees, $230M revenue — call us on 2 July asking if they could "get started and backfill the data later." The answer is technically yes, your reporting period just started so you're collecting data going forward. But their scenario analysis isn't done. Their governance disclosures aren't written. They haven't engaged an assurance provider. And they still don't have a complete inventory of their Scope 1 sources. That's not a data problem. That's a twelve-month sprint that should have started in February.

We wrote a detailed breakdown of what Group 2 actually requires back in February. If you haven't read it, now would be the time.

The assurance bottleneck is real

This is the one we've been warning about and it's playing out exactly as expected.

Australia has a projected shortfall of over 10,000 qualified accountants by 2026, according to ABS workforce projections and industry analysis. CPA Australia's Professional Year Program enrolments cratered from 7,122 in 2018 to roughly 340 in 2024. That's a 95% decline in the pipeline of new accounting graduates entering the profession. CA ANZ survey data shows vacancy fill rates below 67% for external auditors.

Now layer mandatory sustainability assurance on top of that existing shortage. Every Group 2 entity needs limited assurance over their governance disclosures, climate risk strategy, and Scope 1 and 2 emissions under ASSA 5010. That's not optional. It's not a "nice to have for your first year." It's a legal requirement from year one.

The Big Four are booked. They were booked in March. Mid-tier firms — BDO, Grant Thornton, Pitcher Partners, William Buck — started filling their sustainability assurance books in early 2026 off the back of Group 1 demand. Some still have capacity. But the ones who do are quoting engagement timelines that push into late 2027, which means your assurance work might not start until well into your reporting period.

Here's the practical problem. If you can't secure an assurance provider until October or November 2026, they're reviewing your methodology after you've already been collecting data for four or five months. If they flag a problem with your calculation approach — wrong emission factors, incorrect unit conversions, Scope 1 sources you missed — you're reworking months of data. That's not a theoretical risk. We saw it happen with Group 1.

Our advice hasn't changed since February: if you don't have an assurance engagement signed, stop reading this and go make phone calls. Today. Not next week.

Data quality problems surfacing early

The calls we're getting in this first week aren't about strategy or governance or scenario analysis. They're about data. Specifically, the moment when someone actually tries to assemble twelve months of utility bills and fuel records and realises how bad the situation is.

A few recurring themes.

Missing accounts. A property company with 40 sites discovered they had utility data for 34 of them. Six sites had electricity accounts registered to the landlord, the tenant, or a previous building manager — and nobody knew which. Getting those accounts identified, contacted, and the historical data retrieved will take weeks. Maybe months.

Inconsistent units. One manufacturing client had gas consumption recorded in megajoules on some invoices and gigajoules on others, depending on the retailer. Their internal spreadsheet didn't distinguish between the two. A factor-of-1,000 error sitting quietly in a cell.

No source documents. This is the most common one. Companies know roughly how much electricity they used last year because they paid the bills. But the actual PDFs? Downloaded once, maybe forwarded to accounts payable, maybe saved to a shared drive that got reorganised in April. When the assurance provider asks "show me the source document for this 247 MWh figure," the answer can't be "I think it's in an email somewhere."

ASIC has explicitly stated they'll use their directions power from 2026 to compel entities to confirm accuracy, provide supporting documentation, or correct statements that appear incomplete or misleading. If your documentation trail is "we reconstructed the numbers from bank statements because we couldn't find the invoices," that's going to be a difficult conversation.

We built Carbonly's AI document processing pipeline specifically for this problem. Every extracted data point links back to the source PDF. The calculation chain is logged. But honestly, even companies using spreadsheets can avoid the worst outcomes here if they set up a proper document management system now — first week of the reporting period — and enforce it consistently for twelve months.

What Group 1 taught us (and what Group 2 isn't learning)

We published a full analysis of what Group 1 reporters got wrong back in March. The short version: consultant dependency, generic scenario analysis that crumbled under assurance scrutiny, and emission numbers that moved when someone actually checked them.

ASIC's first review of Group 1 sustainability reports is underway. They've already signalled what they found when reviewing voluntary climate disclosures ahead of the mandatory regime: repetitive information, scenario analysis that "lacked detail about the underlying assumptions," and transition plans disconnected from actual targets and strategies. They prompted 15 companies and 4 superannuation trustees to revise or retract sustainability claims during their 2024-25 surveillance. Combined penalties from three greenwashing cases — Mercer ($11.3M), Vanguard ($12.9M), and Active Super ($10.5M) — hit $34.7 million.

Those were greenwashing actions, not ASRS non-compliance. But they signal where ASIC's attention sits. Accuracy matters. Vague claims get punished.

The Group 1 lesson that Group 2 companies should tattoo on their forearms is this: don't buy a report, build a capability. The companies that hired consultants to produce a one-off disclosure for $200K-$400K are now scrambling in year two because nobody internal understands the model. The ones who invested in repeatable systems — even imperfect ones — are updating last year's work instead of starting over.

That's not an abstract observation. We're watching it happen right now. Group 2 companies that engaged consultants to "handle everything" are calling us because the consultant delivered a gap analysis and a proposal for $180K of work, and the CFO is asking whether there's a faster path. There is, but it involves actually understanding your own emissions data — not outsourcing the understanding.

The scope 3 reprieve and why it's a trap

One piece of genuine good news: Scope 3 emissions are deferred for Group 2's first reporting period. You don't have to disclose them until your second year.

Don't mistake that for a free pass.

We're not fully confident in anyone's Scope 3 methodology yet — including our own, if we're honest. The supplier data quality problem is enormous. A mid-market company with 200+ suppliers might get actual emissions data from maybe 10-15 of them. The rest is estimates built on spend-based proxies that can be wildly inaccurate. We're working on it. Everyone's working on it. But nobody should pretend Scope 3 is solved.

Still, starting Scope 3 data collection now — even rough, category-level stuff — is the single best thing you can do to make year two less painful. The companies that defer Scope 3 thinking entirely until their second reporting period will face the same twelve-month sprint that Group 2 laggards are facing right now with Scope 1 and 2. We know how that goes. We're watching it unfold in real time.

What Group 3 should be doing right now

Group 3 entities — $50M+ revenue, $25M+ assets, 100+ employees — start reporting for financial years from 1 July 2027. That's exactly twelve months away.

If you're Group 3 and you're reading this thinking "we've got a year," I'd point you at the Group 2 companies currently scrambling and ask you to notice something. Most of them also thought they had a year. In February, July felt distant. Now it's here and they're behind.

Three things Group 3 companies should do before the end of this month.

First, confirm your Group 3 status. The size thresholds are lower than you might expect. $50M revenue, $25M gross assets, 100 employees — meet two of three. Check the consolidated numbers, not just the parent entity. And check whether you're an NGER reporter, because that pulls you into Group 2 instead.

Second, inventory your emissions data sources. Every electricity account, every gas account, every fuel card, every refrigerant top-up log. Don't calculate anything yet. Just find out where the data physically lives and who controls access to it. This takes two to four weeks if someone is actually dedicated to it, and it's the step that catches every late starter off guard.

Third, get a rough budget approved. Based on what we're seeing across Group 2, a realistic first-year compliance spend for a mid-market entity is $200,000 to $350,000 all-in — covering assurance, scenario analysis, data systems, and internal or fractional sustainability leadership. That number shocks CFOs who haven't been tracking ASRS closely. Better to have the conversation now, with twelve months of lead time, than in March 2027 when the spend is unavoidable and the timeline is impossible.

Our Group 2 compliance checklist maps directly to Group 3 requirements — the disclosure obligations are identical, just shifted by twelve months.

The modified liability window is closing

One detail that keeps getting lost in the noise. The transitional liability protection — where only ASIC can bring action on Scope 3 emissions, scenario analysis, and transition plan disclosures, limited to injunctions and declarations — runs from 1 January 2025 to 31 December 2027.

For Group 2 entities reporting from 1 July 2026, your first reporting period falls within this window. Your second reporting period — when Scope 3 becomes mandatory — extends beyond it. From 1 January 2028, private litigants can bring civil claims against your climate disclosures. Shareholders. NGOs. Activist investors.

And remember: Scope 1 and 2 emissions have no transitional protection at all. Full liability from day one. Getting those numbers wrong exposes directors personally, with penalties up to $15 million or 10% of annual turnover. That's not a compliance nuisance. That's a legal risk that sits alongside your financial statements.

This is why data quality isn't a "nice to have for year one." It's the difference between defensible disclosures and personal liability for every director who signs the declaration.

What we're telling our own clients

We're a carbon accounting software company. We have a commercial interest in companies automating their emissions data collection. I'm not going to pretend otherwise.

But here's what we're actually saying in every conversation this week, regardless of whether they buy our software or not.

Get your assurance provider signed this month. Not shortlisted. Signed. Every week you delay, the pool shrinks and the timeline compresses.

Centralise your source documents immediately. Every utility bill, fuel receipt, and refrigerant log from 1 July forward goes into one system — whether that's Carbonly, a competitor, or a well-organised SharePoint folder. The specific tool matters less than the discipline. Twelve months from now, an assurance provider is going to ask you to produce the source document for a specific figure, and you need to be able to find it in under a minute.

Brief your board before August. Directors need to understand what they'll be signing off on. Two hours, minimum. Cover the four AASB S2 pillars, the liability framework, and the assurance timeline. If they haven't been through a proper climate disclosure briefing, they're not ready to sign a declaration.

And start Scope 3 data collection now, even though it's deferred. You'll thank yourself in eighteen months.

ASRS Group 2 is live. The reporting period has started. The companies that treat this week as day one of a structured twelve-month process will be fine. The ones that treat it as a problem for Q3 or Q4 will repeat every mistake Group 1 made — with less sympathy from ASIC and less availability from assurance providers.

Your move.

Related Reading:

Carbonly.ai automates emissions data extraction from utility bills, invoices, and operational documents for Australian companies facing ASRS and NGER reporting. Our platform provides the auditable data trail that assurance providers require — built specifically for Australian emission factors, regulatory frameworks, and reporting timelines.