What ESMA’s 2025 Enforcement Cycle Means for 2026 ESRS Report Preparers

The European Securities and Markets Authority (ESMA), the EU’s financial markets regulator and supervisor, has published its Report on 2025 Corporate reporting enforcement and regulatory activities for issuers, auditors and other corporate reporting professionals.

For sustainability reporting the report provides:

  • Key messages to improve future sustainability reports by assessing how issuers comply with European Sustainability Reporting Standards (ESRS) and digital reporting obligations.
  • An overview of the activities carried out by ESMA and enforcers to promote transparency and accountability to the market.

The scope of enforcement and regulatory activities reported relate to listed companies. As such, the report does not cover all enforcement and regulatory activities undertaken by enforcers.

At the end of 2025, approximately 2,000 issuers’ sustainability statements were within the scope of ESRS‑based enforcement in the EEA (Articles 19a and 29a), the Top-3 being:

  • 299 in Sweden,
  • 268 in Germany,
  • 223 in France –
  • followed by 142 in Italy.

2025 was the first year of ESRS enforcement for many issuers. In some Member States, CSRD was not yet transposed, so issuers remained under NFRD but some voluntarily applied ESRS.

63% of issuers reported under ESRS following national CSRD transposition and 37% reported voluntarily under ESRS in jurisdictions where NFRD still applied (based on the analyzed sample).

Enforcers continued to focus on improving the quality of sustainability reporting in 2025, in a way that acknowledges the learning curve which issuers are on and the changing regulatory environment during the Omnibus period. Expect less tolerance for shortcomings as ESRS moves into full enforcement.

Most enforcement actions taken on statements prepared in accordance with the CSRD/ESRS related to reporting on climate change under ESRS E1 (40%) and on the general disclosures required by ESRS 2 (36%).

The high proportion of actions relating to the topical area of climate change reporting might be due to this area being more mature than other reporting areas and enforcers therefore having slightly higher expectations of issuers.

Key takeaways for 2026 ESRS Preparers

ESMA’s 2025 enforcement cycle highlights three dominant themes for sustainability reporting:

  1. Materiality disclosures remain overly generic – issuers must demonstrate how they performed double materiality, not merely state that they followed ESRS instructions.
  1. Terminology, referencing and connectivity are insufficient
  • frequent use of non‑ESRS terminology hinders mapping to ESRS topics and obscures the applicable disclosure requirements,
  • inconsistent referencing makes required information difficult to locate and hinders the overall cohesiveness of the sustainability narrative, and
  • missing links to the financial statements makes it difficult to understand how sustainability topics affect financial reporting.
  1. Taxonomy Article 8 disclosures remain inconsistent – particularly the alignment between transition plans and Taxonomy objectives, and incomplete or unclear KPI referencing.

In addition, two additional areas of attention emerge:

  1. Preparing for digital mark‑up and XBRL tagging of sustainability statements – with particular emphasis on tagging completeness and machine readability: we learn that mandatory financial information must be presented as text and correctly marked up, not embedded in images.
  2. Emerging interpretative issues discussed within the SRWG – enforcers continue to exchange cases to ensure consistent application of ESRS requirements, including: Portraying remediation of negative impacts as positive impacts; Treatment of franchise workers (S1 vs S2); Remuneration ratio when the CEO is not the highest‑paid individual (S1‑16); Explaining how Taxonomy alignment was assessed; Financial undertakings stating they have no Taxonomy‑aligned activities.

Materiality Assessment (ESRS 2 + topical standards)

Overall quality of firstyear ESRS materiality reporting 

Most issuers described their double‑materiality assessment, but many disclosures remained generic and did not explain how the methodology was adapted to the issuer’s own business model, value chain, or risk profile. Enforcers frequently noted boilerplate language and missing topical‑level detail, especially where issuers did not explain why certain sustainability matters were deemed not material.

Process disclosures: thresholds, parameters, stakeholder engagement 

Around 60% of issuers provided adequate information on thresholds, input parameters, and stakeholder engagement. However, in many cases the disclosures lacked entity‑specific reasoning, making it difficult to understand how the assessment was actually performed or how decisions were reached.

IRO identification and terminology issues 

Enforcers found frequent use of non‑ESRS terminology, which complicated the mapping to ESRS topics and sometimes obscured which topical disclosure requirements should apply.

Completeness of ESRS disclosure requirement (DR) lists 

Most issuers provided a list of ESRS DRs they complied with, but lists were often incomplete, especially regarding datapoints derived from other EU legislation. Some issuers omitted DRs that should have been disclosed based on their own materiality conclusions.

What this signals for 2026 (implicit expectations)

  • Describe your actual process, not the ESRS textbook steps.
  • Explain thresholds, parameters, weighting, stakeholder engagement, and how they influenced outcomes.
  • Use ESRS terminology consistently (impacts, risks, opportunities; sustainability topics).
  • Ensure traceability between IROs, sustainability topics, and topical DRs.
  • Provide a complete list of ESRS DRs complied with and datapoints from other EU legislation.
  • Ensure topical disclosures match the materiality results – no missing DRs for material topics.

In short, mature, entity specific, auditable materiality processes

Scope & Structure of the Sustainability Statement, including connectivity and financial linkages

Scope and structure

Most issuers confirmed that they prepared the sustainability statement for the same scope as that of the financial statements, but enforcers noted some cases of misalignment.

Issuers generally followed the structure of the sustainability statement in four parts, as prescribed by the ESRS, although enforcers identified some deviations where custom structures were implemented and/or some information was positioned outside the designated section.

Referencing practices and connectivity

Only 35% of the issuers in the sample provided full information to enable an understanding of the connections to other parts of the issuers’ corporate reporting.

For some issuers who made use of incorporation by reference, enforcers identified situations where the use of incorporation by reference impaired the overall cohesiveness and readability of the sustainability statement, notably

  • when hyperlinks were broken or led to non‑existent webpages,
  • when large portions of governance and strategy, business model and value chain sections were redirected to broad sections of the Board of Directors’ report spanning multiple pages and
  • when references to other reports (such as the consolidated management report) did not align with the sections indicated by the issuer, making required disclosures difficult to locate.

These issues, combined with inconsistent referencing practices, created fragmentation and hindered users’ ability to follow the sustainability narrative.

Cross‑references were often incomplete, non‑specific or missing altogether, with many references pointing to broad financial statement notes that did not isolate sustainability‑related CapEx, OpEx, financial effects or resources required under ESRS.

In other cases, issuers stated that no significant financial effects or dedicated resources existed and therefore did not reference the financial statements, while in others they disclosed financial effects without linking them to the corresponding accounting figures.

Outside of Taxonomy issuers rarely provided page numbers, explicit datapoint identification or quantitative linkages, and in some cases the financial statements themselves did not contain the information implied in the sustainability report, resulting in fragmented, inconsistent and only partially connected reporting.

In many cases issuers either disclosed no current financial effects or had no action plans requiring significant CapEx or OpEx.

References, when provided, were generic, incomplete or limited to taxonomy disclosures, with missing cross‑references, mismatched figures or unclear indications of whether effects were current or anticipated.

Several issuers relied solely on qualitative descriptions of risks and opportunities and stated that no material financial effects existed, while others disclosed CapEx or OpEx amounts without connecting them to the financial statements.

As a result, enforcers concluded that the disclosures did not provide the required linkage between sustainability information and the financial statements, leading to no or only very limited connectivity.

What this signals for 2026 (implicit expectations)

  • Confirm full alignment between financial and sustainability consolidation scopes; explain any exceptions.
  • Follow ESRS structure and terminology rigorously to avoid ambiguity and ensure traceability.
  • Use incorporation by reference only when all ESRS conditions are met.
  • Ensure explicit cross‑references with page numbers, datapoint identifiers, and quantitative reconciliation.
  • Provide clear, traceable links between sustainability disclosures and the financial statements; no more generic or boilerplate connectivity statements.
  • Ensure consistency between sustainability statements and accounting figures.
  • Ensure Taxonomy KPIs tie back to the financial statements.
  • Clearly articulate current and anticipated financial impacts.
  • Reconcile CapEx, OpEx and other financial effects with the financial statements.
  • Ensure clear linkage between IROs, sustainability topics and their financial consequences, including how these relate to Taxonomy KPIs and transition planning.
  • Provide entity‑specific explanations of how sustainability topics affect financial reporting.
  • Substantiate when claiming no significant financial effects exist, supported by data rather than generic statements.

Disclosures relating to Article 8 of the Taxonomy Regulation

Consistency with transition plan

Only 24% of issuers in the sample provided explanations in their ESRS E1-1 transition plan disclosures which showed consistency with any objective or plans reported for the alignment of activities with the Taxonomy criteria.

For 40% of issuers in the sample there was no information under E1‑1 and no Taxonomy objectives because the issuers explained that they had not yet developed a transition plan, lacked the necessary data, methodologies, evidence systems or sectoral frameworks to set Taxonomy‑related objectives, and therefore postponed alignment work to future years.

What this signals for 2026 (implicit expectations)

  • Clearly articulate Taxonomy‑related objectives within transition plans, showing how activities will align with Taxonomy criteria over time.
  • Demonstrate consistency between ESRS E1‑1 transition plan disclosures and Taxonomy alignment objectives, avoiding disconnects between climate strategy and Taxonomy reporting.
  • Ensure transparent disclosure of current and anticipated financial effects linked to transition pathways and Taxonomy alignment.

Digital markup and XBRL tagging

To prepare for digital mark‑up, sustainability report preparers should also consider ESMA’s and national enforcers’ key messages on the compliance of Annual Financial Reports (AFRs) prepared and published in the ESEF format in 2025 (p. 34):

Machinereadability requirements: To safeguard machine readability, issuers must avoid embedding mandatory elements of AFR and relevant financial information within images, ensuring that all mandatory disclosures are properly marked up and text‑based, where such disclosures are applicable.

Use of PDF version: Where a PDF AFR is provided as an additional convenience –  for example, as a voluntary extra language version – issuers must include a clear disclaimer stating that the PDF is not the official report and that the ESEF version prevails for Transparency Directive purposes. Any inconsistencies or outdated PDFs should be corrected or replaced without delay.

Tagging all numeric data: Issuers should ensure that all numbers in a stated currency are marked up even if part of a footnote, and that empty fields and/or hyphens which represent the meaning “nil” are also transformed and marked up. This means that every single numeric value – even tiny ones in footnotes, and even “zero” represented by a dash – must be tagged in XBRL, because un‑tagged numbers break machine‑readability, comparability, and automated analysis. (In XBRL/ESEF, “nil” is a data point, not an absence of data.)

Other issues that were discussed

Within the Sustainability Reporting Working Group (SRWG), enforcers also discuss the application and enforcement of the sustainability information framework in regular meetings, ad-hoc conference calls or through written procedure. Case discussions enable enforcers to learn about the experience of other enforcers who have already encountered similar issues and to gather useful input for the analysis of technical issues.

Examples of cases discussed:

Portraying remediation of negative impacts as positive impacts

Enforcers discussed the case of an issuer which had presented the possible remediation of negative impacts coming from its own business as positive impacts, using EFRAG’s guidance as a reference point. The case was useful since it illustrates a tendency which enforcers might encounter and it furthermore provided enforcers with the occasion to discuss the clarification of this matter which is included in the draft revised ESRS.

How to treat franchises in the sustainability statement

The discussion revolved around whether to cover franchise workers under S1 (Own workforce – as non-employees) or S2 (Workers in the value chain). As the reporting obligations under S1 are more substantial, this question is important. Enforcers considered that classification may depend on the nature of the franchise contract, notably whether the issuer controls the work performed by the franchise workers which, enforcers agreed, was usually not the case.

Remuneration disclosure when CEO is not highest paid individual (S1-16, paras 95 and 97b ESRS Set 1)

In relation to the requirement to disclose the ratio between the remuneration of an issuer’s highest paid individual and the median remuneration for all employees excluding the highest paid individual, enforcers discussed an observed diversity in application whereby some issuers calculate the ratio based on the remuneration of the CEO even when they are not the highest paid individual while other issuers use the remuneration of the highest paid individual even when they are not the CEO. The divergence likely comes from the word “CEO” in the footnote reference to an SFDR PAI indicator whereas S1-16 itself consistently refers to “highest paid individual” which enforcers therefore agreed was the reference point.

Disclosure on how alignment in relation Article 8 of the Taxonomy Regulation was assessed

Enforcers discussed the requirement for disclosures explaining how issuers assessed the Taxonomy alignment of their activities. In one specific case, the issuer only briefly stated that it complied with the disclosure requirements regarding technical screening criteria and do no significant harm without providing any explanation or analysis regarding how it assessed its alignment. However, enforcers had generally seen several such cases and agreed that explanation was needed on the way in which issuers had assessed their alignment, notably for some activities where alignment is less obvious.

Statement that financial undertakings have no Article 8 Taxonomy-aligned economic activities 

Enforcers discussed how to apply the new provision in the Amending Delegated Act, published by the Commission in July 2025, according to which financial undertakings do not have to report under the Taxonomy provided that they include a statement in the management report that they do not have Taxonomy aligned economic activities. Notably, enforcers discussed that, if this statement is to be covered by the assurance engagement, it has to sit within the part of the management report dedicated to sustainability reporting.


The best way to prepare? Guided digital ESRS end-to-end templates.

👉 Contact us if you want to use our guided and pre-markedup digital ESRS end-to-end templates to get a head start.

The full Report on 2025 Corporate reporting enforcement and regulatory activities published on 7 May 2026 by ESMA is available here:

https://www.esma.europa.eu/press-news/esma-news/esma-outlines-enforcement-activities-corporate-reporting-across-eea-2025

https://www.esma.europa.eu/sites/default/files/2026-05/ESMA32-2064178921-9413_Report_on_2025_Corporate_reporting_enforcement_and_regulatory_activities.pdf

 

 

ECB Warns: Banks Still Underestimate Climate & Nature Related Risks

Why Companies Should Care

The European Central Bank has released its updated compendium of good practices on climate and nature‑related risk management – and the message is blunt: progress is real, but major blind spots remain.

Banks now have the basic frameworks in place, yet implementation is uneven. Many still fail to cover all material risk drivers, portfolios, and transmission channels.

🔎 Two areas stand out:

  • Physical climate risks – methodologies are still immature, and the non‑linear, forward‑looking nature of these risks means they are likely underestimated.
  • Nature‑related risks – most banks have run materiality assessments, but two‑thirds haven’t turned them into concrete actions. KRIs exist, but often without thresholds that trigger decisions. KRI = Key Risk Indicator measuring risk exposure.

Notably, one‑third of all new good practices focus on nature‑related risks – a clear signal of supervisory priorities.

⚠️ A risk landscape defined by uncertainty

The ECB warns that Europe is moving toward a disorderly transition, with faster‑moving physical and transition risks. Banks must prepare for a wider range of plausible futures, supported by more granular scenario analysis and stress testing.

🛡️ The insurance protection gap is widening

With insurance coverage shrinking and public finances strained, more climate‑ and nature‑related losses will fall directly on banks’ balance sheets – increasing scrutiny on exposed sectors and borrowers.

🌿 What this means for companies

This is not just a banking issue. It directly affects corporates seeking financing or refinancing.

  1. Expect more granular asset‑level data requests on Physical risk exposure, Transition plans, Nature‑related dependencies and impacts and Adaptation measures
  2. Weak disclosures = higher financing costs. If banks cannot quantify your risks, they will price in uncertainty.
  3. Nature‑related risks enter mainstream credit analysis. Expect more questions on biodiversity, land use, water dependency, and supply‑chain exposure.
  4. Transition plans must be credible and operational. Banks are moving from “statements” to evidence of execution. Companies without costed, time‑bound plans will face tighter covenants and reduced credit appetite.
  5. Scenario analysis becomes a shared language. Companies able to articulate resilience under disorderly transition scenarios will stand out.

The ECB’s message is clear: Climate and nature‑related risks are rising, complex, and still underestimated. Banks must accelerate – and so must companies.

Those who provide granular data, credible transition plans, and transparent nature‑related disclosures will secure better financing conditions and stronger long‑term resilience.

📘 The best way to prepare? Adopt ESRS.

The ECB’s expectations align closely with the European Sustainability Reporting Standards (ESRS). For companies, learning and adopting ESRS is the fastest, most reliable way to meet banks’ rising data needs.

👉 Contact us if you want to use our guided digital ESRS end-to-end templates to get a head start.

 


Source: https://www.bankingsupervision.europa.eu/ecb/pub/pdf/ssm.thematicreviewcercompendiumgoodpractices052026.en.pdf

 

 

ESG Shifting Tides

Across the Atlantic, the ESG narrative is splitting in two – as highlighted in the Harvard Law School Forum article “ESG Shifting Tides” – and it is reshaping the landscape in which companies operate.

In the U.S., ESG as a label is shrinking. Mentions in S&P 500 and Fortune 1000 proxies peaked in 2024, fell in 2025, and early 2026 filings have dropped below 2022 levels.

Companies are “greenhushing,” stripping out sustainability language to avoid political, regulatory, and litigation risk.

At the judicial level, new 2025-2026 cases challenge ESG mandates under the doctrine of “unconstitutional vagueness,” arguing that ESG criteria lack objective definition and cannot guide fiduciary duty.

Yet sustainability references in 10‑K risk factors continue to rise – because removing them could expose companies to liability if investors face losses.

Target’s 2021-2025 proxy evolution captures the shift:

▪️ 2021 – sustainability as risk oversight
▪️ 2022-2023 – ESG as a strategic brand asset
▪️ 2024-2025 – ESG nearly disappears, replaced by “resilience” and “long‑term value creation”

ESG isn’t dead, but it’s being rebranded to avoid risk.

Europe, however, is taking a longer‑term view, grounded in the understanding that a company’s negative impacts and dependencies are not abstract ESG issues but concrete financial risks.

The revised ESRS and SFDR 2.0 are not a retreat but a consolidation. While the U.S. backs away from ESG terminology, the EU is doubling down on clarity, comparability, and enforceability.

The ESRS revision simplifies reporting while preserving core objectives. It strengthens definitions, aligns with the Accounting Directive, and reinforces double materiality, preventing companies from reducing sustainability to a pure risk narrative.

SFDR 2.0 complements this by providing a clear financial product framework – clear categories, naming rules, exclusions, thresholds, PAIs – built on CSRD/ESRS data.

This is the opposite of “unconstitutional vagueness.” It is regulatory architecture designed to reduce ambiguity, prevent greenwashing, and support long‑term capital allocation.

ESG as branding is fading. ESG as evidence is rising ‼️ Regulators and investors expect structured, defensible data – not slogans.

Risk‑only framing won’t work in the EU. Double materiality requires addressing both impacts and financial risks.

Simplification is not dilution. ESRS and SFDR 2.0 streamline reporting but raise expectations on quality and comparability.

Capital follows clarity. While U.S. ESG funds face outflows, the EU is building conditions for stable, long‑term sustainable finance.

The EU is not following the U.S. retreat. It is professionalizing sustainability reporting.

Companies that prepare now – with robust data, clear governance, and integrated reporting processes – will be best positioned to benefit from regulatory stability and investor confidence.

The Harvard Law School Forum article “ESG Shifting Tides” is available here: https://corpgov.law.harvard.edu/2026/05/07/esg-shifting-tides-an-analysis-of-the-changing-narrative-around-sustainability-and-esg-investment-contraction/

#CSRD, #ESRS, #SFDR

SFDR 2.0 reform

The main purpose of EU’s Sustainable Finance Disclosure Regulation (SFDR) is to increase transparency about how financial market participants integrate sustainability risks into their investment decisions, how their investments impact environmental, social and governance (ESG) factors, and how financial products address these factors.

Under the SFDR 2.0 reform, this purpose evolves further by introducing a clear, comparable EU‑wide categorisation system for ESG products to strengthen investor protection and reduce greenwashing.

Three fundamental shifts occur:

➡️ SFDR stops being a corporate‑reporting regime and becomes a downstream user of CSRD/ESRS data. Entity‑level SFDR disclosures are largely deleted.

➡️ SFDR’s centre of gravity moves to product‑level clarity and comparability, focusing on investor‑relevant information rather than firm‑level sustainability reporting.

➡️ SFDR replaces open‑ended ESG claims with structured, enforceable financial product categories (Sustainable, Transition, Other ESG), creating a clear EU‑wide system to ensure comparability and reduce greenwashing.

Articles 8 and 9 were not intended as labels, but became de facto labels in the market. The introduction of a voluntary three product category system (Sustainable, Transition, other ESG) is the centrepiece of SFDR 2.0, replacing the de facto Article 8/9 labels. The categories are voluntary – but once a product opts in, the rules are binding.

A financial product may fall under one of the new categories only if it meets all of the following structural requirements and applies one of the permitted investment approaches.

These structural requirements apply to every categorised product:

🌿 Minimum 70% of investments must follow the sustainability claim – i.e., contribute to the stated sustainability objective or apply the stated sustainability‑related considerations.

🌿 Mandatory use of principal adverse impact (PAI) indicators at product level – with Parliament requiring both mandatory and material PAIs.

🌿 Clear exclusions for harmful activities – sectoral and conduct‑based exclusions aligned with ESMA fund‑name guidance and EU minimum safeguards.

🌿 Strict rules for names and marketing – claims must be consistent with the category; non‑categorised products must include a disclaimer and cannot use sustainability terms prominently.

🚀 In short:

SFDR 2.0 becomes a product‑focused classification and anti‑greenwashing tool – not a general ESG disclosure regime – that relies on CSRD/ESRS for entity‑level data and provides investors with clearer, more comparable sustainability product information.

📅 Expected timeline

If the regulation is adopted in late 2026:

➡️ Entry into force: early 2027

➡️ General application: early 2029

➡️ Immediate application for burden‑reduction measures: early 2027

This gives the market a two‑year runway to implement the new categorisation regime and product‑level PAI logic.

 

#CSRD, #SFDR, #ESRS

ESMA’s Assessment framework for opinions on ESRS technical advice

ESMA has just published its new Assessment Framework (11 May), and it’s an important milestone for the future of ESRS.

Unlike the February Opinion on the revised ESRS, this Framework is not a legal deliverable – it’s an internal supervisory tool designed to bring clarity, consistency, and transparency to how ESMA evaluates EFRAG’s technical advice.

The Framework provides a stable methodology that ESMA will use for all future ESRS assessments. It reflects the lessons learned from the February Opinion and ESMA’s core mandate:

▪️ High‑quality, decision‑useful sustainability information
▪️ Investor protection
▪️ Financial stability
▪️ Coherence with EU sustainable finance rules

ESMA evaluates ESRS across four criteria, each with detailed sub‑criteria and indicators, rated from fully capable to not capable:

1️⃣ Quality of sustainability information

Are disclosures forward‑looking, risk‑based, comparable, entity‑specific, and aligned with the Accounting Directive?

2️⃣ Consistent application

Are the standards clear, auditable, enforceable, and compatible with ESEF digital tagging?

3️⃣ Consistency with EU legislation

Do ESRS align with SFDR PAI indicators, Taxonomy Article 8, CTB/PAB benchmarks, and other EU rules?

4️⃣ Interoperability with global standards

How well do ESRS align with IFRS S1/S2 and GRI, while preserving EU‑specific concepts like double materiality?

ESMA may update the Framework as legislation evolves – but it now provides a transparent reference point for future ESRS evaluations.

How this differs from the February Opinion

ESMA’s Opinion on the revised ESRS (Feb) was not a methodology – it was a concrete assessment of EFRAG’s December 2025 draft standards.

ESMA welcomed simplification but flagged some issues affecting investor protection and comparability, including:

  • Reliefs: Too broad or permanent, reducing data quality and weakening alignment with IFRS S1/S2.
  • Materiality: Need for clearer guidance on top‑down assessments and treatment of non‑material subsidiaries.
  • Climate & transition plans: Requests for clearer definitions, ambition levels, and stronger requirements on targets and financed emissions.
  • SFDR & Taxonomy alignment: Risks of burden‑shifting and loss of key datapoints.
  • Digital reporting: Some grouped disclosures still need separate tagging.
  • Interoperability: Divergences in scenario analysis, GHG boundaries, and reliefs absent from IFRS.

In short

  • The February Opinion = ESMA’s judgement on the revised ESRS.
  • The May Assessment Framework = the methodology ESMA will use going forward.

Together, they signal a clear direction: simplification is welcome, but not at the expense of investor‑grade sustainability information – meaning sustainability data that is as trustworthy, comparable, and decision‑useful as financial information.

👉 Contact us if you want to use our guided digital ESRS end-to-end templates to get a head start >>>

CSRD, ESRS

 

The Assessment Framework is available here: https://www.esma.europa.eu/sites/default/files/2026-05/ESMA32-846262651-5443_ESRS_assessment_framework.pdf

Is your sustainability statement ready for an end‑to‑end AI‑driven audit?

The audit profession is being rewritten in real time. Full AI audit automation and advanced AI agents are being deployed to transform how evidence is gathered and insights are delivered.

This shift is not incremental. It is structural – and it directly impacts sustainability reporting.

Under #ESRS 1 §104, sustainability information must be clearly identifiable, structured, and both human‑readable and machine‑readable. In short: your sustainability statement must be ready for AI.

Why this changes everything 👇

1. AI audits require precision, not narrative padding

AI detects gaps, inconsistencies, missing datapoints, and unsubstantiated claims instantly. Vague narratives and inconsistent connections will be surfaced immediately.

Reporting standards exist for a reason: to deliver standardized, comparable, verifiable information – and that visibility is exactly how #CSRD and transparency drive progress.

2. Manual testing is disappearing

KPMG has confirmed that AI will perform routine audit testing, with humans supervising rather than executing the work. PwC anticipates full AI integration across the audit cycle within the year.

This means sustainability statements will be examined by systems capable of scanning 100% of data, cross‑checking disclosures against ESRS datapoints, identifying missing IRO linkages, detecting inconsistencies between narrative and metrics, and flagging anomalies.

3. Governance expectations are rising

AI‑enabled audits increase transparency, professional skepticism, and audit quality. Boards must now understand how AI decision‑making and human oversight interact – and adapt governance frameworks accordingly. This is not just a technology shift. It is a governance shift.

🖥️ ESRS: built for a digital audit era

ESRS was designed for machine readability. Paragraph 104 makes this explicit. This is not optional, it is foundational.

In practice, your sustainability statement must:

▪️ mark every required datapoint, incl GDR requirements

▪️ separate ESRS‑required content from authorized supplementary content

▪️ ensure consistency across policies, actions, targets, and metrics (PATM)

▪️ demonstrate clear IRO‑to‑PATM linkages

▪️ avoid narrative dilution

▪️ be audit‑ready at the datapoint level

The era of promotional ESG storytelling is over. ESRS demands decision‑useful information.

If your first ESRS report is due in FY2027, remember: early reporters will already be on their fourth cycle. Building processes, collecting data, and aligning teams takes time. Waiting until 2027 means falling years behind.

🌿 A well‑structured, machine‑readable sustainability statement strengthens governance, accelerates internal learning, reveals strategic blind spots, and positions your organization for the EU’s dual green and digital transition.

Guided digital ESRS end-to-end templates

👉 Contact us if you want to use our guided digital ESRS end-to-end templates to get a head start.

How the European Commission Has Updated ESRS 1

The Commission has updated ESRS 1 – and the adjustments matter.

From a stricter materiality filter to new guidance on top‑down assessments, clearer rules on what can be omitted, a new value‑chain cap aligned with the voluntary standard, strengthen transparency around omissions, and new exemptions for investment managers under fiduciary duty, these adjustments make ESRS reporting more focused.

For companies, this means less noise, more relevance, and a clearer path to audit‑ready sustainability reporting.

If ESRS preparation is on your agenda, this overview will help you understand what’s changed – and why it matters for your 2026 reporting cycle.

Read the full article for the key takeaways and practical implications. 👇

Overview of the Key Changes

The European Commission has introduced a series of targeted adjustments to ESRS 1, refining how undertakings determine materiality, report value‑chain information, and apply exemptions. Below is a synthesis of the most significant updates.

  1. Reinforced Materiality Filter and Prohibition of Non‑Material Disclosures

A new clarification confirms that undertakings must not disclose non‑material information, whether prescribed by an ESRS Disclosure Requirement or arising from entity‑specific disclosures. This strengthens the materiality filter and explicitly prevents “over‑reporting” that could obscure relevant information.

  1. New Guidance on “Informed Assessments”

A new Application Requirement (AR 8) explains that informed assessments are the reasonable evaluations made by the category “other users of general-purpose sustainability statements” when forming decisions about the undertaking. This addition clarifies the role of non‑financial users – business partners, social partners (trade unions and employer organisations), civil society and NGOs – in the materiality logic.

  1. Clarified Expectations for the Top‑Down Materiality Approach

The Commission adds explanatory guidance confirming that a top‑down approach can avoid unnecessary work by allowing undertakings to conclude on materiality at topic level without assessing every individual impact, risk, or opportunity. However, a more granular assessment is required when it could change the materiality conclusion.

  1. Clarification on the Level at Which Materiality Is Assessed

A new AR (AR 16) explains that the level of materiality assessment is distinct from the level of aggregation for reporting. This separation ensures that undertakings can assess materiality at one level (e.g., topic or geography) while reporting at another, depending on what best supports faithful representation.

  1. New Rules for Undertakings Managing Investments Under Fiduciary Duty

Two new ARs (AR 17 and AR 37) introduce an important exemption:

  • If an undertaking manages investments on behalf of clients under fiduciary duty and does not retain risks or rewards of ownership,
    • it is not expected to assess impacts, risks, and opportunities related to those investments;
    • nor is it expected to provide value‑chain data on them.

This reduces the reporting burden for asset managers operating under strict fiduciary mandates.

  1. Introduction of a New Paragraph on the Value‑Chain Cap

A new paragraph (66) explains how undertakings must apply the value‑chain cap when requesting information from protected undertakings in their value chain. Key points include:

  • The cap covers disclosures marked as “necessary” in both the basic and comprehensive modules of the voluntary standard.
  • The cap differs for undertakings above or below 10 employees.
  • Disclosures marked “voluntary”, “consideration when reporting sector information”, or “necessary if applicable” are not included in the cap.
  • The limitation applies equally to non‑EU undertakings in the value chain.

This addition aligns ESRS 1 with the forthcoming voluntary standard and clarifies the legal boundaries of information requests.

  1. Complete Rewrite of Section 7.7 on Omission of Information

The Commission has substantially rewritten the rules governing when information may be omitted. The revised section:

  • Defines four categories of information that may be omitted: (a) commercially sensitive information, (b) trade secrets, (c) classified information, (d) information protected by other EU or national laws.
  • Requires undertakings to disclose the use of each omission.
  • Requires reassessment at each reporting date.
  • Adds an AR clarifying that non‑EU undertakings’ lighter reporting obligations cannot justify omissions.

This rewrite strengthens transparency while preserving legitimate protections.

  1. Additional Clarifications on Anticipated Financial Effects

A new AR explains that:

  • Reporting anticipated financial effects will often involve estimates.
  • Revisions to estimates do not automatically constitute reporting errors.
  • The omission rules in Section 7.7 also apply to anticipated financial effects.

This provides comfort to preparers and aligns ESRS with financial‑reporting logic.

Overall Impact of the Commission’s Amendments

The changes introduced by the European Commission:

  • Reinforce the materiality filter, reducing unnecessary disclosures.
  • Clarify expectations for top‑down assessments, value‑chain reporting, and the use of estimates.
  • Introduce targeted reliefs for investment managers under fiduciary duty.
  • Align ESRS 1 with the upcoming voluntary standard and the Accounting Directive.
  • Strengthen transparency around omissions while protecting sensitive information.

The Commission’s updates to ESRS 1 sharpen the rules and make compliance more focused. For companies, the priority now is to tighten their materiality process, structure value‑chain requests, and apply omission rules with clear justification.

Strengthened guidance on top‑down assessments, estimates, and fiduciary‑duty exemptions gives organisations room to streamline their work – provided they document decisions and maintain traceability.

In practice, this means building a controlled, well‑evidenced ESRS workflow that avoids unnecessary disclosures, protects sensitive information, and ensures consistent, audit‑ready reporting year after year.

ESRS 1 Is Evolving – Cleerit Gets You Ready

These changes make ESRS reporting more focused – but also more demanding in terms of structure, documentation, and traceability. Cleerit is designed precisely for this.

The solution integrates the full ESRS logic – from materiality assessment and governance to ESRS compliant sustainability reporting – so you can move from interpretation to execution with confidence and ensure your disclosures flow directly into the right ESRS datapoints.

If you’d like to explore how Cleerit can support your ESRS preparation, just reach out >>

Source: https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16775-Revised-European-sustainability-reporting-standards_en

Stay tuned for more CSRD, ESRS and VSME insights on our LinkedIn page >>

European Commission Draft Delegated ESRS Regulation

Today the European Commission published the Draft Delegated ESRS Regulation, open for feedback until 3 June 2026.

The revised introduce minor targeted but meaningful changes to IRO and PATM (GDR) disclosures. The updates increase precision and streamline structure.

🌿 ESRS IRO & PATM: What Changed – and What It Means for Preparers

IRO Disclosures – Clearer, More Action‑Oriented

Most IRO requirements remain stable, but the Commission strengthens precision and action language:

  • “Responded” changed to “Addressed” when describing how undertakings manage impacts, risks and opportunities. This shifts the emphasis from reaction to action‑oriented management, aligning with OECD/UNGP due‑diligence language.
  • Exemption logic clarified: Instead of “cannot provide” the Commission uses “determines it need not provide”. This reframes omissions as reasoned determinations, not inability – raising the bar for justification.

PATM (GDR) – Structural Alignment & Due‑Diligence Upgrade

This is where the Commission introduces the most structural improvements.

  • Policies (GDR‑P) – Expanded due‑diligence verbs: prevent, mitigate, bring to an end, minimise, remediate (instead of the narrower prevention/mitigation/remediation), aligned with UNGP/OECD.
  • Actions (GDR‑A) – Scope and timeframe split into separate datapoints. Clearer structure, easier auditability.
  • Targets (GDR‑T) – Restructuring: the Commission separates methodologies, legal requirements and scenarios into distinct datapoints. Improves transparency and aligns with climate/scenario‑based reporting.
  • Metrics (GDR‑M) – Clarified that planned improvements to value chain data must be disclosed if such actions exist, now avoids implying that actions always exist. No change in substance, but expectations are clearer.

What This Means for Preparers

  • Increased precision – ambition is not decreasing
    • The Commission’s edits make requirements more precise, more auditable, and more aligned with global due‑diligence frameworks.
  • Prepare for structured, modular reporting
    • Explicit references to GDR‑P, GDR‑A, GDR‑T, GDR‑M signal a shift toward a modular, repeatable architecture.
    • Good for tooling and comparability – but it requires early preparation and a move away from high‑level ESG storytelling.
  • Exemptions now require explicit justification
    • Expect auditors to challenge unsupported omissions.
  • Supplementary information is now explicitly exceptional
    • It must be clearly labelled, justified, and must not obscure mandatory disclosures.
    • This is a direct warning against narrative-heavy reporting that dilutes required content.

The message is clear: start preparing now

The Commission’s refinements make one thing obvious: companies that wait will struggle. Expectations are firmer, structure is clearer, and interpretive flexibility is shrinking.

If you haven’t begun aligning your #strategy, #governance, and data model with the revised  #IRO and  #PATM requirements, now is the moment.

IRO, policy, target, action templates in Cleerit

We have updated the IRO-PAT templates in Cleerit. When using these templates correctly your disclosures will be compliant and can be automatically inserted in the corresponding ESRS datapoints. Contact us to get started >>>

Source: https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16775-Revised-European-sustainability-reporting-standards_en

The Commission’s draft Sustainability reporting standard for voluntary use is also available here: https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/17232-Sustainability-reporting-standard-for-voluntary-use_en

Stay tuned for more CSRD, ESRS and VSME insights on our LinkedIn page >>

Pink Flamingos vs. Black Swans: Which Risk Should Leaders Fear Most?

In risk management, we often focus on Black Swans — rare, unpredictable shocks that reshape entire systems. They are dramatic and unforgettable.

But the real danger for organisations lies elsewhere.

Pink Flamingo risks 🦩  — the known, visible, repeatedly signalled risks we collectively ignore — are far more likely to undermine resilience. They sit in plain sight, underestimated due to familiarity, optimism bias or fatigue. And because they are known, failing to act is far more damaging.

This distinction matters now more than ever.

‼️ Why this matters for CSRD, CS3D, NIS2 and GDPR

Europe’s regulatory landscape is converging around one idea:

➡️ Resilience is now a legal, strategic and operational requirement.

  1. Sustainability & human‑rights risks (CSRD + CS3D)

Most sustainability‑related negative impacts — human‑rights violations, environmental harm, supply‑chain abuses — are not Black Swans.

They are Pink Flamingos 🦩: well known, repeatedly documented, and often ignored until they escalate into crises.

Under CSRD and CS3D, companies must show they can:

  • identify, mitigate, prevent these impacts
  • manage the financial risks arising from them

Ignoring known risks is no longer poor governance — it is a compliance failure.

  1. Cybersecurity resilience (NIS2 + GDPR)

Cyber incidents are increasingly predictable. Ransomware, supply‑chain attacks, credential theft, DDoS disruptions — none are Black Swans.

They are Pink Flamingos 🦩: widely understood, repeatedly warned about, and capable of causing severe operational disruption or financial loss.

Under NIS2, organisations must prove they can:

  • prevent and manage cybersecurity incidents
  • secure critical systems and supply chains
  • report significant incidents rapidly
  • protect others from material or non‑material harm

And when personal data is involved, GDPR applies simultaneously — making cybersecurity both a resilience and legal obligation.

💡Black Swans scare us in theory. Pink Flamingos hurt us in practice.

Most corporate crises — cyber breaches, human‑rights violations, environmental damage and other sustainability-related failures — were visible long before they became catastrophic.

Resilience today means:

  • acting on the risks we already know
  • closing the gap between awareness and action
  • embedding continuous monitoring, governance and accountability
  • aligning with regulatory frameworks designed to enforce exactly that

Resilience is capital. Negative impacts and dependencies are financial risks. Double materiality is the method to uncover both.

♟️ The strategic takeaway for leaders

To build a resilient organisation under #CSRD, #CS3D, #NIS2 and GDPR, focus less on predicting the unpredictable — and more on addressing the obvious.

Because the risks we ignore are the ones that break us.

👉 Want to strengthen both your resilience and your compliance? Get in touch and we’ll show you how Cleerit can support you.

#ESRS, #SustainabilityReporting, #NIS2, #Governance


Acknowledgement:

This article is based on a Risk and Policy Analysis assignment carried out by Chloé Lefèbvre in February 2024 during her Master’s studies in International Studies and Diplomacy at SOAS University of London. Thank you, Chloé, for introducing us to the world of Pink Flamingos vs. Black Swans!

Do you know who really owns the software you use?

Do you know who really owns the software you use for strategy, governance, compliance, risk management, financial planning and sustainability reporting?

Preserving Europe’s digital independence and safeguarding our core values matters — now and for the generations to come.

In Europe, we often talk about digitalisation, performance and ESG — but far less about the jurisdictional risks behind the software we use to manage them.

Yet for organisations working with strategy, execution, compliance, risk management, finance and ESG, the legal environment of your software provider is no longer a technical detail. It directly affects the confidentiality of your plans, the integrity of your reporting, and the compliance burden placed on your teams.

In a EU market where U.S. private equity firms are taking an increasingly strong position, the need for suppliers with clear European ownership and long‑term predictability is growing.

Here’s the reality:

  • When a SaaS provider is U.S.-owned or U.S.-controlled, every piece of EU personal data processed — even if hosted in the EU — becomes an international data transfer.
  • This triggers obligations such as DPF, SCCs, TIAs, DPIAs, and an assessment of exposure to U.S. surveillance laws (FISA 702, CLOUD Act, EO 12333).

And none of these mechanisms protect business‑critical data like strategy documents, financial forecasts, product roadmaps, risk analysis or ESG data.

For tools that sit at the heart of corporate governance, this matters

This is why the structural choice of a privately owned, EU‑based and EU‑controlled software editor is more than a procurement preference — it is a governance decision. When your platform operates fully under EU jurisdiction, you avoid cross‑border transfers, reduce compliance overhead, and maintain clearer protection over both personal and non‑personal strategic data.

As organisations raise the bar on transparency, resilience, and responsible digitalisation, the question is no longer only

“What can the software do?”

It is also

“Under which legal system does it operate — and what does that mean for our data, our reporting, and our risk posture?”

The below article outlines the obligations and risks EU organisations need to consider when choosing software operated under U.S. jurisdiction.

When selecting software for strategy, governance, compliance, risk management, financial planning and sustainability reporting, data protection is not a secondary concern — it is a core governance requirement

These domains involve highly sensitive information: forward‑looking strategy, financial planning, regulatory reporting, and internal performance and compliance data.

For EU organisations, the legal environment in which a software provider operates directly affects how securely this information can be processed and how predictable the compliance obligations will be.

This is where the distinction between an EU‑based, EU‑owned software editor and a U.S.-owned or U.S.-controlled SaaS provider becomes critical.

Because Cleerit is a privately owned, EU‑based and EU‑controlled solution, all processing remains fully within the EU legal framework. This means no international data transfers, no reliance on DPF/SCCs/TIAs, and no exposure to U.S. surveillance laws such as FISA 702, the CLOUD Act, or Executive Order 12333. For customers, this translates into lower regulatory risk, fewer compliance steps, and clearer protection for both personal data and business‑critical information.

By contrast, using a U.S.-owned or U.S.-controlled SaaS provider — even if hosted in the EU — automatically triggers GDPR international transfer rules and requires organisations to assess foreign‑law risks, implement additional safeguards, and limit the types of data that can be safely uploaded.

This is particularly relevant when the software handles strategic, financial, or ESG‑related content, where confidentiality and regulatory integrity are essential.

The following section outlines the obligations and risks EU organisations should consider when choosing software operated under U.S. jurisdiction.

Is your software provider U.S.-based, owned or controlled? 

If your software provider is U.S.-based, any EU personal data processed by the provider involves a cross‑border transfer and requires valid international data transfer mechanism.

This means you must rely on one of the following U.S. SaaS obligations:

  • EU–U.S. Data Privacy Framework (DPF) — A U.S. government–run certification that allows U.S. companies to legally receive EU personal data by committing to GDPR‑level protections.
  • Standard Contractual Clauses (SCCs), if not DPF‑certified — EU‑approved legal contracts that let organizations transfer personal data to non‑EU countries, incl. the U.S., while guaranteeing GDPR‑level protection.
  • Transfer Impact Assessment (TIA), always required when SCCs are used — a mandatory GDPR risk analysis that evaluates whether sending personal data to a non‑EU provider (such as a U.S. SaaS company) exposes it to foreign laws or surveillance risks, and what safeguards are needed.

You also have DPIA obligations. In the EU, a DPIA (Data Protection Impact Assessment) is a mandatory GDPR assessment that organizations must perform when a processing activity is likely to result in a high risk to individuals’ rights and freedoms — especially when using tools, systems, or transfers involving non‑EU countries.

U.S. surveillance laws remain a risk factor for EU organisations

 Even with DPF or SCCs, EU regulators expect you to assess exposure to:

  • FISA 702
  • CLOUD Act
  • Executive Order 12333

This is standard for any U.S. SaaS.

Moreover, protection under DPF or SCCs does not cover business data, only personal data in relation to GDPR. GDPR does not regulate: 

  • business plans
  • internal strategy documents
  • product roadmaps
  • financial forecasts
  • ESG reports without personal data
  • anonymized datasets
  • source code

These are not protected under GDPR, and therefore not covered by DPF or SCCs.

What these laws mean for a U.S.-owned/controlled SaaS company

FISA Section 702

A U.S. law that allows intelligence agencies (primarily the NSA) to compel U.S. electronic communication service providers to provide access to data about non‑U.S. persons located outside the U.S. for foreign intelligence purposes.

  • Applies to any U.S.-based cloud or SaaS provider
  • Can require secret, non‑disclosable access to data
  • Applies even if the data is stored in the EU, as long as the company is U.S.-controlled

GDPR impact:

  • This is the main reason the EU considers the U.S. a third country with inadequate personal data protection (except for DPF‑certified companies).
  • The EU noted that data protection rules only contribute to the protection of individuals if they are followed in practice. It is therefore necessary to consider not only the content of rules applicable to personal data transferred to a third country, but also the system in place to ensure the effectiveness of such rules.
  • U.S. surveillance laws allow broad government access to data without EU‑equivalent privacy safeguards or judicial remedies, as confirmed by the CJEU in Schrems II.
  • DPF reduces the risk but does not eliminate it. DPF solves the transfer problem — meaning you may transfer EU personal data to that company and it will be assimilated to intra-EU transmissions of data — but it does not guarantee full GDPR adequacy and compliance by the provider, and it does not eliminate your DPIA obligations.
  • Moreover, the CJEU (Schrems II) made clear that adequacy can be challenged again, meaning that even with DPF, adequacy is conditional and can be re‑evaluated or invalidated. The Court invalidated the previous Privacy Shield because U.S. surveillance laws conflicted with EU fundamental rights. (CJEU Case C‑311/18 “Schrems II”: https://curia.europa.eu/juris/liste.jsf?num=C-311/18

 In practice: A U.S. SaaS provider could be compelled to hand over EU personal data without notifying the customer, and protection under DPF or SCCs does not cover business data.

U.S. CLOUD Act

A law that allows U.S. law enforcement to compel U.S. companies to provide data regardless of where the data is stored (including EU data centers).

  • Applies to any U.S.-owned company, even if it operates an EU subsidiary
  • Applies to data stored in the EU
  • Can include business data, user data, logs, metadata 

In practice: A U.S. SaaS provider may be legally required to disclose EU customer data stored in Europe.

Executive Order 12333

A presidential order that authorizes U.S. intelligence agencies to conduct surveillance outside the U.S., often through upstream collection (intercepting data in transit).

  • Does not require cooperation from the SaaS provider
  • Data can be collected without the provider’s knowledge
  • Applies to data crossing international networks (e.g., transatlantic traffic)

EO 12333 is relevant because it allows upstream collection of data that passes through global networks — even if the company storing the data is not directly compelled. It targets infrastructure, not companies.

This is why the CJEU (Schrems II) considered it a risk factor for EU–U.S. data transfers. EO 12333 permits intelligence collection without EU‑equivalent safeguards, which is why the U.S. was not granted adequacy.

The risk is harder to mitigate because it targets infrastructure, not companies. Encryption and zero knowledge architectures reduce exposure. 

How does this affect your choice of software? 

For any U.S.-owned SaaS provider you must evaluate exposure to U.S. surveillance laws and you may need to restrict what data users upload, register or integrate, especially:

  • HR data
  • sensitive strategy documents
  • regulated ESG/CSRD data
  • customer data
  • anything containing personal data

In short: when governance matters, jurisdiction matters.

Cleerit’s EU‑based and EU‑controlled model gives organisations the legal clarity and operational predictability they increasingly expect from their core platforms, and that many organisations now consider essential.

And last but not least: preserving Europe’s digital independence and safeguarding our core values matters — now and for the generations to come.

Read more about Cleerit’s privately owned, EU based and EU controlled solution for Performance Management & Compliance Governance 360° — connecting strategy, execution, finance & ESG to drive your everyday performance, protect your organization and turn your strategies into reality >>>

It’s the clarity and decision support designed for you to reach your goals, maximize results, secure compliance, and contribute to an inclusive and sustainable future.