The EU’s Corporate Sustainability Reporting Directive (CSRD) introduces considerable changes to the Environmental, Social, and Governance (ESG) disclosures by mandating double materiality, value chain transparency, and external assurance. This study investigates how Nordic IT firms (N = 14) are operationalizing CSRD compliance. Through qualitative design and thematic analysis of publicly disclosed sustainability reports, the study identifies diverse organizational responses to regulatory demands, including internal ESG governance, strategic alignment, and adaptations in digital infrastructure. While the firms capitalize on CSRD to advance internal governance and sustainability practices, challenges persist in data collection, Scope 3 emissions reporting, fragmented data systems, and supplier engagement. We propose a conceptual framework illustrating how IT firms translate regulatory mandates into actionable ESG capabilities and sustainability practices. The study contributes to institutional and sustainability leadership discourse by offering a process-based perspective on ESG capability development at the intersection of digital transformation and regulatory compliance.