Author Archive: Cleerit

European Commission Draft Delegated ESRS Regulation

Posted on by

Today the European Commission published the Draft Delegated ESRS Regulation, open for feedback until 3 June 2026.

The revised introduce minor targeted but meaningful changes to IRO and PATM (GDR) disclosures. The updates increase precision and streamline structure.

🌿 ESRS IRO & PATM: What Changed – and What It Means for Preparers

IRO Disclosures – Clearer, More Action‑Oriented

Most IRO requirements remain stable, but the Commission strengthens precision and action language:

  • “Responded” changed to “Addressed” when describing how undertakings manage impacts, risks and opportunities. This shifts the emphasis from reaction to action‑oriented management, aligning with OECD/UNGP due‑diligence language.
  • Exemption logic clarified: Instead of “cannot provide” the Commission uses “determines it need not provide”. This reframes omissions as reasoned determinations, not inability – raising the bar for justification.

PATM (GDR) – Structural Alignment & Due‑Diligence Upgrade

This is where the Commission introduces the most structural improvements.

  • Policies (GDR‑P) – Expanded due‑diligence verbs: prevent, mitigate, bring to an end, minimise, remediate (instead of the narrower prevention/mitigation/remediation), aligned with UNGP/OECD.
  • Actions (GDR‑A) – Scope and timeframe split into separate datapoints. Clearer structure, easier auditability.
  • Targets (GDR‑T) – Restructuring: the Commission separates methodologies, legal requirements and scenarios into distinct datapoints. Improves transparency and aligns with climate/scenario‑based reporting.
  • Metrics (GDR‑M) – Clarified that planned improvements to value chain data must be disclosed if such actions exist, now avoids implying that actions always exist. No change in substance, but expectations are clearer.

What This Means for Preparers

  • Increased precision – ambition is not decreasing
    • The Commission’s edits make requirements more precise, more auditable, and more aligned with global due‑diligence frameworks.
  • Prepare for structured, modular reporting
    • Explicit references to GDR‑P, GDR‑A, GDR‑T, GDR‑M signal a shift toward a modular, repeatable architecture.
    • Good for tooling and comparability – but it requires early preparation and a move away from high‑level ESG storytelling.
  • Exemptions now require explicit justification
    • Expect auditors to challenge unsupported omissions.
  • Supplementary information is now explicitly exceptional
    • It must be clearly labelled, justified, and must not obscure mandatory disclosures.
    • This is a direct warning against narrative-heavy reporting that dilutes required content.

The message is clear: start preparing now

The Commission’s refinements make one thing obvious: companies that wait will struggle. Expectations are firmer, structure is clearer, and interpretive flexibility is shrinking.

If you haven’t begun aligning your #strategy, #governance, and data model with the revised  #IRO and  #PATM requirements, now is the moment.

IRO, policy, target, action templates in Cleerit

We have updated the IRO-PAT templates in Cleerit. When using these templates correctly your disclosures will be compliant and can be automatically inserted in the corresponding ESRS datapoints. Contact us to get started >>>

—

Source: https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/16775-Revised-European-sustainability-reporting-standards_en

The Commission’s draft Sustainability reporting standard for voluntary use is also available here: https://ec.europa.eu/info/law/better-regulation/have-your-say/initiatives/17232-Sustainability-reporting-standard-for-voluntary-use_en

—

Stay tuned for more CSRD, ESRS and VSME insights on our LinkedIn page >>

Pink Flamingos vs. Black Swans: Which Risk Should Leaders Fear Most?

Posted on by

In risk management, we often focus on Black Swans — rare, unpredictable shocks that reshape entire systems. They are dramatic and unforgettable.

But the real danger for organisations lies elsewhere.

Pink Flamingo risks 🦩  — the known, visible, repeatedly signalled risks we collectively ignore — are far more likely to undermine resilience. They sit in plain sight, underestimated due to familiarity, optimism bias or fatigue. And because they are known, failing to act is far more damaging.

This distinction matters now more than ever.

‼️ Why this matters for CSRD, CS3D, NIS2 and GDPR

Europe’s regulatory landscape is converging around one idea:

➡️ Resilience is now a legal, strategic and operational requirement.

  1. Sustainability & human‑rights risks (CSRD + CS3D)

Most sustainability‑related negative impacts — human‑rights violations, environmental harm, supply‑chain abuses — are not Black Swans.

They are Pink Flamingos 🦩: well known, repeatedly documented, and often ignored until they escalate into crises.

Under CSRD and CS3D, companies must show they can:

  • identify, mitigate, prevent these impacts
  • manage the financial risks arising from them

Ignoring known risks is no longer poor governance — it is a compliance failure.

  1. Cybersecurity resilience (NIS2 + GDPR)

Cyber incidents are increasingly predictable. Ransomware, supply‑chain attacks, credential theft, DDoS disruptions — none are Black Swans.

They are Pink Flamingos 🦩: widely understood, repeatedly warned about, and capable of causing severe operational disruption or financial loss.

Under NIS2, organisations must prove they can:

  • prevent and manage cybersecurity incidents
  • secure critical systems and supply chains
  • report significant incidents rapidly
  • protect others from material or non‑material harm

And when personal data is involved, GDPR applies simultaneously — making cybersecurity both a resilience and legal obligation.

💡Black Swans scare us in theory. Pink Flamingos hurt us in practice.

Most corporate crises — cyber breaches, human‑rights violations, environmental damage and other sustainability-related failures — were visible long before they became catastrophic.

Resilience today means:

  • acting on the risks we already know
  • closing the gap between awareness and action
  • embedding continuous monitoring, governance and accountability
  • aligning with regulatory frameworks designed to enforce exactly that

Resilience is capital. Negative impacts and dependencies are financial risks. Double materiality is the method to uncover both.

♟️ The strategic takeaway for leaders

To build a resilient organisation under #CSRD, #CS3D, #NIS2 and GDPR, focus less on predicting the unpredictable — and more on addressing the obvious.

Because the risks we ignore are the ones that break us.

—

👉 Want to strengthen both your resilience and your compliance? Get in touch and we’ll show you how Cleerit can support you.

#ESRS, #SustainabilityReporting, #NIS2, #Governance

Acknowledgement:

This article is based on a Risk and Policy Analysis assignment carried out by Chloé Lefèbvre in February 2024 during her Master’s studies in International Studies and Diplomacy at SOAS University of London. Thank you, Chloé, for introducing us to the world of Pink Flamingos vs. Black Swans!

Do you know who really owns the software you use?

Posted on by

Do you know who really owns the software you use for strategy, governance, compliance, risk management, financial planning and sustainability reporting?

Preserving Europe’s digital independence and safeguarding our core values matters — now and for the generations to come.

In Europe, we often talk about digitalisation, performance and ESG — but far less about the jurisdictional risks behind the software we use to manage them.

Yet for organisations working with strategy, execution, compliance, risk management, finance and ESG, the legal environment of your software provider is no longer a technical detail. It directly affects the confidentiality of your plans, the integrity of your reporting, and the compliance burden placed on your teams.

In a EU market where U.S. private equity firms are taking an increasingly strong position, the need for suppliers with clear European ownership and long‑term predictability is growing.

Here’s the reality:

  • When a SaaS provider is U.S.-owned or U.S.-controlled, every piece of EU personal data processed — even if hosted in the EU — becomes an international data transfer.
  • This triggers obligations such as DPF, SCCs, TIAs, DPIAs, and an assessment of exposure to U.S. surveillance laws (FISA 702, CLOUD Act, EO 12333).

And none of these mechanisms protect business‑critical data like strategy documents, financial forecasts, product roadmaps, risk analysis or ESG data.

For tools that sit at the heart of corporate governance, this matters

This is why the structural choice of a privately owned, EU‑based and EU‑controlled software editor is more than a procurement preference — it is a governance decision. When your platform operates fully under EU jurisdiction, you avoid cross‑border transfers, reduce compliance overhead, and maintain clearer protection over both personal and non‑personal strategic data.

As organisations raise the bar on transparency, resilience, and responsible digitalisation, the question is no longer only

“What can the software do?”

It is also

“Under which legal system does it operate — and what does that mean for our data, our reporting, and our risk posture?”

The below article outlines the obligations and risks EU organisations need to consider when choosing software operated under U.S. jurisdiction.

—

When selecting software for strategy, governance, compliance, risk management, financial planning and sustainability reporting, data protection is not a secondary concern — it is a core governance requirement

These domains involve highly sensitive information: forward‑looking strategy, financial planning, regulatory reporting, and internal performance and compliance data.

For EU organisations, the legal environment in which a software provider operates directly affects how securely this information can be processed and how predictable the compliance obligations will be.

This is where the distinction between an EU‑based, EU‑owned software editor and a U.S.-owned or U.S.-controlled SaaS provider becomes critical.

Because Cleerit is a privately owned, EU‑based and EU‑controlled solution, all processing remains fully within the EU legal framework. This means no international data transfers, no reliance on DPF/SCCs/TIAs, and no exposure to U.S. surveillance laws such as FISA 702, the CLOUD Act, or Executive Order 12333. For customers, this translates into lower regulatory risk, fewer compliance steps, and clearer protection for both personal data and business‑critical information.

By contrast, using a U.S.-owned or U.S.-controlled SaaS provider — even if hosted in the EU — automatically triggers GDPR international transfer rules and requires organisations to assess foreign‑law risks, implement additional safeguards, and limit the types of data that can be safely uploaded.

This is particularly relevant when the software handles strategic, financial, or ESG‑related content, where confidentiality and regulatory integrity are essential.

The following section outlines the obligations and risks EU organisations should consider when choosing software operated under U.S. jurisdiction.

Is your software provider U.S.-based, owned or controlled? 

If your software provider is U.S.-based, any EU personal data processed by the provider involves a cross‑border transfer and requires valid international data transfer mechanism.

This means you must rely on one of the following U.S. SaaS obligations:

  • EU–U.S. Data Privacy Framework (DPF) — A U.S. government–run certification that allows U.S. companies to legally receive EU personal data by committing to GDPR‑level protections.
  • Standard Contractual Clauses (SCCs), if not DPF‑certified — EU‑approved legal contracts that let organizations transfer personal data to non‑EU countries, incl. the U.S., while guaranteeing GDPR‑level protection.
  • Transfer Impact Assessment (TIA), always required when SCCs are used — a mandatory GDPR risk analysis that evaluates whether sending personal data to a non‑EU provider (such as a U.S. SaaS company) exposes it to foreign laws or surveillance risks, and what safeguards are needed.

You also have DPIA obligations. In the EU, a DPIA (Data Protection Impact Assessment) is a mandatory GDPR assessment that organizations must perform when a processing activity is likely to result in a high risk to individuals’ rights and freedoms — especially when using tools, systems, or transfers involving non‑EU countries.

U.S. surveillance laws remain a risk factor for EU organisations

 Even with DPF or SCCs, EU regulators expect you to assess exposure to:

  • FISA 702
  • CLOUD Act
  • Executive Order 12333

This is standard for any U.S. SaaS.

Moreover, protection under DPF or SCCs does not cover business data, only personal data in relation to GDPR. GDPR does not regulate: 

  • business plans
  • internal strategy documents
  • product roadmaps
  • financial forecasts
  • ESG reports without personal data
  • anonymized datasets
  • source code

These are not protected under GDPR, and therefore not covered by DPF or SCCs.

What these laws mean for a U.S.-owned/controlled SaaS company

FISA Section 702

A U.S. law that allows intelligence agencies (primarily the NSA) to compel U.S. electronic communication service providers to provide access to data about non‑U.S. persons located outside the U.S. for foreign intelligence purposes.

  • Applies to any U.S.-based cloud or SaaS provider
  • Can require secret, non‑disclosable access to data
  • Applies even if the data is stored in the EU, as long as the company is U.S.-controlled

GDPR impact:

  • This is the main reason the EU considers the U.S. a third country with inadequate personal data protection (except for DPF‑certified companies).
  • The EU noted that data protection rules only contribute to the protection of individuals if they are followed in practice. It is therefore necessary to consider not only the content of rules applicable to personal data transferred to a third country, but also the system in place to ensure the effectiveness of such rules.
  • U.S. surveillance laws allow broad government access to data without EU‑equivalent privacy safeguards or judicial remedies, as confirmed by the CJEU in Schrems II.
  • DPF reduces the risk but does not eliminate it. DPF solves the transfer problem — meaning you may transfer EU personal data to that company and it will be assimilated to intra-EU transmissions of data — but it does not guarantee full GDPR adequacy and compliance by the provider, and it does not eliminate your DPIA obligations.
  • Moreover, the CJEU (Schrems II) made clear that adequacy can be challenged again, meaning that even with DPF, adequacy is conditional and can be re‑evaluated or invalidated. The Court invalidated the previous Privacy Shield because U.S. surveillance laws conflicted with EU fundamental rights. (CJEU Case C‑311/18 “Schrems II”: https://curia.europa.eu/juris/liste.jsf?num=C-311/18

 In practice: A U.S. SaaS provider could be compelled to hand over EU personal data without notifying the customer, and protection under DPF or SCCs does not cover business data.

U.S. CLOUD Act

A law that allows U.S. law enforcement to compel U.S. companies to provide data regardless of where the data is stored (including EU data centers).

  • Applies to any U.S.-owned company, even if it operates an EU subsidiary
  • Applies to data stored in the EU
  • Can include business data, user data, logs, metadata 

In practice: A U.S. SaaS provider may be legally required to disclose EU customer data stored in Europe.

Executive Order 12333

A presidential order that authorizes U.S. intelligence agencies to conduct surveillance outside the U.S., often through upstream collection (intercepting data in transit).

  • Does not require cooperation from the SaaS provider
  • Data can be collected without the provider’s knowledge
  • Applies to data crossing international networks (e.g., transatlantic traffic)

EO 12333 is relevant because it allows upstream collection of data that passes through global networks — even if the company storing the data is not directly compelled. It targets infrastructure, not companies.

This is why the CJEU (Schrems II) considered it a risk factor for EU–U.S. data transfers. EO 12333 permits intelligence collection without EU‑equivalent safeguards, which is why the U.S. was not granted adequacy.

The risk is harder to mitigate because it targets infrastructure, not companies. Encryption and zero knowledge architectures reduce exposure. 

How does this affect your choice of software? 

For any U.S.-owned SaaS provider you must evaluate exposure to U.S. surveillance laws and you may need to restrict what data users upload, register or integrate, especially:

  • HR data
  • sensitive strategy documents
  • regulated ESG/CSRD data
  • customer data
  • anything containing personal data

In short: when governance matters, jurisdiction matters.

Cleerit’s EU‑based and EU‑controlled model gives organisations the legal clarity and operational predictability they increasingly expect from their core platforms, and that many organisations now consider essential.

And last but not least: preserving Europe’s digital independence and safeguarding our core values matters — now and for the generations to come.

Read more about Cleerit’s privately owned, EU based and EU controlled solution for Performance Management & Compliance Governance 360° — connecting strategy, execution, finance & ESG to drive your everyday performance, protect your organization and turn your strategies into reality >>>

It’s the clarity and decision support designed for you to reach your goals, maximize results, secure compliance, and contribute to an inclusive and sustainable future.

Svensk utredning om genomförandet av ändringarna i CSRD (SOU 2026:27)

Posted on by

Den svenska utredningen om genomförandet av ändringarna i CSRD (SOU 2026:27) föreslår att EU:s Omnibus I‑lättnader införs så snart som möjligt:

▪️Våg 1‑bolag: från räkenskapsår som börjar 1 jan 2026
▪️Våg 2‑bolag: från räkenskapsår som börjar 1 jan 2027

Företag som inte längre uppfyller de nya gränsvärdena slipper lagstadgad hållbarhetsrapport för räkenskapsåret 2026. Inga svenska särregler föreslås – genomförandet sker i linje med EU‑rätten.

Nya gränsvärden för rapporteringsplikt

Ett företag (eller moderföretag i en koncern) omfattas endast om det under två år i rad har:

▪️> 1 000 anställda, och
▪️> 4,9 mdkr i nettoomsättning

Detta ersätter dagens regler och den tidigare vågindelningen (inkl NFRD‑baserad rapportering). Börsnoterade små och medelstora företag faller därmed ur scope.

Utredningen bedömer att endast 150–200 svenska företag kommer att omfattas framöver. Samtidigt väntas vissa företag fortsätta rapportera frivilligt.

Tillgången till hållbarhetsinformation beräknas dock minska, vilket kan påverka investerare, sparare och civilsamhället negativt.

Dotterföretag, koncerner och tredjelandsföretag

▪️Dotterföretag omfattas inte om koncernen redan rapporterar enligt ESRS eller likvärdiga standarder.

▪️De ska dock upplysa om detta i förvaltningsberättelsen och länka till moderföretagets rapporter.

▪️Filialer till tredjelandsföretag blir rapporteringspliktiga först vid > 4,9 mdkr i EES‑omsättning och > 2,2 mdkr i filialomsättning.

▪️Finansiella holdingföretag vars dotterföretag har affärsmodeller och verksamhet som är oberoende av varandra blir inte rapporteringspliktiga.

Värdekedjan och skyddade företag

▪️Ett företag i värdekedjan med ≤ 1 000 anställda betraktas som skyddat företag.

▪️Det kan därmed vägra att lämna information som ett rapporterande företag begär för sin hållbarhetsrapportering, om uppgifterna går utöver de frivilliga standarder som EU väntas fastställa senast den 19 juli 2026.

👉 Begränsningen gäller när information efterfrågas för att uppfylla kraven i hållbarhetsrapporteringen – inte när information begärs som del av företagets ordinarie leverantörsstrategi.

👉 Den europeiska centralbanken (ECB) rekommenderar i sitt yttrande (feb 2026 sid. 13) att företag som inte längre omfattas av CSRD använder ESRS för sin frivilliga rapportering.

▪️Rapportering om värdekedjan kan undantas i tre år om information saknas – men det rapporterade företaget måste redogöra för sina försök att få fram den.

Revision

Revisorsinspektionen föreslås få möjlighet att godkänna revisorer och revisionsföretag från tredjeland för att granska hållbarhetsrapporter i Sverige – under förutsättning att kraven på granskningen och på revisorn är likvärdiga med svensk rätt.

Tredjelandsrevisorer ska kunna godkännas redan nu – så länge de lämnar in vissa uppgifter. Från och med räkenskapsår 2031 krävs full likvärdighet med svensk rätt.

Remisstid

Förslagen är nu ute på remiss till 21 augusti 2026.

Källa: https://regeringen.se/rattsliga-dokument/statens-offentliga-utredningar/2026/04/sou-202627/

EU’s New Anti‑Corruption Directive: What Business Leaders Need to Know — and How to Prepare

Posted on by

On 21 April 2026, the Council of the EU formally adopted the Anti‑Corruption Directive, creating—for the first time—a fully harmonised EU‑wide criminal law framework to prevent, detect and sanction corruption across all Member States.

This is not “just another compliance update.” It is a structural shift with direct implications for governance, internal controls, procurement, reporting, and sustainability disclosures.

And it aligns closely with the Draft ESRS G1 (Business Conduct)—meaning companies will need to integrate anti‑corruption compliance into their CSRD‑aligned sustainability reporting.

What the Directive Changes — at a Glance

Harmonised EU definitions of corruption offences

The Directive standardises what constitutes:

  • Public and private bribery
  • Misappropriation
  • Trading in influence
  • Obstruction of justice
  • Enrichment from corruption
  • Concealment
  • Serious unlawful exercise of public functions

This closes long‑standing gaps between Member States and removes ambiguity for cross‑border operations.

Turnover‑based sanctions for companies

For the most serious offences, companies face:

  • Fines of at least 5% of global turnover or €40M
  • For other offences: 3% of global turnover or €24M

This mirrors the GDPR model and raises the stakes dramatically.

Corporate liability for lack of supervision

Companies can be held liable when offences are committed for their benefit, including when failures in oversight or internal controls enabled the misconduct.

Extended jurisdiction & longer limitation periods

Member States may prosecute offences committed abroad if the company benefits within their territory. Limitation periods extend to 8–10 years, reflecting the complexity of corruption cases.

Mandatory national anti‑corruption strategies & specialised bodies

Member States must establish dedicated prevention bodies and structured risk assessments.

Whistleblower protection reinforced

The Directive confirms the applicability of the EU Whistleblowing Directive to corruption cases and requires strong protection for individuals reporting or cooperating.

Why This Matters for Companies — Beyond Criminal Law

The Directive is not only about criminal sanctions. It directly intersects with corporate governance, procurement, sustainability reporting, and stakeholder trust.

And this is where ESRS G1 (Business Conduct) becomes central.

  1. How the Anti‑Corruption Directive Connects to ESRS G1 (Nov 2025)

The Draft ESRS G1 requires companies to disclose policies, actions, targets and metrics related to business conduct, including:

Anti‑corruption & anti‑bribery policies

Companies must disclose whether they have policies aligned with the UN Convention Against Corruption—the same international standard the Directive incorporates.

Whistleblower protection

ESRS G1 requires disclosure of whistleblower protection policies—now reinforced by the Directive’s mandatory protections.

Functions most exposed to corruption risk

ESRS G1 requires companies to identify roles most at risk (e.g., procurement, public‑sector interactions, high‑risk geographies). The Directive’s broad definitions of public officials and influence‑trading expand this risk perimeter.

Actions & procedures to prevent, detect, investigate corruption

ESRS G1 requires disclosure of:

  • Training for high‑risk roles
  • Supplier engagement and ESG due diligence
  • Procedures for investigating allegations

These map directly to the Directive’s expectations for effective internal controls and corporate liability mitigation.

Metrics: convictions, fines, political influence, payment practices

ESRS G1 requires transparency on:

  • Convictions and fines for corruption
  • Political contributions and lobbying
  • Payment practices (especially late payments to SMEs)

The Directive’s turnover‑based sanctions will make these disclosures far more material.

What Companies Should Do Now — A Practical Roadmap

With a 24‑month transposition period (36 months for national risk assessments and strategies), companies should not wait.

  1. Conduct a corruption‑risk gap analysis

Assess alignment with:

  • New EU offence definitions
  • Corporate liability triggers
  • Turnover‑based sanctions
  • ESRS G1 disclosure requirements
  1. Update policies and codes of conduct

Ensure consistency with:

  • Harmonised EU definitions (e.g., “undue advantage”)
  • Broader scope of public officials
  • Trading in influence and misappropriation
  1. Strengthen procurement & third‑party due diligence

Given the Directive’s broad liability scope, companies should:

  • Screen intermediaries, agents, distributors
  • Reinforce supplier ESG assessments
  • Monitor high‑risk relationships continuously
  1. Enhance internal controls & audit mechanisms

Courts will assess the effectiveness, not the existence, of compliance systems.

  1. Reinforce whistleblowing channels

Ensure:

  • Confidential reporting
  • Anti‑retaliation measures
  • Awareness and training
  1. Prepare for ESRS G1 reporting

Integrate anti‑corruption data into:

  • Policies (G1‑1)
  • Actions (G1‑2)
  • Targets (G1‑3)
  • Metrics (G1‑4 to G1‑6)
  1. Train leadership and high‑risk functions

The Directive explicitly requires training for roles most exposed to corruption risk.

The Strategic Opportunity

Beyond compliance, this Directive is a catalyst for:

  • Stronger governance
  • More resilient value chains
  • Better investor confidence
  • Enhanced CSRD‑aligned transparency
  • A culture of integrity

Companies that act early will not only reduce legal exposure—they will strengthen their competitive position in a market where trust, transparency and accountability are becoming decisive.

—

The new Directive will enter into force 20 days after its publication in the Official Journal of the EU.

Source: https://www.consilium.europa.eu/en/press/press-releases/2026/04/21/council-adopts-new-eu-wide-law-to-combat-corruption/

—

👉 Want to strengthen resilience, compliance and stakeholder trust? Get in touch — Cleerit can help you operationalise all of this efficiently.

#SustainabilityReporting #Governance

EFRAG 2026 Sustainability Reporting Work Programme in short

Posted on by

The CSRD requires the European Commission (EC) to consult the Member States and the European Parliament on EFRAG’s work program.

A document setting out the proposed EFRAG Sustainability Reporting work programme for 2026 was approved by the EFRAG SRB on 26 March 2026.

🔑 Key takeaways

EFRAG’s 2026 work programme outlines the Sustainability Reporting Pillar’s priorities, shaped by CSRD mandates, the Omnibus I Directive, and the renewed EC pilot project running until mid‑2027.

Activities depend on the adoption of Delegated Acts for the Voluntary Standard (VS) and simplified ESRS, expected in June 2026. A stable draft of the Delegated Act on simplified ESRS is currently anticipated in April 2026.

🔹 Core Priorities for 2026

📝 Standard‑setting:

Development of N‑ESRS for non‑EU groups under CSRD Article 40a, including a public consultation (mid‑July to mid‑October 2026) and delivery of technical advice by end of January 2027 (tentative).

🖥️ Digitalisation:

Digitalisation is recognised as a key enabler for the effective application of ESRS and VS.

An ESRS XBRL taxonomy will be developed following the ESRS simplification to support machine-readability, as well as further enhancement of the ESRS Knowledge Hub with interactive and multilingual features (subject to funding), as well as publication of the XLS list of ESRS requirements.

🫂 SME Ecosystem:

Continuation of support for SMEs through the SME Forum. Research on emerging practices from VSME reports will inform future guidance.

Technical enhancements to the XBRL taxonomy and the Digital Template are expected to continue, supporting usability, interoperability and digital readiness.

🎓 Education:

Creation of training materials, videos, and structured learning modules, integrated into the Knowledge Hub.

💁 Implementation Support:

Focus on designing future support mechanisms. An Agenda Consultation (July–October 2026) will gather stakeholder input on priorities for ESRS and VS implementation guidance.

Work on Anticipated Financial Effects is planned jointly with ISSB.

EFRAG also envisages updating the State of Play report already issued in 2025, in order to assess emerging ESRS reporting practices. A similar report will also be issued for reports prepared in compliance with VSME.

⛓️ Interoperability:

Ongoing alignment with ISSB/SASB, GRI and GHG Protocol, including consultation responses, updated mappings, and digital interoperability efforts.

—

The program has been developed considering regulatory timelines and resource allocation. It also takes account of the need to wait until the Commission has adopted the Delegated Acts for the VS and for Simplified ESRS (expected in June 2026) before launching any new public consultations.

Deliverables for the second half of 2026 are indicative and subject to regulatory and market developments.

Source: https://www.efrag.org/system/files/sites/webpublishing/Meeting%20Documents/2602131320521776/03-01%20EFRAG%20Work%20programme%202026_SRB_25032026.pdf

The world’s biggest individual investor is effectively redefining financial materiality

Posted on by

The below document published recently by world’s biggest individual investor, NBIM, is a must read for any board member and top manager — as nature is moving up the investor agenda.

NBIM stresses that these expectations are based on their “beliefs about what contributes to long-term value creation and sound risk management”.

Norges Bank Investment Management (NBIM) — holding 2.3% of all listed European companies — is effectively redefining financial materiality

The document sets out how NBIM expects companies to manage environmental and social matters, including nature related impacts, dependencies, risks, and opportunities.

It is not soft guidance, NBIM writes. “It is a de facto global standard for nature‑related governance.”

It includes board‑level oversight requirements, policies, time‑bound targets and action plans, as well as engagement and potential divestment for non‑compliance.

“The degradation of land, freshwater systems, and marine environments all affect the long-term value of companies in our portfolio. The financial risks … are already apparent and are likely to increase over time.

Companies face risks when natural resources they depend on become scarce or degraded, and when their environmental impacts lead to regulatory action, legal liability, operational restrictions or reputational risks.

Evolving trends in consumer demands and availability of natural resources will also present opportunities as new markets are created.

We expect companies to address these topics in a manner meaningful to their business model and wish to support them in their efforts.

Our expectations are primarily directed at company boards.

Boards should understand the broader environmental and social consequences of company operations, taking into account the interests of relevant stakeholders.

They must set their own priorities and account for the associated outcomes.

Companies should pursue relevant opportunities and address significant risks.

They should report financially material information to investors, and broader impacts as appropriate.

Boards should effectively guide and review company management in these efforts.

Our expectations follow a logical implementation flow from strategic oversight to implementation.

The core expectations establish the foundational governance and strategic requirements that boards and senior management should address.”

—

An unparalleled reach across markets and sectors

NBIM manages Norway’s sovereign wealth fund, set up in the 1990s to invest revenues from the country’s oil and gas industry.

The fund, the largest of its kind in the world, currently has a value of just over $2 trillion.

It invests in more than 7,200 companies across 60 countries and has stakes in around 1.5% of the world’s publicly listed stocks with holdings including a 1.3% stake in Nvidia, a 1.2% stake in Apple and a 1.3% stake in Microsoft.

This gives NBIM unparalleled reach across markets and sectors.

Where to start to meet investor expectations?

By adopting the ESRS 2.0 reporting standards and associated governance processes.

If you have not yet participated in our ESRS 2.0 training, offered free of charge, you are welcome to get in touch: https://cleeritesg.com/index.php/how-can-we-help/

 

Sources :

https://www.nbim.no/en/responsible-investment/our-expectations/climate-and-nature/nature/

https://www.nbim.no/contentassets/5fce0e1e7e15449ca986ac1cd26d7e0f/nature-expectations-2026.pdf

CSRD and non-EU country companies after Omnibus I

Posted on by

What does CSRD and Omnibus I mean for non-EU country undertakings with significant presence in the EU?

In short:

➡️ A non‑EU group must report under CSRD if it

  • generates more than €450 million in net turnover within the EU (for each of the two consecutive financial years) AND has,
  • EITHER an EU subsidiary generating more than €200 million in net turnover (or large undertaking),
  • OR an EU branch generating more than €200 million in net turnover

➡️ That EU entity must publish the parent’s sustainability report in the EU

➡️ The non-EU reporting obligations apply for FY 2028 (report published in 2029)

➡️ This report is impact‑focused, not full double materiality.

➡️ A specific reporting standard (N-ESRS) will be adopted for non-EU groups by 30 June 2026.

Read more in the article below 👇

—

Three categories of CSRD in-scope companies must publish a sustainability statement. Each category follows different rules and timelines.

1) EU undertakings (individual reporting) — Article 19a

An EU company must publish a sustainability statement at individual level if it meets these two thresholds:

  • Net turnover > €450 million (for each of the two consecutive financial years), and
  • More than 1,000 employees (average during the financial year)

This applies to large EU companies and credit institutions and insurance undertakings (same thresholds apply).

2) EU parent companies (consolidated reporting) — Article 29a

An EU parent company must publish a consolidated sustainability statement if the group, at consolidated level, if it meets these two thresholds:

  • Net turnover > €450 million (for each of the two consecutive financial years), and
  • More than 1,000 employees (average during the financial year)

Exception:  Financial holding companies that do not intervene in the management of their subsidiaries and whose subsidiary undertakings’ business models and operations are independent of one another, may opt out of consolidated sustainability reporting.

3) Non‑EU (third‑country) undertakings — Article 40a

A non‑EU parent company with significant presence in the EU must publish its parent sustainability statement in the EU (via its EU subsidiary or branch) if:

  • The non‑EU group generates more than €450 million turnover in the EU AND it has
  • either an EU subsidiary with more than €200 million turnover or classified as large,
  • or an EU branch with more €200 million turnover

4) What must third‑country undertakings report?

They must publish a sustainability report at the global consolidated level of the non‑EU parent company.

The report must follow one of these frameworks:

  1. ESRS, or
  2. Standards deemed “equivalent” by the European Commission, or
  3. Specific reporting standards (N-ESRS) that the Commission will adopt through delegated acts for non‑EU groups by 30 June 2026.

Specifically, N-ESRS will specify the information that an undertaking shall disclose about its material impacts in relation to environmental, social, and governance sustainability topics.

This non-EU special standard focuses on “impact‑related information” only — not on financial risks or opportunities. This is a deliberate political and legal choice:

  • The CSRD legally limits their reporting scope.
  • The EU cannot impose full double materiality on non‑EU parents.
  • Impact reporting fills the gap left by ISSB/IFRS-S.
  • It avoids excessive burden and jurisdictional conflict.
  • It ensures minimum transparency for EU markets.

The report must be:

  • Published in the EU,
  • Digitally tagged,
  • Freely accessible,
  • Prepared in a single electronic reporting format.

5) Role of the EU subsidiary or branch

The EU subsidiary or branch is responsible for:

  • Publishing the parent company’s sustainability report in the EU,
  • Ensuring it is accessible to the public.

6) Assurance requirements

The report must undergo limited assurance.

7) Timeline

The obligations for third‑country undertakings apply later than for EU companies, with reporting expected to begin 2029 for financial year 2028.

8) Purpose of the rules

  • Ensure level playing field between EU and non‑EU companies.
  • Provide investors with comparable sustainability data.
  • Prevent regulatory arbitrage by large non‑EU groups operating in the EU.

9) When Can an EU Subsidiary Be Exempt from Sustainability Reporting?

Article 19a(9) of the CSRD also sets out when an EU subsidiary can be exempt from preparing its own sustainability statement.

In short: a subsidiary doesn’t need to report separately if it is fully covered by its parent company’s consolidated sustainability report.

When the exemption applies

An EU subsidiary can rely on the parent company’s reporting if:

  • The parent (EU or non‑EU) publishes a consolidated sustainability report that includes the subsidiary.
  • That consolidated report follows EU sustainability reporting standards (ESRS) or is deemed equivalent to them.
Conditions the subsidiary must meet

To use the exemption, the subsidiary must include in its own management report:

  • The name and registered office of the parent company.
  • Weblinks to the parent’s consolidated sustainability report and its assurance opinion.
  • A clear statement that the subsidiary is exempt from preparing its own sustainability report.
Additional rules for non‑EU parent companies

If the parent is outside the EU:

  • Its consolidated sustainability report and assurance opinion must be published in line with EU rules.
  • The subsidiary must still disclose the EU Taxonomy Article 8 indicators for its own EU activities, either in its own management report or within the parent’s consolidated report.
  • Why this matters: Article 8 of the EU Taxonomy requires companies to disclose KPIs such as: Taxonomy‑eligible and aligned turnover, CapEx and OpEx. These KPIs must still be visible for the EU‑based activities, even if the parent handles the rest of the sustainability reporting.
  • In other words: Even when a non‑EU parent covers the group’s sustainability reporting, the EU subsidiary cannot “disappear” from the EU Taxonomy. Its EU activities must remain transparent and compliant.
Language requirements

Member States may require the parent’s consolidated report to be published in a locally accepted language, with translation if needed.

10) Do Joint Ventures count in the employee CSRD thresholds?

Under Directive 2013/34/EU, a joint venture is not treated as a subsidiary (full control) but as an undertaking under joint control, typically accounted for using:

  • the equity method in consolidated accounts, or
  • cost or equity method in individual accounts.

In both cases, employee numbers of the joint venture are not added to the parent’s employee count.

The directive only requires including employees of subsidiaries in consolidated thresholds.

Article 3(5)–(7) specifies that groups calculate thresholds on a consolidated basis, which includes only parent + subsidiaries:

“groups shall be groups consisting of parent and subsidiary undertakings to be included in a consolidation and which, on a consolidated basis, exceed the limits of …”

—

Sources:

[CSRD] Directive (EU) 2022/2464: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32022L2464

[Accounting Directive ] Directive 2013/34/EU: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A02013L0034-20240528

[Omnibus I] Directive (EU) 2026/470 of the European Parliament and of the Council of 24 February 2026 amending Directives 2006/43/EC, 2013/34/EU, (EU) 2022/2464 and (EU) 2024/1760 as regards certain corporate sustainability reporting requirements and certain corporate sustainability due diligence requirements: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202600470

More about EFRAG’s draft N-ESRS project: https://www.efrag.org/en/projects/noneu-groups-standard-setting/research-phase

Summary of opinions on draft simplified ESRS: ECB, EBA, ESMA, EIOPA

Posted on by

🔎 What the financial and supervisory authorities expect from the revised ESRS

When the European Commission adopts the delegated acts on the ESRS, it must consider EFRAG’s draft (December 2025) and request the opinions of a wide range of EU bodies — including ESMA, EBA, EIOPA, the ECB, the European Environment Agency, the EU Agency for Fundamental Rights (FRA), the Committee of European Auditing Oversight Bodies and the Platform on Sustainable Finance.

Below is a short overview of the ECB, EBA, ESMA and EIOPA opinions — all of which shed light on the sustainability information that financial markets need, and the expectations placed on companies, banks and insurers.

You can download a more comprehensive summary here: Summary of ECB, EBA, ESMA and EIOPA opinions on simplified ESRS 05-03-2026

🔹 Digitisation and usability

ESMA emphasises that effective digital tagging is essential for the usability of sustainability information. Users must be able to identify and retrieve key data efficiently.

🔹 Concerns about cumulative reliefs

All authorities highlight that the accumulation of relief measures risks undermining the CSRD’s objective: creating a reliable, standardised data ecosystem that enables benchmarking, risk differentiation and comparability.

🔹 Permanent reliefs and distorted incentives

They warn that several permanent reliefs could create incentives for undertakings to omit relevant information or delay efforts to improve methodologies and data access. This would weaken the integrity and comparability of disclosures — and increase greenwashing risks.

🔹 Competitiveness and alignment with ISSB

In many areas, the new ESRS reliefs go beyond those in the IFRS ISSB standards, with potential negative consequences for EU companies’ competitiveness and access to global financial markets.

🔹 Reliefs must remain exceptional

The ECB recognises that companies may need initial flexibility while building data systems and estimation methods. But it stresses that reliefs must remain exceptional, not become the norm.

🔹 Progressive capability‑building

For the EBA, once impacts, risks and opportunities (IROs) are identified, undertakings should progressively equip themselves to provide the required ESRS information.

🔹 Avoiding long‑term data gaps

All authorities agree: it is essential to avoid indefinite data gaps and to maintain incentives for companies to start collecting data and improving coverage and quality.

🔹 Assurance implications

ESMA notes that permanent reliefs will require additional judgement from assurance providers and more documentation from preparers — potentially increasing the reporting burden.

👥 FRA’s perspective

In addition, the EU Agency for Fundamental Rights (FRA) issued an opinion focused on safeguards for people adversely affected by corporate activities. FRA warns that several changes may make severe or systemic human rights impacts less visible — especially those occurring deep in value chains or affecting marginalised groups.

FRA’s full opinion is particularly relevant for HR, sustainability and compliance professionals: https://fra.europa.eu/en/news/2026/fra-issues-legal-opinion-proposed-simplified-european-sustainability-reporting-standards

Link to the Omnibus I directive: Directive – EU – 2026/470 – EN – EUR-Lex

European Union Agency for Fundamental Rights opinion on draft simplified ESRS

Posted on by

While ECB, EBA, ESMA and EIOPA focus in particular on cross-cutting and environmental standards, the European Union Agency for Fundamental Rights (FRA) opinion assesses whether the proposed simplifications of ESRS preserve essential safeguards for people adversely affected by corporate activities, and do not compromise the protection of human rights or the quality of disclosures.

FRA applies a risk-based human rights approach, grounded in the UN Guiding Principles on Business and Human Rights and the OECD Guidelines for Multinational Enterprises.

FRA’s full opinion is particularly relevant for HR and compliance professionals: https://fra.europa.eu/en/news/2026/fra-issues-legal-opinion-proposed-simplified-european-sustainability-reporting-standards

Here’s a short summary :

What changed / Why it matters for fundamental rights

  • The recent simplification of the ESRS aimed to ease the reporting burden on companies, particularly smaller entities, while seeking to retain the essential safeguards that underpin effective sustainability disclosure.
  • The sustained focus on a human rights risk-based framework aligned with the approach articulated in the UNGPs is welcome for its potential to enhance focus and practicality.
  • However, a more streamlined regime also carries risks, including the possibility of inconsistent application or reduced transparency where companies interpret materiality too narrowly.
  • The draft simplified ESRS introduce extensive reductions in mandatory data points, broaden the reliance on reliefs and phase ins, and increase the use of estimates and proxies in value chain reporting.
  • Social metric reductions affect gender equality, non-employee transparency, work life balance, and occupational health and safety, while climate and pollution disclosures have become less prescriptive.
  • These changes matter because they may render making severe or systemic human rights impacts less visible, particularly where they occur deep in value chains or affect marginalised groups.
  • Moreover, simplifications in climate and pollution reporting may slow the detection of harms affecting fundamental rights to health, decent work, and a safe environment.

FRA are also apposed to relocating human rights policy disclosures to a single, cross-cutting item ( GDR-P), since it risks reducing human rights to generic statements. The GDR-P disclosures should require to remain explicitly disaggregated by rightsholder group (own workforce, value chain workers, affected communities and consumers), setting out group-specific commitments and the associated governance and due diligence approaches, rather than a single, undifferentiated policy statement.

In addition, FRA identifies three clusters of changes that could significantly weaken transparency on gender outcomes:

1️⃣ Gender pay gap (S1‑15)

The simplified ESRS would require companies to disclose only the unadjusted gender pay gap — a single aggregate figure showing the raw difference in average pay between men and women.

No adjusted analysis.

No breakdown by age, category, or country.

This falls short of both GRI and the Pay Transparency Directive, which requires deeper analysis and action when unexplained gaps exceed 5%.

Without granularity, companies may appear compliant while lacking the insight needed to detect discrimination or structural bias.

2️⃣ Removal of gender‑disaggregated data

Several mandatory gender breakdowns disappear in the simplified standards, including:

▪️ non‑guaranteed‑hours employees (S1‑5)

▪️ participation in performance and career development reviews, and average training hours (S1‑12)

▪️ uptake of family‑related leave (S1‑14)

These deletions reduce visibility into gender‑specific outcomes — especially for women in precarious roles or with limited access to development opportunities.

They also diverge from GRI requirements and weaken the ability to identify structural barriers.

3️⃣ From “parental leave” to “maternity leave” (S1‑10)

Replacing parental leave with maternity leave narrows the scope of social protection disclosures.

EU law — notably Directive (EU) 2019/1158 — promotes shared caregiving, granting each parent at least four months of parental leave.

By focusing only on maternity leave, the simplified ESRS risk reinforcing the stereotype that childcare is primarily a women’s responsibility, sidelining fathers and undermining gender equality objectives.

🔍 Why this matters

Taken together, these revisions reduce the ESRS’ ability to reveal gender disparities.

Without mandatory gender‑disaggregated data, companies will struggle to identify patterns such as:

▪️ women’s over‑representation in variable‑hour or part‑time roles,

▪️ unequal access to training and career development,

▪️ structural barriers affecting women differently across operations and value chains.

Intersectional inequalities — increasingly recognised in EU policy — also become harder to detect when disclosures are limited to aggregate figures.

💬 Final thought

Transparency is not a burden; it is a prerequisite for progress.

If we want to close gender gaps, our reporting standards must illuminate inequalities — not obscure them.

Let’s keep pushing for the data and the standards that make equality real.