Compliance means knowing which rules apply to your company, doing what those rules require, and being able to show your work. In an ESG sense, the rules concern environmental impact, treatment of people, and how the company is run: the permit that limits a discharge, the emissions figure that must be reported, the supplier practice that must be checked, and the public claim that must be true. A company is not compliant because it has good intentions or a polished report. It is compliant when each obligation has been identified, met on time, and backed by evidence someone else can inspect.
That sounds simple because the idea is simple. The difficulty is that “the rules” do not arrive as one tidy list. They come from different governments, regulators, customers, lenders, contracts, and standards, and they change at different speeds. BC ESG’s ESG Meaning page separates the wider term into its environmental, social, and governance parts. Compliance is where those categories turn into specific duties with owners, dates, thresholds, and records.
The three jobs inside the word
1. Know the rule
First, the company has to know that an obligation exists and whether it applies. That means identifying the jurisdiction, entity, activity, threshold, reporting period, deadline, and current legal status. A proposal is not yet a duty. A paused rule is not the same as a live one. A rule covering a parent company may not cover every subsidiary in the same way.
This is why a compliance register matters. It is not a folder of PDFs. It is the working list of what is owed, to whom, by when, under which test, and with what evidence. Without that list, compliance depends on memory and whoever happens to hear about a rule first.
2. Meet the rule
Next, the company has to do the thing required: measure the emissions, stay inside the permit limit, collect the supplier evidence, correct the unsafe practice, publish the disclosure, or stop making the claim it cannot support. Meeting the rule may require new data, a changed process, capital spending, training, or a decision to withdraw a product or statement.
A policy by itself does not meet a rule. “We require suppliers to respect human rights” is only a sentence until purchasing knows what evidence to request, what finding triggers action, and who can pause an order. A climate target is not a filing. A code of conduct is not proof that the conduct happened.
3. Prove it
Finally, the company must be able to show what it did. Proof can be a meter record, calculation, inspection, approval, training log, supplier audit, board minute, filing confirmation, or assurance report. The evidence should connect the requirement to the result: which data were used, who checked them, what changed, and when.
This third job is where many ESG efforts fail. The work may have happened, but the trail is scattered across inboxes and spreadsheets. When a regulator, auditor, customer, or court asks later, “we did it” is weaker than a dated record showing how the company knew, decided, acted, and checked.
What makes compliance an ESG subject?
All companies have compliance duties. ESG compliance is the slice attached to environmental, social, and governance obligations. On the environmental side, it includes permits, waste and pollution controls, product restrictions, building-performance requirements, and emissions measurement and disclosure. On the social side, it includes workplace safety, labour standards, human-rights due diligence, and rules against forced labour in supply chains. On the governance side, it includes truthful disclosure, documented oversight, controls over data and claims, and a process for finding and correcting failures.
Disclosure is the part readers now meet most often. Under the CSRD as amended by the Omnibus, the in-scope threshold is more than 1,000 employees and more than €450 million in turnover, and double materiality remains the gateway: the company tests both its effects on people and the environment and the financial effects those issues can have on the company. BC ESG’s CSRD double-materiality guide works through how that test is applied.
California shows why status belongs in the register. SB 253’s Scope 1 and 2 reports are due November 10, 2026. SB 261, its climate-risk reporting sibling, is under a Ninth Circuit injunction. Treating both as simply “California climate compliance” would miss the operative difference: one duty is live; the other is paused. The California climate disclosure playbook follows those mechanics.
The SEC gives the same lesson from the opposite direction. Its 2024 climate disclosure rules never took effect, and rescission has been proposed but is not final. A headline saying a rule is coming, stayed, withdrawn, or proposed for rescission is not enough. Compliance begins with the legal status and the exact obligation, not the loudest summary of it.
The family of words around compliance
Regulatory compliance is the part owed under laws, regulations, permits, listing rules, and regulator-made requirements. It answers the question, “What does an authority require of us?” BC ESG’s compliance frameworks map sorts those requirements by who issues them, what compels the company to follow them, and where they overlap. Regulatory compliance is usually the non-negotiable layer, although contracts and customer requirements can be just as commercially binding.
Corporate compliance is the company’s internal system for handling those obligations. It includes the register, accountable owners, procedures, training, monitoring, escalation, investigation, and correction. It also covers internal rules the company adopts for itself, such as approval limits and codes of conduct. If regulatory compliance names the external duty, corporate compliance is the machinery that makes sure the duty is not left to chance.
Trade compliance concerns what crosses borders. It includes customs classification and valuation, export controls and sanctions, import restrictions, product rules, origin claims, and evidence that goods were not made with prohibited labour practices. In ESG work, trade compliance is where a supply-chain promise meets a shipment: a company may have a responsible-sourcing policy, but the practical questions are what the goods are, where they came from, who handled them, and what documents prove it.
Compliance risk is the exposure created by the gap between what is owed and what the company can actually do or prove. The gap can be ignorance, weak data, a missed deadline, a control that exists only on paper, or a public claim that runs ahead of the evidence. BC ESG’s ESG risk explainer treats that exposure operationally: what can hurt the company, how badly, and what reduces it.
Compliance, governance, and risk are not synonyms
These three words work together, but they do different jobs. Compliance asks, “What must we do, and can we show that we did it?” Governance asks, “Who decides, who oversees the decision, and who is accountable when the answer changes?” Risk asks, “What could happen, how serious would it be, and how much uncertainty can we accept?”
A board can govern well and still discover a compliance failure. A risk assessment can identify a danger without creating a legal duty to use one particular control. A company can satisfy a filing rule and still carry a large physical or transition risk that no filing removes. Keeping the words separate prevents a common mistake: treating a completed disclosure as though it were a decision, or treating a risk workshop as though it were evidence of compliance.
The connection is just as important. Governance sets ownership and escalation. Risk work helps decide where limited attention goes first. Compliance supplies the fixed points—the duties that must be met whether or not they rank highest in a workshop. Tonight’s companion piece, Risk Management Through ESG and Compliance, takes the board-level view of how those pieces fit together.
What being compliant looks like week to week
In a functioning company, compliance is mostly unglamorous maintenance. Each obligation has a named owner. The source data have a known home. Calculations can be traced. Deadlines sit on a calendar early enough for review. Exceptions are recorded rather than quietly worked around. When a rule changes, someone updates the register, the procedure, and the evidence request—not just a slide.
A useful obligations register usually records the authority and requirement, the entities and activities covered, the threshold or trigger, the due date or frequency, the internal owner, the control used to meet it, the evidence retained, and the status of any gap. A compliance check then compares that register with reality: What has changed? Which evidence is missing? Which deadline moved? Which claim in a report or sales document no longer matches the underlying record?
That weekly discipline is the real difference between a programme and a scramble. The scramble begins when a filing date, customer questionnaire, audit, or border hold reveals that nobody owns the answer. The programme is slower in appearance and faster in fact, because the answer already has a place to live.
What compliance is not
Compliance is not a certificate on the wall. A management-system certificate or assurance statement may be useful evidence for a defined scope and period, but it does not settle every law, site, product, or claim outside that scope. Nor is compliance only the legal department’s problem. Lawyers can interpret duties and defend decisions; operations produce the emissions, purchasing holds the supplier records, finance controls the reporting process, and communications makes many of the claims that later need support.
It is not one-and-done, because both the company and the rulebook move. A new facility, acquisition, supplier, product, market, or public claim can create a duty that did not exist last year. A rule can also narrow, pause, or change form. And compliance is not the same as being responsible in the broad moral sense. A company can meet a minimum legal requirement and still make a poor environmental or social choice. Compliance is the floor that can be tested, not the whole judgement of whether the company behaved well.
The plain test is this: pick any ESG statement the company makes and ask three questions. Which rule or commitment sits behind it? Who owns meeting it? What record would persuade a sceptical outsider? If those answers are clear, the word “compliance” is doing real work. If they are not, it is still just vocabulary.