BC ESG

Blog

  • Compliance Frameworks, Mapped: Who Issues Them, Who Must Comply, and How They Overlap

    A compliance framework is a published set of requirements or controls that tells an organization what it must do — or what good looks like — in an area such as financial reporting, data protection, workplace safety, or environmental management. Frameworks come from legislatures, regulators, standards bodies, and industry groups, and they differ in a way that matters enormously in practice: some are law with penalties behind them, and some are voluntary standards that become mandatory only because a customer, contract, or certification demands them.

    Boardrooms tend to meet frameworks as an undifferentiated pile of acronyms, each arriving with its own auditor and deadline. The pile becomes manageable once sorted by two questions: who issued this, and what compels us to follow it? This page is that sorting — a map, not a sales pitch.

    Who Issues Compliance Frameworks?

    Compliance frameworks are issued by four kinds of bodies: governments and regulators, whose frameworks are law; international standards organizations, whose frameworks are voluntary until adopted or contracted; industry bodies, whose frameworks govern a sector’s participants; and reporting initiatives, whose frameworks shape disclosure to investors and the public. Knowing which kind you are looking at tells you the consequence of ignoring it — prosecution, decertification, expulsion from a payment network, or a difficult conversation with shareholders.

    Governments and regulators issue the non-negotiables. Financial reporting law for public companies, data-protection regulation, occupational safety rules, environmental permits and emissions rules: these bind by jurisdiction, apply whether or not a company likes them, and carry fines or worse. Examples of the genre include the Sarbanes-Oxley Act’s internal-control requirements for U.S. public companies, the European Union’s General Data Protection Regulation (GDPR) for personal data, and the U.S. Occupational Safety and Health Administration’s (OSHA) workplace standards. Nobody opts in. The only decisions are how to comply and how to prove it.

    International standards bodies — principally the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) — publish management-system standards: ISO 9001 for quality, ISO 14001 for environmental management, ISO/IEC 27001 for information security, ISO 45001 for occupational health and safety. These are voluntary in law. In practice, they become compulsory the moment a major customer requires certification in a supply contract or a tender scores it — which, in many industries, is most of the time.

    Industry and scheme bodies govern participation in a system. The PCI Security Standards Council — founded by the major card brands — maintains the PCI DSS, which applies to organizations that handle payment card data not by statute but by contract with the card networks; non-compliance risks fines through acquiring banks and, ultimately, the ability to take cards at all. Accounting and audit professions, through bodies such as the American Institute of Certified Public Accountants (AICPA), maintain attestation frameworks like the SOC reporting suite, which service providers undergo to demonstrate controls to their customers’ auditors.

    Reporting and disclosure initiatives — the GHG Protocol for emissions accounting, sustainability reporting standards such as those of the International Sustainability Standards Board (ISSB) and the Global Reporting Initiative (GRI) — set the formats in which companies disclose. Voluntary at birth, they harden into obligation as securities regulators adopt them into listing rules and as large buyers require them of suppliers.

    How Do the Frameworks Overlap?

    Frameworks overlap because they are all, underneath the vocabulary, asking for the same management behaviors: assign responsibility, assess risk, write the procedure down, control access, train people, monitor what happens, and fix what fails. An organization with disciplined document control, access management, incident response, and internal audit will find that each new framework reuses most of what the last one built. The overlap is the good news buried in the acronym pile.

    The overlaps worth knowing concretely: the ISO management-system standards share a common structure by design, so a company certified to one can extend to another at a fraction of the first one’s cost. Control frameworks converge — the access-control, logging, and change-management evidence produced for a SOC 2 examination substantially serves PCI DSS and ISO 27001 audits, even though each is attested differently. And data-protection law sits across all of them: GDPR-style obligations attach to the personal data processed inside every other framework’s systems.

    Where overlap becomes waste is duplication without mapping: three audits sampling the same evidence because nobody cross-referenced the requirements, or parallel policy libraries written separately for each regime. Mature compliance functions maintain one control set mapped to many frameworks — comply once, attest many times. Immature ones discover the map after paying for the territory several times over.

    How Should a Leadership Team Read This Map?

    A leadership team should read the framework landscape by compulsion and by audience: what binds us by law in the jurisdictions where we operate; what binds us by contract with the customers and networks we depend on; and what we adopt voluntarily because the market rewards it. Each layer gets a different governance conversation — legal obligations are resourced without debate, contractual ones are weighed against the relationship they protect, and voluntary ones must justify themselves commercially.

    That ordering also restores proportion. The question in the boardroom is rarely “how do we comply with everything?” It is “what is actually being asked of us, by whom, with what consequence — and what single set of controls answers the most of it?” Companies that can answer that question on one page rarely fear the acronym pile. Companies that cannot are usually complying with the loudest auditor rather than the binding requirement, which is the most expensive posture of all.

  • Carbon Credits and the GHG Protocol: How the Accounting Works and Where the Scams Live

    A carbon credit is a tradable certificate representing one metric tonne of carbon dioxide equivalent that was either removed from the atmosphere or prevented from being emitted. A project generates credits by demonstrating — under a standard, verified by a third party — that its activity reduced emissions beyond what would have happened anyway. A buyer purchases credits and retires them, claiming the reduction against its own footprint. The GHG Protocol is the accounting framework that defines the footprint in the first place.

    The GHG Protocol tells a company how to count its emissions. The credit market sells instruments companies use against that count. Confusion between the ledger and the instruments is where most of the trouble — honest and otherwise — begins.

    What Is the GHG Protocol and What Does It Count?

    The GHG Protocol is the most widely used international standard for measuring and reporting greenhouse gas emissions, developed by the World Resources Institute (WRI) and the World Business Council for Sustainable Development (WBCSD). Its Corporate Standard sorts a company’s emissions into three scopes: direct emissions from sources it owns or controls, indirect emissions from the energy it purchases, and all other indirect emissions across its value chain, upstream and downstream.

    The scopes, translated:

    Scope 1 is what you burn yourself: fuel in your furnaces, your fleet’s diesel, refrigerant leaks from your equipment. If the emission leaves a stack, tailpipe, or valve you control, it is Scope 1.

    Scope 2 is the energy you buy: electricity, steam, heating, cooling generated by someone else. The emissions happen at the power plant, but the protocol assigns them to you because your demand caused them.

    Scope 3 is everything else in the value chain: emissions embedded in purchased goods, business travel, employee commuting, product transport, and what happens to products after sale. For most companies Scope 3 is the largest category and the hardest to measure, because it depends on data from suppliers who may not measure it themselves.

    The protocol’s contribution is comparability: two companies using it produce inventories built on the same definitions, which is what makes reporting, targets, and — eventually — credit purchases meaningful. A footprint figure with no stated methodology behind it is a marketing number. A footprint built on the Corporate Standard is an account that can be audited.

    How Does a Carbon Credit Get Created and Retired?

    A carbon credit is created when a project developer carries out an emissions-reduction activity — protecting a forest at risk of clearing, capturing methane from a landfill, distributing cleaner cookstoves — and has the reduction quantified and verified under a carbon standard, after which a registry issues credits with unique serial numbers into the developer’s account. Credits move between accounts as they are sold, and a credit’s environmental claim is consumed when a buyer retires it in the registry, permanently, in their own name.

    Three mechanisms in that chain carry the integrity of the whole market:

    Additionality. The reduction must be additional — it would not have happened without the credit revenue. A forest nobody intended to cut, a renewable plant that was already profitable: reductions there may be real in a physical sense but were not caused by the credit, so selling them lets a buyer claim progress that the purchase did not create.

    Verification and the registry. Independent auditors check projects against the issuing standard’s methodology, and registries track each credit’s serial number to prevent double-selling. The registry is the market’s land title office: if a tonne appears in two accounts, the market has failed at its most basic job.

    Retirement. A purchased credit sitting in an account is an asset, not a claim. Only retirement — permanent removal from circulation, recorded publicly — converts it into the buyer’s offset claim. Credits resold onward carry their claim with them; retired credits are spent and gone.

    Where Do the Scams Live?

    The scams in carbon markets live in the gap between the claim and the atmosphere: credits issued for reductions that never happened or would have happened anyway, credits counted twice, and credits marketed to buyers who do not understand — or prefer not to understand — what they purchased. Investigative reporting and academic reviews have repeatedly found categories of credits, particularly some older forestry credits, that likely represented little real reduction.

    The recurring failure patterns, stated factually:

    Phantom reductions. Baseline inflation is the classic: a project claims it prevented emissions against a hypothetical scenario — deforestation that was asserted but implausible — and is credited for the difference. The credits are real certificates backed by an imaginary counterfactual.

    Double counting. The same reduction claimed by the project developer, the host country toward its national targets, and the purchasing company toward its own. Standards and registries exist largely to prevent this; it persists at the seams between systems.

    Permanence failure. A forest credit represents carbon stored in trees. Trees burn. If the stored carbon returns to the atmosphere in a wildfire twenty years later and no buffer or insurance mechanism replaces it, the buyer’s claim evaporated with the forest.

    Retail fog. At the consumer end, credits and offsets are marketed with language — “carbon neutral flight,” “net-zero product” — that implies a precision the underlying instruments do not have. Regulators have begun treating unsupported neutrality claims as a consumer-protection issue, which moves this category from embarrassment risk to legal risk.

    The proportionate response for a buyer is not to abandon the market but to buy like an auditor: favor credits with conservative baselines, strong registries, buffer pools against reversal, and transparent project documentation — and make public claims that match what the instruments can actually support. Count honestly under the GHG Protocol, reduce what you can directly, and let credits carry only the weight they can bear.

  • ESG Risk, Explained: What It Means Operationally for a Mid-Size Company

    ESG risk is the risk a company carries from environmental, social, and governance factors: the physical and regulatory exposure in its operations and supply chain, the workforce and community issues that can disrupt it, and the quality of the oversight making its decisions. For a mid-size company, ESG risk is not a philosophy or a reporting exercise. It is a practical inventory of things that can interrupt revenue, raise costs, or close doors — increasingly asked about, in writing, by customers, lenders, and insurers.

    Strip away the acronym wars and the term points at ordinary operational questions wearing new labels. What happens to your facility in a flood plain? What happens to your costs when a major customer starts requiring supplier disclosures? What happens to your insurance renewal, your credit terms, your ability to hire? ESG risk is the discipline of answering those questions before someone else asks them on a form with a deadline.

    What Are the Three Parts of ESG Risk?

    The three parts are environmental exposure (how the physical world and environmental rules can hurt the business), social exposure (how people — employees, customers, communities — can hurt or be hurt by it), and governance exposure (how decision-making failures turn small problems into large ones). Each part contains risks a mid-size company already manages informally. The framework’s value is making the inventory explicit, owned, and reviewable.

    Environmental. Physical risks come first for most operators: severe weather exposure of facilities and inventory, dependency on a single site, water and energy costs. Transition risks follow: a regulation changes what you can sell or what it costs to run; a large customer adopts procurement standards that reach into your operation. Neither category requires a position on climate politics. Both show up in budgets.

    Social. Workforce safety and turnover, labor practices in your supply chain, product safety, community relations around a facility. For a mid-size company the sharpest social risks are usually concentration risks: one key customer relationship damaged by a preventable incident, one safety event that becomes a reputation event, one supplier whose practices become your headline.

    Governance. Who actually decides, and what do they see? Board or owner oversight of risk, financial controls, data privacy practices, succession, the gap between stated policy and daily practice. Governance failures are the multiplier: they are how an environmental or social problem becomes a fraud headline or a regulatory action. When investigators reconstruct a corporate failure, they almost always find the governance layer failed first and longest.

    Why Is ESG Risk Landing on Mid-Size Companies Now?

    ESG risk is landing on mid-size companies because their largest customers, lenders, and insurers are being asked the same questions and are passing the inquiry down the chain. A public company with reporting obligations needs data from its suppliers. A bank managing portfolio risk wants to understand borrower exposure. An insurer repricing climate-affected coverage wants to know what an insured has done about it. The mid-size company is rarely the target of the regulation — it is the target of the questionnaire.

    This cascade is the part worth understanding, because it reframes the work. You do not need a sustainability department to answer a customer’s supplier survey honestly and completely. You do need to know your answers: your energy use, your safety record, your policies, your exposures. Companies get into trouble in these exchanges not by having imperfect numbers but by having no numbers — or worse, by writing down aspirations as if they were facts. Regulators in several jurisdictions have fined companies, including large ones, for public ESG claims their operations could not support. The operational risk to a mid-size firm is less the exposure itself than overstating the response to it.

    What Should a Mid-Size Company Actually Do About ESG Risk?

    A mid-size company should start with an inventory, not a program: list the environmental, social, and governance exposures that could realistically interrupt operations or revenue, assign each an owner, and record what is already being done about it. Then answer the questions your customers and insurers are actually asking, accurately, from that inventory. Formal reporting frameworks can come later, sized to what stakeholders genuinely require.

    In sequence, the work usually looks like this. First, the exposure inventory — a page or two, written by the people who run the operation, covering physical risks to sites and supply chains, key-person and safety risks, and basic governance facts (controls, oversight, privacy practices). Second, a claims audit: read what your website, proposals, and marketing currently say about your environmental and social performance, and make sure every sentence is defensible. Third, a response file: the standard documents customers request — policies, safety statistics, utility data — assembled once and kept current, so each new questionnaire is an afternoon instead of a scramble.

    Done in that order, ESG risk management is unglamorous and proportionate: an operator knowing their exposures, in writing, before a form asks. That is the level at which the subject actually touches most mid-size companies — and handling it at that level is what separates a manageable compliance task from a credibility problem discovered in public.

  • November 10 Is Locked: California’s OAL Approval Puts Scope 1 and 2 on the Calendar for Facilities

    On October 12, 2026 the California Office of Administrative Law approved the California Air Resources Board’s Initial Regulation implementing SB 253 and SB 261. The rule became effective the same day. It sets November 10, 2026 as the first deadline for Scope 1 and Scope 2 greenhouse gas emissions reports under the Climate Corporate Data Accountability Act for U.S.-organized companies with more than $1 billion in annual revenue that do business in California.

    CARB had earlier withdrawn the package to push the date from August 10 to November 10 and to clarify certain mechanics. The OAL approval ends that uncertainty for the 2026 cycle. More than 4,000 U.S. companies were identified in CARB’s preliminary list as likely in scope. For the first year, companies may use emissions data they already had or were collecting as of December 5, 2024, or they may file a statement of non-reporting if they were not collecting the data. Third-party assurance is not required for 2026 submissions. Scope 3 value-chain reporting begins in 2027.

    SB 261, the companion Climate-Related Financial Risk Act covering companies above $500 million, remains subject to a Ninth Circuit injunction. Enforcement is stayed pending appeal. The Scope 1 and 2 obligation under SB 253 is not.

    What the number actually changes for facility teams

    The hard date is November 10, 2026. That is less than four weeks from the approval. Facility managers, property managers, and real-estate operators who sit inside or sell to companies above the $1 billion threshold now face a concrete data demand, not a future rulemaking.

    Scope 1 covers direct emissions from company-controlled sources—on-site boilers, generators, fleet vehicles. Scope 2 covers purchased electricity, steam, heating, and cooling. Most commercial buildings generate both. The data already lives in utility bills, fuel invoices, and building-management systems. The work is assembling it into a report that matches the GHG Protocol or an equivalent standard CARB accepts.

    For property managers the immediate so-what is ownership of the inventory. If the building owner or the corporate occupier is a reporting entity, someone must produce the numbers. Green-lease clauses that already allocate energy data sharing become operational this month. Facilities teams that have treated ESG language as boilerplate now have a filing date attached to it.

    Contract clauses that move from aspiration to requirement

    IFMA’s earlier Facility Management Pulse showed 45 percent of facilities managers already writing ESG or sustainability provisions into project contracts. The October 12 approval gives those clauses a concrete use. Price-escalation, cybersecurity, and data-security language were already rising; emissions data access is the next line item that can be justified with a calendar date.

    Practical language that now has a deadline behind it includes:

    • Utility and fuel data delivery within a fixed number of days after month-end.
    • Access to building-management-system exports for Scope 2 calculations.
    • Contractor notification of on-site fuel use or temporary equipment that creates Scope 1 emissions during a project.
    • Record retention aligned with the five-year California tax-record obligation in the Initial Regulation.

    None of this requires inventing new Scope 3 methodologies today. Scope 3 is still 2027. The 2026 filing is Scope 1 and 2 only. Teams that already collect vendor carbon for GRESB or internal targets can keep doing so, but the regulatory clock for purchased goods and services has not started.

    Green leases and the owner-occupier split

    The same building can generate reporting obligations on both sides of the lease. The owner may need Scope 2 for base-building energy. The tenant may need Scope 1 and 2 for its own operations and, later, Scope 3 Category 1 for the services it purchases. Restoration, janitorial, and capital projects sit in that Category 1 line when the tenant engages the work.

    Property managers sit at the only point where every trade is authorized. Making energy and fuel data a condition of engagement is cheaper in October 2026 than reconstructing it from invoices in November. The Initial Regulation also sets an annual fee framework; earlier staff estimates put the SB 253 fee near $3,106 per entity. The fee is small relative to the cost of a late or incomplete filing, but it is real and due after the December 10 determination notice.

    What to do before November 10

    Confirm whether the entity is in scope: U.S.-organized, more than $1 billion revenue, doing business in California. CARB sent reminder letters to organizations on its preliminary list. If the company was not collecting Scope 1 and 2 data as of December 5, 2024, a statement of non-reporting is available for this cycle.

    For everyone else, pull the utility and fuel files, map them to the GHG Protocol, and decide the submission path—CARB’s voluntary online intake platform or email to [email protected]. Document the methodology. The 2026 reports do not require limited assurance, but the data will be the baseline for later years when assurance and Scope 3 arrive.

    Facility teams that treat the November 10 date as a data-collection drill rather than a compliance crisis will be positioned when Scope 3 categories that touch capital goods, purchased services, and waste begin in 2027. The OAL approval did not invent the obligation. It removed the last procedural excuse for treating it as optional.

    How the 2026 numbers feed 2027 Scope 3 work

    The 2026 Scope 1 and 2 inventory becomes the organizational boundary for later Scope 3 calculations. When Category 1 purchased goods and services and Category 2 capital goods enter the reporting window in 2027, the same facility data systems that produced this year’s numbers will be asked to tag contractor activity. Restoration jobs, roof replacements, HVAC retrofits, and janitorial contracts all sit in those categories when the reporting entity engages the work.

    GRESB scores already reward supplier ESG monitoring. Green-lease riders that require energy and water data sharing can be extended, without new legal invention, to require the same data formats that will satisfy CARB’s 2027 templates. The Initial Regulation’s five-year record-retention rule for threshold determinations also creates a paper trail that auditors and later assurance providers will expect to see.

    The practical sequence is short. First, lock the Scope 1 and 2 file by November 10 using data already in hand. Second, inventory the vendors and capital projects that will fall into Scope 3 Categories 1 and 2 next year. Third, write the data-delivery clause into the next round of service agreements so the reconstruction cost never appears. The October 12 OAL approval simply made the first step non-optional for covered entities.

    Facilities operators who treat the deadline as a one-time filing exercise will spend 2027 reconstructing invoices. Those who treat it as the start of a recurring data system will have the files when the Scope 3 wave arrives. The regulation did not create new physics; it created a calendar.

  • SEC Climate Disclosure Rule: 2026 Status & What Comes Next

    SEC Climate Disclosure Rule: 2026 Status & What Comes Next

    SEC Climate Disclosure Rule: 2026 Status, Timeline & What Companies Must Do Now

    Updated October 6, 2026.

    The SEC’s 2024 climate disclosure rule has been effectively rescinded. The SEC stopped defending it in March 2025 and proposed full withdrawal. But disclosure obligations haven’t disappeared — California’s SB 253, the EU’s CSRD, and ISSB S2 now fill the gap. The timeline table below shows exactly where things stand.

    SEC Climate Disclosure Rule: Full Timeline

    Date Event What It Means
    March 2024 SEC finalizes climate disclosure rule Required Scope 1, 2, 3 reporting for public companies
    April 2024 SEC voluntarily stays the rule Implementation paused pending legal challenges
    March 2025 SEC stops defending the rule Rule effectively abandoned under new administration
    April 2025 8th Circuit suspends litigation Legal process frozen
    2026 SEC proposes full rescission Rule being formally withdrawn
    2026 onwards State laws fill the gap California SB 253, SB 261 now primary US obligations
    2027 ISSB S2 widely adopted globally 40+ jurisdictions implementing climate disclosures

    What Public Companies Must Do Now

    Even though the federal SEC rule is being withdrawn, climate disclosure obligations remain. Companies operating in California, the EU, or with international investors face binding requirements under:

    • California SB 253 — requires large companies doing business in California to disclose Scope 1, 2, and 3 emissions
    • California SB 261 — requires climate-related financial risk disclosure
    • EU CSRD — applies to large EU companies and non-EU companies with significant EU revenue
    • ISSB S2 — adopted in 40+ jurisdictions and becoming the global baseline

    For a full compliance framework, see our California Climate Accountability Laws guide and the ESG Regulatory Frameworks Complete Guide.

    Frequently Asked Questions

    Is the SEC climate disclosure rule still in effect in 2026?

    No. The SEC stopped defending the rule in March 2025 and has proposed full rescission. The rule is effectively dead at the federal level, though state and international obligations remain.

    What replaced the SEC climate disclosure rule?

    California’s SB 253 and SB 261 are now the primary US climate disclosure obligations. Internationally, ISSB S2 has been adopted in 40+ jurisdictions and is becoming the global standard.

    Do companies still need to disclose climate risk in 2026?

    Yes — companies operating in California, the EU, or with international investors face binding climate disclosure requirements regardless of the SEC rule being withdrawn.

    When did the SEC abandon its climate disclosure rule?

    The SEC voluntarily stayed the rule in April 2024, stopped defending it in March 2025, and proposed full rescission in 2026.

  • Supply Chain Human Rights Due Diligence: EU CSDDD, Forced Labor Prevention, and Audit Frameworks

    Home /
    Social Responsibility /
    Supply Chain Due Diligence

    Supply Chain Human Rights Due Diligence: EU CSDDD, Forced Labor Prevention, and Audit Frameworks

    Updated October 6, 2026.

    If CSDDD or forced-labor due diligence is in scope for your supply chain, this guide covers audit evidence, risk prioritization, and remediation documentation.

    By BC ESG | Published March 18, 2026 | Updated March 18, 2026

    Supply chain human rights due diligence is a systematic process to identify, assess, and mitigate actual and potential adverse human rights impacts across an organization’s value chain. The EU Corporate Sustainability Due Diligence Directive (CSDDD), effective 2027, mandates large companies to conduct ongoing due diligence addressing human rights (forced labor, child labor, wage/hour violations, freedom of association), environmental harm (pollution, resource depletion, biodiversity loss), and anti-corruption across direct operations and value chains. Effective due diligence combines risk mapping, supplier engagement, audit and monitoring, remediation processes, and transparent reporting—transforming supply chain responsibility from compliance checkbox to competitive advantage and value creation lever.

    EU Corporate Sustainability Due Diligence Directive (CSDDD): 2027 Effective Date

    Directive Scope and Applicability

    The CSDDD, adopted in 2023 and effective 2027, applies to:

    • Phase 1 (2027): EU companies with ≥5,000 employees or €1.5B annual turnover
    • Phase 2 (2028): EU companies with ≥3,000 employees or €900M annual turnover; non-EU companies with EU-sourced revenues ≥€900M
    • Phase 3 (2029): Potentially expanded to SMEs with supply chain exposure

    Non-EU organizations with material EU supply chain exposure or customers in EU markets should begin CSDDD alignment immediately to mitigate regulatory and supply chain disruption risk.

    Core Due Diligence Requirements

    The CSDDD mandates a six-step due diligence cycle:

    1. Risk Mapping and Materiality Assessment

    Organizations must identify actual and potential adverse impacts across their value chain:

    • Human rights: Forced labor (debt bondage, document confiscation, movement restrictions), child labor, wage theft, unsafe working conditions, denial of freedom of association, discrimination
    • Environmental: GHG emissions, water pollution, deforestation, habitat destruction, pollution from hazardous substances
    • Governance/Anti-corruption: Bribery, fraud, sanctions evasion, corruption in supply chain engagement

    Materiality assessment should identify geographic risk zones (countries with weak labor standards, environmental enforcement), sector-specific risks (garment, agriculture, mining, electronics exhibit high labor risk), and supply chain concentration (single-sourcing amplifies risk).

    2. Stakeholder Engagement and Impact Identification

    Organizations should engage:

    • Internal: Procurement, operations, compliance, ESG teams to map supply chain structure and identify risk concentration
    • Suppliers: Direct engagement on working conditions, environmental practices, compliance requirements
    • External stakeholders: NGOs, labor unions, industry coalitions, local communities to validate risk assessment and identify gaps in organizational awareness

    3. Risk Assessment and Prioritization

    Organizations rank risks by:

    • Severity: Magnitude of potential harm (forced labor or child labor are highest severity; wage disputes lower)
    • Likelihood: Probability risk occurs given industry, geography, supplier characteristics
    • Reach: Number of workers or extent of environmental impact affected

    Priority should focus on high-severity/high-likelihood risks: garment factories in Southeast Asia (forced labor, wage theft), agricultural supply chains in emerging markets (child labor, unsafe pesticide use), mining operations (environmental damage, community displacement).

    4. Due Diligence Actions: Contractual, Audit, Remediation

    Contractual Requirements

    Supplier contracts should mandate:

    • Compliance with ILO conventions (forced labor, child labor, freedom of association)
    • Compliance with applicable environmental regulations and ESG standards (water quality, hazardous substance management, GHG reporting where applicable)
    • Right of access for audits, inspections, and worker interviews
    • Obligation to remediate identified violations within agreed timelines
    • Prohibition on retaliation against workers reporting concerns

    Audit and Monitoring Frameworks

    Organizations implement tiered audit approaches:

    • Self-assessment questionnaires (SAQs): Low-cost initial screening; suppliers self-report compliance status. Limited reliability; used for baseline categorization.
    • Desktop audit: Remote review of supplier documentation, certifications, track record. Identifies documentation gaps.
    • On-site compliance audits: Third-party auditors conduct announced or unannounced facility inspections, worker interviews, document reviews. Standard practice for high-risk suppliers; typically conducted annually or biennially.
    • Specialized assessments: Deep dives on specific risks: forced labor risk assessment (ILO indicators), environmental audit, community impact assessment

    Remediation and Corrective Action Plans (CAPs)

    When audits identify violations, organizations establish CAPs specifying:

    • Root cause analysis
    • Specific corrective actions with timelines
    • Resource allocation (sometimes financial support from buyer to enable remediation)
    • Verification mechanisms (follow-up audits, worker feedback mechanisms)
    • Escalation triggers for failure to remediate (supplier delisting, termination, regulatory notification)

    Critical remediation cases (forced labor, child labor, severe wage theft) should trigger immediate action: law enforcement notification, victim support programs, supply chain re-routing.

    5. Grievance and Remediation Mechanisms

    Organizations should establish channels enabling workers, communities, and suppliers to report concerns confidentially:

    • Worker hotlines: Phone, SMS, WhatsApp accessible in local languages, managed by third-party to ensure confidentiality
    • Grievance forms: On-site or digital grievance submission (e.g., QR code at facility entry)
    • External partnerships: Engagement with NGOs, industry coalitions to receive and investigate complaints
    • Remedy procedures: Clear process for investigation, remedy determination, appeal, and escalation

    Organizations must commit to non-retaliation and victim confidentiality. Remedies typically include wage restitution, worker retraining, facility remediation funding, or supply chain restructuring for systematic abuse.

    6. Reporting and Transparency

    Organizations should disclose:

    • Supply chain structure and geographic concentration (top suppliers/sourcing countries)
    • Due diligence methodology, materiality assessment, and risk prioritization approach
    • Findings from risk mapping and audits: number of facilities audited, prevalence of identified violations (anonymized for worker/supplier confidentiality)
    • Remediation and grievance resolution: cases identified, resolved, pending; remedies provided
    • Governance: board/management accountability, policy commitments, third-party certifications

    Forced Labor Prevention: Assessment and Indicators

    ILO Forced Labor Indicators

    The International Labour Organization defines forced labor assessment criteria:

    • Threat of penalty: Threats to punish workers, coercive worker scheduling, sexual or psychological abuse
    • Debt bondage: Workers indebted to employers for recruitment, housing, uniforms, food; debt escalates faster than wages can repay
    • Restriction of movement: Confiscation of identity documents, locked facilities, surveillance preventing worker departure
    • Isolation: Workers in remote locations, linguistic/cultural isolation, low literacy preventing understanding of rights
    • Excessive working hours: Mandatory overtime without additional pay, no rest days, unrealistic production quotas
    • Wage deprivation: Non-payment of wages, excessive fines/deductions, underpayment relative to agreed terms

    Supplier Self-Assessment and Audit Checklists

    Organizations should require suppliers to complete ILO-aligned assessments:

    • Evidence of written employment contracts provided to workers before employment
    • Verification that workers retain control of identity documents (passports, visas)
    • Documentation of wage payments (pay stubs, bank transfers) meeting or exceeding legal minimum wage
    • Evidence of reasonable working hours (max 48 hours/week per ILO, or compliance with national standards)
    • Documentation of freedom of association (union memberships, grievance channels, worker councils)
    • Proof of freedom of movement (no locked facilities, exit controls, or surveillance preventing departure)

    High-Risk Indicators Requiring Escalation

    Organizations should immediately escalate cases exhibiting:

    • Obvious evidence of document confiscation or worker confinement
    • Extreme wage theft (unpaid wages, excessive deductions exceeding 50% of earnings)
    • Child labor (workers under 18 in hazardous work, or under 15 in other work)
    • Systematic denial of freedom of association (suppression of union organizing, retaliation against worker representatives)

    Audit Frameworks and Third-Party Certification

    Key Audit Standards and Protocols

    SA8000 (Social Accountability International)

    SA8000 is an auditable standard covering labor rights, occupational health and safety, environmental management, and management systems. Certification is valid for 3 years with annual surveillance audits. Organizations relying on SA8000 certification should verify certification currency and audit scope.

    BSCI Code and Audit Protocol

    Business Social Compliance Initiative (BSCI) Code covers human rights, labor standards, environmental practices, and anti-corruption. BSCI conducts announced audits (annually) and re-audits for flagged violations. BSCI audits are documented in publicly accessible database, enabling supply chain transparency.

    RBA (Responsible Business Alliance) Code

    RBA Code focuses on electronics and supply chain assembly. It includes labor rights, occupational health, environmental management, ethics, and management systems. RBA maintains audit database of member facility assessments.

    Fair Trade and Industry-Specific Certifications

    Certifications like Fair Trade, UTZ Certified, Rainforest Alliance, RSPO (palm oil) cover labor, environmental, and social standards in specific commodities. Organizations sourcing certified commodities should verify certification authenticity and audit recency.

    Supplier Engagement and Capacity Building

    Tiered Supplier Programs

    Organizations should differentiate supplier engagement by risk level:

    • Tier 1 (low-risk): Minimal audit frequency (biennial or triennial); lighter due diligence burden
    • Tier 2 (medium-risk): Annual audits; quarterly management reviews; corrective action plan requirements
    • Tier 3 (high-risk): Semi-annual or quarterly audits; enhanced grievance monitoring; intensive management engagement; remediation funding

    Capacity Building and Technical Assistance

    Rather than pure punishment/supplier replacement, progressive organizations invest in supplier improvement:

    • Training: Worker rights education, management labor practices, grievance handling, health and safety protocols
    • Systems assistance: Help suppliers implement management systems (documentation, record-keeping, worker communication channels)
    • Financial support: Low-interest loans or direct funding for facility remediation, wage gap closure, or safety equipment
    • Partnership models: Long-term purchasing commitments and price stability enabling supplier investment in labor/environmental compliance

    Capacity-building approach is more sustainable than supplier replacement, particularly for developing-market suppliers who face structural capacity constraints.

    Frequently Asked Questions

    When should non-EU organizations begin CSDDD compliance preparation?
    Non-EU organizations with EU supply chain exposure or >€900M EU-sourced revenue face Phase 2 (2028) applicability. Organizations should begin alignment immediately: Phase 1 (2027) applies only to EU companies but sets governance/audit precedent affecting investor expectations globally. Early movers avoid disruption and build supply chain resilience ahead of mandatory compliance deadlines.

    How should organizations balance audit frequency with supplier relationships and costs?
    Use risk-based tiering: low-risk suppliers (certified, established track record) audit less frequently (biennial); high-risk suppliers (new, high-labor-intensive, weak institutional environment) audit more frequently (semi-annual). Blend announced (transparent, relationship-building) and unannounced audits (detection of covert violations). Use technology: self-assessment questionnaires, remote audits, worker feedback platforms reduce per-facility costs while maintaining coverage.

    What is the appropriate response when audits identify forced labor indicators?
    Forced labor discovery is a critical escalation: (1) immediately document evidence and notify facility management/ownership; (2) notify law enforcement and labor authorities (required under CSDDD and most national laws); (3) cease orders/purchasing from facility; (4) establish support program for affected workers (repatriation assistance, wage restitution, legal support); (5) investigate buyer-side contribution (excessive price pressure, short lead times forcing excessive overtime); (6) consider supplier termination unless facility commits to comprehensive remediation with third-party verification. Supply chain continuity must never override victim protection.

    How can organizations ensure audit credibility and prevent audit manipulation?
    Use reputable third-party auditors with industry-specific experience and track records. Conduct worker interviews in private (away from management), in workers’ languages. Use mix of announced and unannounced audits. Cross-check audit findings with worker grievance data, external NGO reports, and labor authority investigations. Audit all key facilities regularly; don’t rely exclusively on third-party certifications. Train internal teams to spot audit red flags: cherry-picked worker interviews, missing documentation, unrealistic records.

    What should organizations disclose about supply chain due diligence findings in ESG reporting?
    Organizations should transparently disclose: due diligence methodology, number of facilities in supply chain, audit coverage and frequency, findings summary (violations identified by category: forced labor, child labor, wage theft, unsafe conditions), remediation outcomes, grievance statistics. Maintain worker and supplier confidentiality while demonstrating comprehensive coverage and commitment to remediation. Disclosure builds investor confidence and distinguishes genuine compliance from greenwashing.

    Connecting Related ESG Topics

    Supply chain due diligence integrates with broader ESG and risk management. Explore related resources:

    Published by: BC ESG (bcesg.org) | Date: March 18, 2026

    Standards Referenced: EU CSDDD (effective 2027), ILO Forced Labor Indicators, SA8000, BSCI Code, RBA Code, GRI 401/403/405 (Labor Standards), UN Guiding Principles on Business and Human Rights, ISSB IFRS S1 (Social Capital)

    Reviewed and updated: March 18, 2026 for 2027 CSDDD implementation and integrated human rights due diligence requirements

  • Local Law 97 Deadline June 30, 2026: File Your Report or Buy the $60 Extension

    Local Law 97 Deadline June 30, 2026: File Your Report or Buy the $60 Extension

    Updated October 6, 2026.

    As of October 6, 2026, the June 30, 2026 and August 29, 2026 filing deadlines for calendar year 2025 Local Law 97 reports have passed; confirm your building’s status in DOB systems rather than assuming an outcome here.

    By Will Tygart, author of the Commercial Restoration Carbon Protocol (CRCP) and a filed public commenter in CARB’s SB 253 Scope 3 rulemaking. Every regulatory claim links to its primary source.

    This guide is written for the person who actually coordinates the filing: the property manager. It covers what was due for filing year 2026, what missing those deadlines costs (in real dollars per month), how the three-portal filing process works, and what to do if your building is over its cap.

    LL97 filing year 2026 deadlines (reference)

    October 2026 status: The June 30, 2026 statutory deadline and the August 29, 2026 extended deadline (for buildings that secured a $60 extension by June 30) are both in the past. Use DOB BEAM and DOB NOW records to verify whether your building filed; this article does not state filing outcomes for any property.

    Date What happens Source
    May 1, 2026 LL97 report on calendar-year-2025 emissions was due (Admin Code §28-320.6.2) DOB service notice, Feb 27, 2026
    June 30, 2026 Hard end of the 60-day grace period — AND the last day to apply for an extension Same notice; 1 RCNY 103-14(g)(2)
    August 29, 2026 Extended filing deadline, only for buildings that applied by June 30 ($60 fee) Same notice

    The extension is applied for as a ticket inside the BEAM portal; the $60 fee is paid separately in DOB NOW: Safety. No professional attestation is required to request it. Sixty dollars is the cheapest insurance in NYC real estate this month.

    What missing the deadline actually costs

    Local Law 97 has two separate penalties, and the one for not filing is usually worse than the one for emitting too much.

    • Failure to file: gross floor area × $0.50 per month, assessed for each month the report is not submitted within the 12 months following May 1 — and if you file after the grace period, penalties accrue retroactively to May 1 (DOB violations page).
    • Exceeding the cap: (actual emissions − emissions limit) × $268 per metric ton of CO2e, assessed annually.
    • False filing: a misdemeanor, with fines up to $500,000.

    Worked example: a 60,000 sq ft Midtown office building

    The 2024–2029 emissions cap for office space is 0.00758 tCO2e per square foot (1 RCNY 103-14). So the building’s annual limit is 60,000 × 0.00758 = 454.8 tCO2e.

    • If the building actually emitted 550 tCO2e in 2025, the overage penalty is (550 − 454.8) × $268 = $25,514 for the year.
    • If the same building simply fails to file, the penalty is 60,000 × $0.50 = $30,000 per month.

    Read that again: one month of not filing costs more than a full year of being 21% over the cap. Whatever your building’s emissions situation is, filing is always the cheaper move — and for the roughly 91% of buildings currently under their 2024–2029 caps, the report costs only the filing fee ($210 for a simple report) and the engineer’s time.

    Enforcement is no longer theoretical

    On April 22, 2026, DOB published its first-year results (press release): approximately 93% of covered privately-owned properties filed their CY2024 reports, the DOB Sustainability Bureau is now auditing filings from roughly 28,000 buildings, and about 1,400 properties that never filed are receiving Notices of Deficiency with a 60-day cure window before DOB attorneys take the cases to OATH.

    Filing rates by borough: Manhattan 95%, Brooklyn 93%, Bronx 92%, Queens 91%, Staten Island 83%. By building type, offices and hotels led at 95%; houses of worship (81%) and garages (80%) trailed. If your portfolio includes the laggard categories, your buildings are statistically the ones DOB’s enforcement queue is built from.

    How the filing actually works (the three-portal reality)

    The single most common operational complaint about LL97 is that compliance lives in three systems that sync overnight. As DOB’s own assistant commissioner for sustainability put it: “You cannot complete a report in one day and you need to plan for that.” (Habitat, March 2025)

    1. DOB NOW: Safety — pay the filing fee first ($210 simple report / $615 complex / $60 extension / $950 good-faith-efforts report, per 1 RCNY 101-03). BEAM does not unlock until the payment clears, which happens overnight.
    2. ENERGY STAR Portfolio Manager (ESPM) — your building’s energy data flows from here. Note: “Other” and “Mixed Use” property types are prohibited for LL97 reporting; the building must be typed correctly.
    3. BEAM (nyc.beam-portal.org) — where the report itself is filed, and where extensions, Covered Buildings List disputes, and penalty-mitigation requests are submitted as numbered tickets.

    Two coordination traps: the email addresses for the owner, property manager, and energy provider must be consistent across all three systems, and only a Registered Design Professional (a licensed PE or RA) can certify and submit the Article 320 report. The property manager does not file — the property manager coordinates: portal access, BBL/BIN numbers, fee payment, utility data, and the RDP’s calendar. If you have not booked your RDP yet, that is today’s call, not June 29’s.

    Over your cap? File anyway — then mitigate

    Filing and penalty exposure are separate questions. If your building exceeded its 2025 cap:

    • Good-faith efforts mitigation (1 RCNY 103-14(i)(2)) can reduce penalties — but it legally requires the annual report to be filed, LL84 benchmarking to be current, and an LL88 lighting/sub-metering attestation, plus one qualifying path (a decarbonization plan, an approved DOB application for compliance work, electric-readiness upgrades, a prior under-cap year, critical-facility status, or a pending adjustment).
    • RECs can offset emissions attributable to electricity only, must be NYC-deliverable, and are currently uncapped for the 2024–2029 period — except that buildings using the decarbonization-plan path are barred from them (DOB REC policy).
    • Offsets are capped at 10% of your emissions limit and the only eligible program is the city’s Affordable Housing Reinvestment Fund, priced at $268/ton — deliberately equal to the penalty rate.
    • Disaster damage is a named mitigating factor: under 1 RCNY 103-14(i)(1), an owner who documents that a hurricane, severe flooding, or fire precluded compliance in a calendar year — with photographs and a narrative — “may result in a penalty of zero dollars” for that year. If your building had a major loss event in 2025, your restoration contractor’s job file is now LL97 evidence. Ask for it.

    What this deadline means for each seat at the table

    If you are the… June 30 means…
    Owner You bear the penalty: $0.50/sqft/month for silence, $268/ton for overage. The $60 extension protects you for $60. Authorize it today.
    Facility / property manager You own the pipeline: three portals, matching emails, the RDP booking, the utility data, and the ticket trail. The overnight-sync delays mean teams should have completed BEAM filings before the June 30, 2026 deadline (now passed).
    Tenant Your energy use counts against the building’s whole-building number, and the A–F energy grade posted at your entrance every October comes from the same data. Expect your landlord to get more interested in your submeter.

    The rest of the 2026 compliance calendar

    Deadline Obligation
    June 30, 2026 LL97 CY2025 report grace ends; last day for $60 extension application
    Aug 29, 2026 Extended LL97 filing deadline (extension-approved buildings only)
    Oct 1–31, 2026 LL33/LL95 energy grade labels (A–F) must be posted near every public entrance
    Dec 31, 2026 LL87 Energy Efficiency Reports due for buildings in the 2026 cycle
    May 1, 2028 Good-faith decarbonization-plan filers must show a DOB-approved application for their 2030-cap work
    Jan 1, 2030 The cliff: caps tighten sharply — roughly 57% of covered properties currently emit more than their 2030 limit (Urban Green Council)

    That last row is the real story of 2026. Only about 9% of properties exceed today’s caps; about 57% exceed the 2030 caps. The buildings that use this filing cycle to understand their numbers — including the carbon that enters and leaves through their vendors and capital projects — are the ones that will plan their way under the 2030 line instead of writing checks over it.

    Frequently asked questions

    When is the Local Law 97 report due in 2026?

    The report on calendar-year-2025 emissions was due May 1, 2026, with a statutory grace period through June 30, 2026. Buildings that apply by June 30 for a $60 extension have until August 29, 2026.

    What happens if my building misses the June 30, 2026 deadline?

    Without an approved extension, the failure-to-file penalty is gross floor area × $0.50 per month, assessed retroactively to May 1 — $30,000 per month on a 60,000 sq ft building. Filing late stops the clock; it does not refund it.

    How much does an LL97 extension cost and how do I get one?

    $60. Apply as a ticket in the BEAM portal by June 30, 2026 and pay the fee in DOB NOW: Safety; the deadline moves to August 29, 2026. No professional attestation is required to apply.

    Who can actually file the LL97 report?

    Only a Registered Design Professional — a New York licensed Professional Engineer or Registered Architect — can certify and submit an Article 320 emissions report. The property manager coordinates the data, portals, and payment, but cannot self-file.

    Will DOB extend the deadline again like it did in 2025?

    No. DOB’s February 27, 2026 service notice states that “deadline extensions issued by service notice in 2025 do not apply to filing year 2026.” Do not assume another blanket extension; verify status in DOB systems.

    How are Local Law 97 fines calculated?

    Overage: (actual emissions − your building’s limit) × $268 per metric ton CO2e, per year. Non-filing: floor area × $0.50 per month. A false filing is a misdemeanor with fines up to $500,000.

    Does my restoration contractor’s carbon count toward LL97?

    No. LL97 counts only emissions from operating the building — on-site fuel combustion plus purchased electricity and steam. Contractor operations, hauling, disposal, and materials are outside the cap. But that vendor carbon is exactly what GRESB, California SB 253, and corporate tenant reporting increasingly demand — see the Commercial Restoration Carbon Protocol (CRCP) for how property managers are starting to collect it.

    Primary sources

    More in Local Law 97 and About BC ESG.

    Related reading: how to file LL97, board resolution checklist, and Article 320 vs 321. Sister hubs: Restoration Intel, Healthcare Facility Hub, Continuity Hub, Risk Coverage Hub, and Tygart Media.

  • AI Governance as an ESG Imperative in 2026: What Organizations Must Disclose About Algorithmic Risk

    AI Governance as an ESG Imperative in 2026: What Organizations Must Disclose About Algorithmic Risk

    Updated October 6, 2026.

    If investors or regulators ask how you manage algorithmic risk in ESG data and decisions, this 2026 guide covers governance, documentation, and disclosure patterns.

    AI systems have graduated from “nice to have” technology to material ESG risk. The landscape shifted decisively in 2026, and organizations that haven’t built AI governance frameworks are now facing disclosure obligations they didn’t anticipate.

    The convergence of three regulatory forces—the EU AI Act’s high-risk tier implementation, the CSRD (Corporate Sustainability Reporting Directive) inclusion of AI as an ESG material risk, and a wave of US state-level AI transparency laws—has created a new reality: AI governance is now a boardroom issue, not just an IT issue.

    The Regulatory Landscape Shift in 2026

    The EU AI Act entered full implementation for high-risk systems in 2026. High-risk designation now covers AI used in critical infrastructure, employment decisions, credit decisions, and any system that can create legal or similarly significant effects. Organizations deploying these systems must maintain technical documentation, implement human oversight mechanisms, and maintain detailed audit logs—or face fines up to 6% of global revenue.

    The California AI Transparency Act took effect January 1, 2026, requiring disclosure of AI-generated content and detailed training data provenance. This isn’t optional disclosure to regulators; it’s disclosure to users and consumers. A California-based company deploying AI in customer-facing roles must now disclose that fact and describe where the training data came from.

    Texas passed the Responsible AI Governance Act and Colorado enacted the AI Act, both focused on algorithmic discrimination prevention. These states are now requiring algorithmic impact assessments for any AI system used in hiring, lending, housing, or insurance decisions. Texas explicitly requires evidence that algorithms don’t discriminate by protected class; Colorado mandates algorithmic transparency and opt-out mechanisms.

    CSRD, now in full effect for many EU organizations, has formalized AI governance as a material ESG risk category alongside climate, labor, and supply chain. If your organization uses AI to make consequential decisions or creates algorithmic bias risk, CSRD requires disclosure in your sustainability report—just as you’d disclose Scope 2 emissions.

    The Disclosure Obligation Framework

    Here’s what ESG teams and compliance officers need to understand: AI governance disclosure falls into three overlapping buckets.

    Algorithmic Accountability Disclosure: What AI systems does your organization deploy? What decisions do they influence? What safeguards are in place to prevent discrimination or harm? This is the California AI Transparency Act requirement. It’s also what CSRD reviewers will ask about. The disclosure should include: system purpose, training data sources, human oversight mechanisms, and documented testing for bias and accuracy.

    Explainability and Human Oversight: Can you explain how the algorithm makes decisions? Who reviews those decisions? This is the core of EU AI Act compliance for high-risk systems. The requirement isn’t perfect explainability—it’s documented human oversight and a mechanism to challenge algorithmic decisions. Insurance underwriting AI? That means having a human underwriter review or spot-check claims. Employment AI? That means someone can explain to a candidate why they weren’t hired.

    Governance Process Disclosure: How does your organization govern AI systems? Who approves new deployments? How do you monitor for drift, bias, or performance degradation? CSRD reviewers want evidence of governance structure: a chief AI officer or designated AI governance committee, documented policies, regular audit procedures, and clear escalation paths when issues arise.

    The Cross-Sector Implementation Challenge

    AI governance requirements look different depending on your industry, but the core disclosure obligation is universal. Here’s how this plays out in four critical sectors:

    Property Restoration & Insurance Claims: Organizations using AI-powered damage assessment tools (drone imagery analysis, computer vision systems) must disclose the accuracy rates of those systems, the human review process when AI assessments seem incorrect, and the liability framework when AI assessments are wrong. Read the restoration sector analysis here. The restoration industry adopted AI assessment tools faster than governance frameworks kept pace—2026 is the year that gap gets exposed.

    Insurance Underwriting & Risk: State insurance commissioners are conducting detailed examinations of algorithmic underwriting and pricing models. Carriers must now disclose which variables their algorithms use, prove those variables don’t correlate with protected classes, and maintain an appeal process when an applicant challenges an algorithmic decision. The insurance sector governance framework is detailed here. Carriers using AI in claims handling face parallel requirements: transparency about which claims are routed to automated decision-making, what percentage of claims are adjudicated purely by algorithm, and human appeal mechanisms.

    Business Continuity & Operational Resilience: The newer risk—and the one most organizations haven’t addressed—is AI dependency as a single point of failure. When GenAI tools, workflow automation, or AI-powered decision support systems go down, how long before operations halt? Business continuity governance for AI is explored in detail here. BC teams need to map AI systems into their Business Impact Analysis and develop resilience strategies for when vendor tools or internal AI systems fail.

    Healthcare Facility Operations: The FDA’s Quality Management System Regulation, effective in 2026, now treats AI and machine learning medical devices under expanded oversight. CMS is flagging AI systems in clinical decision-making. Healthcare facility governance requirements are outlined here. The complexity: clinical AI (diagnostic support, treatment planning) and operational AI (predictive maintenance, scheduling) follow different regulatory tracks, but both need governance.

    Building the Governance Framework

    Organizations that move fast in 2026 will establish an AI governance framework with these components:

    AI System Inventory: Document every AI system in use: internal tools, SaaS platforms, embedded vendor algorithms. For each, record: purpose, decision authority (does it decide or recommend?), training data source, accuracy metrics, human review process, and last audit date.

    Risk Assessment Protocol: Assess each system’s ESG risk: Does it affect protected classes? Does it influence consequential decisions? Could failure cause operational harm? High-risk systems get more rigorous oversight.

    Governance Accountability: Assign clear accountability: Who approves new AI deployments? Who monitors for bias and drift? Who handles escalations when AI systems fail or produce unexpected outcomes? This should ladder up to the board or an audit committee.

    Documented Human Oversight: For high-risk systems, document the human oversight mechanism. This doesn’t mean humans should override every algorithmic decision; it means someone can explain the decision and has the authority to escalate or appeal it.

    Regular Audit and Testing: Establish a cadence for testing AI systems—at minimum annually—for accuracy, bias, drift, and compliance with documented performance standards. Document the results.

    Disclosure Readiness: Prepare your ESG disclosure now. Be ready to answer: What AI systems do you use? How do you govern them? What safeguards are in place? What testing have you done? CSRD reviewers, state regulators, and proxy advisory firms are going to ask these questions. Organizations with documented frameworks will move through audits far more quickly.

    The Convergence Risk

    The real challenge isn’t any single regulation. It’s the convergence: CSRD disclosure requirements + EU AI Act penalties + California transparency obligations + state-level algorithmic discrimination rules = a comprehensive governance obligation that most organizations haven’t integrated.

    The organizations building advantage in 2026 are the ones treating AI governance not as a compliance checkbox but as a core ESG and operational risk framework. They’re integrating it into capital allocation, vendor evaluation, and board reporting. They’re making algorithmic accountability a competitive advantage, not a liability.

    Your ESG team, compliance team, IT team, and board need to align on AI governance right now. The regulatory window for moving fast and building legitimate frameworks is open in Q2 and Q3 2026. By Q4, regulators will have sharper guidance on enforcement, and the organizations without documented frameworks will be scrambling.

    Related Reading:

  • KPI Design for ESG Performance: Leading Indicators, Lagging Metrics, and Target-Setting Frameworks

    Home >
    ESG Metrics >
    KPI Design for ESG Performance

    KPI Design for ESG Performance: Leading Indicators, Lagging Metrics, and Target-Setting Frameworks

    Updated October 6, 2026.

    If you are designing ESG KPIs for board or CSRD reporting, this guide distinguishes leading vs lagging indicators and target-setting practices.

    ESG KPI Definition: Environmental, social, and governance key performance indicators (KPIs) are quantifiable metrics that measure ESG performance, inform decision-making, and demonstrate progress toward strategic objectives. Effective KPI systems balance leading indicators (predictive, activity-based) with lagging indicators (outcome-based, retrospective) aligned with GRI Standards, ISSB frameworks, and business strategy.

    Introduction to ESG KPI Design

    KPIs form the quantitative backbone of ESG performance management. Well-designed KPIs enable organizations to:

    • Translate ESG strategy into measurable objectives
    • Track progress toward targets and identify performance gaps
    • Enable accountability through performance management systems
    • Support investor communication and ESG rating provider submissions
    • Drive organizational alignment around shared ESG priorities
    • Identify emerging risks and opportunities through early warning signals

    Effective KPI systems integrate three critical elements: leading indicators that predict future outcomes, lagging indicators that measure actual results, and aligned targets that establish clear performance expectations. This comprehensive approach enables both proactive management and transparent accountability.

    Leading Indicators vs. Lagging Indicators

    Understanding Leading Indicators

    Leading indicators are activity-based metrics that predict future outcomes. They measure inputs, activities, or intermediate outcomes that influence ultimate results. Leading indicators enable organizations to:

    • Predict future performance: Leading indicators signal future results, enabling proactive adjustments
    • Enable early intervention: Organizations can address issues before they manifest as performance failures
    • Support continuous improvement: Early feedback enables rapid iteration and optimization
    • Demonstrate management effectiveness: Leading indicators reflect management actions and priorities

    Understanding Lagging Indicators

    Lagging indicators measure actual outcomes and ultimate results. They reflect the combined impact of all activities and are less controllable in the short term. Lagging indicators provide:

    • Accountability for results: Clear measurement of actual achievements versus targets
    • Outcome validation: Confirmation that activities produce intended results
    • Comparability: Standard metrics enabling peer comparison and investor assessment
    • Materiality alignment: Outcomes that directly reflect material ESG impacts

    Leading and Lagging Indicators by ESG Pillar

    Environmental KPIs

    Issue Area Leading Indicators Lagging Indicators
    Climate & Emissions Energy audits completed, renewable energy investments, efficiency projects launched, green team participation Absolute Scope 1/2/3 emissions, emissions intensity (per revenue, per unit), carbon reduction rate
    Water Management Water audits conducted, recycling system installations, supplier commitments Total water consumption, water intensity, wastewater quality metrics
    Waste & Circular Economy Waste reduction initiatives launched, recycling program coverage, supplier assessments Waste diverted from landfill %, hazardous waste generation, material recycled
    Biodiversity Habitat restoration projects initiated, biodiversity assessments, community partnerships Land area restored, species populations monitored, ecosystem health index

    Social KPIs

    Issue Area Leading Indicators Lagging Indicators
    Labor Practices & Wages Wage audits completed, collective bargaining agreements, training programs delivered Living wage %, collective bargaining coverage, voluntary turnover rate
    Health & Safety Safety training completion, hazard audits, near-miss reporting, safety committee engagement Total recordable incident rate (TRIR), lost-time incident rate (LTIR), severity rate
    Diversity & Inclusion D&I program participation, recruitment pipeline initiatives, leadership development participation Women in workforce %, women in management %, ethnic diversity %, pay equity gap
    Community Impact Community programs initiated, volunteer hours, community needs assessments Community satisfaction score, social impact metrics, community employment

    Governance KPIs

    Issue Area Leading Indicators Lagging Indicators
    Board Composition Board recruitment initiatives, governance training, succession planning progress Board independence %, gender diversity %, average tenure, committee rotation
    Ethics & Compliance Ethics training completion %, compliance assessments, audit findings resolved Regulatory violations, substantiated ethics complaints, sanctions/fines
    Executive Compensation ESG metrics in comp plan development, peer benchmarking, board discussions CEO pay ratio, pay equity analysis, pay for performance correlation
    Risk Management Risk assessment completion, control implementations, ERM framework maturity Risk incidents materialized, internal audit findings, external audit observations

    KPI Selection and Design Framework

    Step 1: Align KPIs with Materiality and Strategy

    Effective KPIs emerge from double materiality assessments identifying issues critical to the business and stakeholders. KPIs should:

    • Address issues in the high-high quadrant of materiality matrices (high financial and impact materiality)
    • Support strategic ESG objectives and business imperatives
    • Align with long-term business strategy and value creation
    • Reflect stakeholder priorities and expectations

    Step 2: Select Indicators Aligned with Established Frameworks

    Leading frameworks provide established metrics ensuring consistency and comparability:

    • GRI Standards: Sector-specific metrics covering environmental, social, and governance issues
    • ISSB Standards: Climate-related disclosures and sustainability metrics focused on investor relevance
    • CSRD/ESRS: Required metrics for EU-listed companies
    • Industry-specific standards: Sector frameworks (e.g., SASB for specific sectors)
    • Science-based targets: Climate targets aligned with climate science

    Step 3: Design the Leading Indicator System

    Leading indicators should be:

    • Within management control: Reflect activities and initiatives that managers can directly influence
    • Timely: Measured frequently (monthly, quarterly) to enable real-time management
    • Predictive: Demonstrably correlate with future lagging indicator outcomes
    • Actionable: Provide clear implications for management decisions
    • Balanced: Mix of activity-based (programs launched, people trained) and intermediate outcome metrics
    Example – Climate Leading Indicator System:

    A manufacturing company establishes leading indicators for carbon emissions reduction:
    • Energy audits completed (by facility, by quarter)
    • Renewable energy MW contracted or installed
    • Energy efficiency projects with positive ROI approved and funded
    • Employee green team participation rate
    • Supplier Scope 3 emissions reduction commitments received

    These leading indicators predict future emissions reductions by tracking activities that drive change.

    Step 4: Design the Lagging Indicator System

    Lagging indicators should be:

    • Material to stakeholders: Measure outcomes that matter to investors, regulators, and communities
    • Comparable: Align with industry standards and peer metrics enabling benchmarking
    • Verified: Independently auditable and subject to third-party assurance
    • Historical: Tracked consistently over multiple years enabling trend analysis
    • Boundary-clear: Transparent scope (direct operations, supply chain, value chain)
    Example – Climate Lagging Indicator System:

    The same manufacturer measures actual carbon outcomes:
    • Absolute Scope 1 emissions (mtCO2e annually)
    • Absolute Scope 2 emissions (mtCO2e annually)
    • Scope 3 emissions from purchased goods and services (mtCO2e annually)
    • Carbon intensity (mtCO2e per unit production, per $ revenue)
    • Year-over-year emissions reduction rate (%)

    These lagging indicators demonstrate whether leading indicator activities produced intended emissions reductions.

    Target-Setting Frameworks

    Science-Based Targets (SBT)

    For climate metrics, science-based targets aligned with limiting global warming to 1.5°C or 2°C provide credible, externally validated targets:

    • SBTi validation: Science-based targets initiative (SBTi) validates targets against climate science
    • Ambition levels: 1.5°C pathway (most ambitious) vs. 2°C pathway (less ambitious)
    • Scope coverage: Targets typically cover Scope 1, 2, and significant Scope 3 emissions
    • Interim milestones: Targets specify 2030 interim goal and 2050 long-term goal

    Benchmarking-Based Targets

    Targets relative to peer performance or industry averages:

    • Peer comparison: Aim to be in top quartile of industry on specific metrics
    • Best-in-class: Match or exceed leading companies in industry sector
    • Advantages: Credible, achievable, understandable to stakeholders
    • Limitations: May not be ambitious if industry lagging on ESG

    Trajectory-Based Targets

    Targets based on historical improvement rates and future trajectory:

    • Linear reduction: Equal percentage reduction each year (e.g., 5% annually)
    • Accelerating reduction: Faster reduction over time as efficiency improvements compound
    • Baseline approach: Set baseline year (typically most recent full year) and establish targets relative to baseline

    Stakeholder-Defined Targets

    Targets informed by stakeholder expectations and needs:

    • Investor expectations: Targets aligned with investor guidance and capital market expectations
    • Regulatory requirements: Targets meeting or exceeding regulatory minimums
    • Community needs: Targets addressing specific community concerns and priorities
    • NGO commitments: Targets aligning with NGO commitments and industry initiatives

    KPI Measurement and Data Governance

    Data Collection Systems

    Reliable KPI systems require robust data collection:

    • Primary data: Direct measurement from company operations (utility bills, employee records, safety systems)
    • Secondary data: Information from suppliers, partners, and external databases
    • Estimation methods: Well-documented approaches for data gaps or partial information
    • System integration: ERP, HR, sustainability, and operational systems contributing to KPI data

    Quality Assurance

    Data quality is critical for KPI credibility:

    • Accuracy: Regular audits confirming data reflects actual performance
    • Completeness: Comprehensive coverage of relevant operations and business units
    • Consistency: Uniform definitions and measurement methodologies across organization
    • Timeliness: Data available for timely decision-making and performance management
    • Traceability: Clear audit trails documenting data sources and calculations

    Assurance and Verification

    Credibility requires external verification:

    • Third-party assurance: Limited or reasonable assurance from external auditors or consultants
    • Internal audit: Audit committee oversight of ESG data and systems
    • Financial audit integration: Growing integration of ESG metrics into financial audit scope
    • Public disclosure: Transparent reporting of assurance scope and findings

    Integrating KPIs with Business Performance

    Executive Compensation Linkage

    Linking executive compensation to ESG KPIs drives organizational alignment:

    • Compensation structure: 10-25% of variable compensation typically tied to ESG KPIs
    • Balance: Equal weighting of ESG KPIs with financial metrics
    • Governance: Board committee oversight of ESG KPI selection and performance assessment
    • Transparency: Clear disclosure of KPI targets and actual achievement

    Operational Management Integration

    ESG KPIs should integrate with operational management:

    • Balanced scorecard: ESG KPIs alongside financial and operational metrics
    • Strategic alignment: KPIs linked to strategic objectives and business unit accountability
    • Real-time dashboards: Visual management systems enabling team-level tracking and accountability
    • Performance reviews: Individual performance assessment including ESG KPI contribution

    Frequently Asked Questions

    Q: How many KPIs should organizations track?

    Most organizations track 10-20 core KPIs across ESG pillars, with additional metrics for specific material issues. More KPIs increase measurement burden and dilute focus. Best practice emphasizes quality over quantity—fewer, well-designed indicators drive better management than numerous metrics.

    Q: How frequently should KPIs be reviewed?

    Leading indicators should be reviewed monthly or quarterly for real-time management. Lagging indicators are typically reviewed quarterly and annually. The full KPI system should undergo annual review to assess continued relevance, with reassessment if material issues change significantly.

    Q: Can organizations use external benchmarking for ESG KPIs?

    Yes, benchmarking provides valuable context for ESG performance. Peer comparison helps organizations understand competitive positioning and identify improvement opportunities. However, KPIs should reflect internal materiality assessment rather than external benchmarking alone. Leading ESG organizations establish ambitious targets exceeding peer averages.

    Q: How should organizations handle data limitations or estimation?

    Organizations should disclose data limitations transparently. GRI Standards permit estimation where direct measurement is unavailable, provided estimation methodologies are documented and disclosed. As measurement systems mature, estimation should progressively be replaced with direct measurement. Significant estimation should be flagged for stakeholder awareness.

    Q: How do KPIs relate to ISSB and CSRD requirements?

    ISSB standards focus on investor-relevant KPIs addressing financial materiality. CSRD requires comprehensive KPIs addressing both financial and impact materiality. Organizations should establish KPIs addressing both standards’ requirements, with CSRD requirements typically being more comprehensive including broader stakeholder considerations.

    Related Resources

    About this article: Published by BC ESG on March 18, 2026. This comprehensive guide covers ESG KPI design including leading and lagging indicators, target-setting methodologies, and measurement frameworks. Content reflects GRI Standards, ISSB requirements, science-based target approaches, and industry best practices current as of 2026.

  • Circular Economy and Waste Reduction: Zero-Waste Strategy for Business Operations

    Home /
    Environmental ESG /
    Circular Economy and Waste

    Circular Economy and Waste Reduction: Zero-Waste Strategy for Business Operations

    Updated October 6, 2026.

    If you are building a zero-waste or circular operations program, this guide ties waste KPIs, supplier engagement, and disclosure frameworks to measurable targets.

    By BC ESG | Published March 18, 2026 | Updated March 18, 2026

    The circular economy is a regenerative economic model that minimizes waste and maximizes resource efficiency by keeping products and materials in use for as long as possible through design, reuse, repair, remanufacturing, and recycling. Unlike the linear “take-make-dispose” model, circular principles embed waste reduction into product design, supply chain operations, and end-of-life management. This approach aligns with ISSB IFRS S1 (material impacts and value creation) and EU CSRD requirements for environmental progress, reducing operational costs, regulatory risk, and carbon footprint simultaneously.

    Circular Economy Fundamentals and Business Models

    The circular economy operates on three core principles, articulated by the Ellen MacArthur Foundation:

    1. Design Out Waste and Pollution

    Products and services should be designed to eliminate waste and pollution from inception. This requires:

    • Lifecycle assessment (LCA): ISO 14040/14044 methodology to evaluate environmental impacts from raw material extraction through end-of-life, identifying hotspots for intervention
    • Design for disassembly: Products engineered for easy separation of materials, enabling selective recycling or remanufacturing
    • Material innovation: Substituting virgin materials with recycled, bio-based, or renewable inputs (e.g., post-consumer recycled plastics, mycelium leather, seaweed biopolymers)
    • Chemical safety: Eliminating hazardous substances that impede recycling or harm human health during use (REACH compliance in EU, California Proposition 65 in US)

    2. Keep Products and Materials in Use (Biological and Technical Cycles)

    The circular economy recognizes two distinct material cycles:

    Biological cycle: Organic materials (food waste, cellulose, natural fibers) are designed to safely biodegrade or decompose, returning nutrients to soil. Composting infrastructure, anaerobic digestion, and soil amendment capture value from organic waste streams.

    Technical cycle: Synthetic materials and durable goods cycle through multiple uses: first use → reuse (secondhand markets) → repair (spare parts, refurbishment services) → remanufacturing (component recovery) → recycling (material recovery). Each cycle extends asset value and delays end-of-life disposal.

    3. Regenerate Natural Systems

    Beyond minimizing harm, circular systems should contribute positively to environmental restoration through regenerative agriculture, habitat restoration, and ecosystem service provisioning.

    Extended Producer Responsibility (EPR) and Regulatory Frameworks

    EPR frameworks hold manufacturers and producers accountable for the environmental impact of their products throughout the lifecycle, incentivizing circular design. Key regulatory trends (2026):

    EU Directives and Taxonomy Materiality (Updated Jan 2026)

    The EU Single-Use Plastics Directive, Packaging and Packaging Waste Directive (revised 2024), and Digital Products Act mandate EPR schemes for packaging, electronics, batteries, and textiles. The updated EU Taxonomy (effective Jan 2026) incorporates materiality thresholds: activities must align with circular principles and demonstrate waste minimization (e.g., <2% non-hazardous waste to landfill for manufacturing activities).

    ISSB IFRS S1 and Resource Efficiency Disclosure

    ISSB IFRS S1 (General Sustainability Disclosure) expects organizations to disclose material impacts on natural capital, including waste generation, material efficiency metrics (e.g., material consumption per revenue unit), and circular business model innovation. Organizations should quantify waste streams by type (hazardous, non-hazardous, recyclable, landfill, incineration) and geographic location.

    GRI Standards and Waste Accounting

    GRI 306 (Waste, 2020) requires disclosure of total waste generated (with breakdowns), waste handled by external parties, and progress toward zero-waste or waste reduction targets. Organizations should track Scope 1 waste (direct) and Scope 2 waste (outsourced waste management).

    Zero-Waste Strategy Implementation

    Waste Assessment and Baseline Establishment

    Organizations must conduct comprehensive waste audits to:

    • Quantify waste streams by source (manufacturing process waste, packaging, office/operational waste, product end-of-life)
    • Analyze waste composition (food, paper, plastic, metal, hazardous, electronic)
    • Identify disposal destinations (landfill, incineration, recycling, composting, reuse programs)
    • Calculate waste diversion rate: (diverted waste) / (total waste generated) × 100%; zero-waste target typically ≥99% diversion

    Waste Reduction Hierarchy (In Priority Order)

    1. Prevention/Reduction: Eliminate waste at source (process optimization, packaging reduction, material substitution). Reduces disposal costs and environmental impact most effectively.
    2. Reuse: Use products or materials multiple times without reprocessing (refillable containers, secondhand markets, donation programs).
    3. Recycling: Process waste into new materials or products (material recovery, mechanical recycling, chemical recycling). Requires infrastructure and market demand.
    4. Recovery: Energy recovery via incineration or waste-to-energy. Preferable to landfill but lower priority than reuse/recycling.
    5. Disposal: Landfill, incineration without energy recovery, or deep-sea disposal. Last resort for non-recoverable waste.

    Operational Waste Reduction Initiatives

    Manufacturing/processing: Lean manufacturing (reducing material loss), process water recycling, hazardous waste minimization through chemistry innovation, equipment preventive maintenance to reduce scrap rates.

    Packaging: Right-sizing packaging to product dimensions, material optimization (reducing weight while maintaining protection), transition to reusable or recyclable materials, consumer take-back programs.

    Supply chain: Supplier engagement for reduced packaging, pallet and container reuse networks, logistics optimization to minimize damage-related waste.

    Workplace: Waste separation (compost, recyclables, trash), office paper reduction via digitalization, procurement of recycled content products, employee engagement/behavior change programs.

    Circular Business Model Innovation

    Product-as-a-Service (PaaS)

    Organizations retain ownership of products and charge customers for usage (e.g., lighting-as-a-service, equipment leasing). This incentivizes manufacturers to design durable, repairable, remanufacturable products because they bear the cost of replacement.

    Resale and Secondhand Markets

    Certified refurbishment programs, authorized resellers, and reverse logistics extend product life. Example: automotive parts suppliers operate vehicle end-of-life (ELV) take-back programs, recovering 90%+ of vehicle materials through disassembly and recycling.

    Take-Back and Recycling Programs

    Manufacturers establish consumer take-back schemes (e.g., IKEA furniture recycling, Apple device trade-in programs, textile brand garment collection for upcycling). EPR mandates increasingly require manufacturers to fund or operate these systems.

    Industrial Symbiosis and Waste-to-Resource Networks

    Organizations identify opportunities to convert one company’s waste into another’s raw material (e.g., brewery spent grain → animal feed, steel mill slag → cement production). Industrial parks and circular economy clusters facilitate these partnerships.

    Measurement and Reporting of Waste Reduction Impact

    Key Performance Indicators (KPIs)

    • Waste intensity: Total waste per revenue unit (kg waste / €M revenue), normalized for year-over-year comparison
    • Waste diversion rate: Percentage diverted from landfill (recycled, composted, reused, energy recovered)
    • Hazardous waste: Absolute quantity, intensity, and trend; compliance with regulatory limits
    • Recycled content percentage: % of input materials sourced from recycled/recovered sources; demonstrates circular purchasing
    • Material recovery rate: % of product mass recoverable at end-of-life via documented take-back programs

    Environmental Impact Quantification

    Lifecycle assessment (LCA) quantifies the full environmental impact of waste reduction initiatives:

    • Carbon footprint avoided: Reducing virgin material extraction, transportation, and processing lowers Scope 1, 2, 3 emissions significantly (e.g., recycled aluminum saves ~95% energy vs. virgin aluminum)
    • Water consumption reduced: Recycling and reuse typically require less water than virgin material production
    • Landfill diversion: Measured in tonnes; also reduces methane emissions from landfill decomposition (reported as CO₂e avoided)

    GRI 306 and ISSB IFRS S1 Alignment

    Organizations should report waste data consistent with GRI 306:

    • Total waste generated (absolute, intensity)
    • Breakdown by composition and disposal method
    • Waste managed by external parties (disclosure of downstream waste impacts)
    • Progress toward zero-waste targets

    Frequently Asked Questions

    What is the difference between recycling and circular economy design?
    Recycling captures value from end-of-life waste but requires energy, infrastructure, and market demand. Circular economy design prevents waste at source through product redesign, reuse, and repair systems. Circular design addresses root causes; recycling manages symptoms. Leading organizations prioritize design-out waste and reuse over recycling in the waste hierarchy.

    How is waste accounting handled under GRI 306 and ISSB IFRS S1?
    GRI 306 requires disclosure of total waste generated (absolute and intensity), breakdown by composition and hazard classification, and disposal method (landfill, recycling, incineration, etc.). ISSB IFRS S1 expects materiality assessment and disclosure of resource efficiency impacts, including waste streams. Organizations should align both frameworks: quantify waste, segment by source, and disclose progress toward zero-waste targets as part of material impact assessment.

    What defines “zero waste” for certification purposes?
    True zero waste (<100% diversion from landfill) is rare. Industry certifications (Zero Waste Business Bureau, TRUE Certification) typically define zero waste as ≥90% waste diversion or ≥99% in some standards. The remaining non-diverted waste must be non-hazardous and unavoidable. Most organizations target 95%+ diversion as a practical zero-waste proxy.

    How does extended producer responsibility (EPR) impact circular economy strategy?
    EPR shifts financial and physical responsibility for end-of-life management from municipalities to producers, creating incentive structures favoring circular design. Manufacturers absorb costs of take-back, recycling, and remanufacturing, making durable, repairable, recyclable products economically rational. EPR compliance accelerates circular business model adoption and waste reduction investment across industries.

    What lifecycle assessment (LCA) standard should organizations use for circular economy claims?
    ISO 14040/14044 are the international standards for LCA methodology, ensuring consistent system boundary definition, impact categories, and data quality. Organizations should conduct cradle-to-grave or cradle-to-cradle LCAs to assess the true environmental benefit of circular interventions (e.g., recycling vs. virgin material production). Third-party verification of LCA claims strengthens credibility and prevents greenwashing.

    Connecting Related ESG Topics

    Circular economy strategy integrates with broader environmental and social performance. Explore related articles:

    Published by: BC ESG (bcesg.org) | Date: March 18, 2026

    Standards Referenced: Ellen MacArthur Foundation Circular Economy Principles, ISO 14040/14044 (LCA), GRI 306 (Waste), ISSB IFRS S1, EU Taxonomy (updated Jan 2026), EU Single-Use Plastics Directive, EU Packaging Waste Directive (2024)

    Reviewed and updated: March 18, 2026 for EU Taxonomy materiality thresholds (effective Jan 2026) and EPR landscape

  • AI Governance in ESG: Algorithmic Bias, Model Transparency, and Responsible AI Frameworks

    AI Governance in ESG: Algorithmic Bias, Model Transparency, and Responsible AI Frameworks

    AI Governance in ESG: Algorithmic Bias, Model Transparency, and Responsible AI Frameworks in 2026

    Updated October 6, 2026.

    If you govern AI systems that touch hiring, credit, or ESG analytics, this guide covers algorithmic bias testing, model transparency, and disclosure expectations in 2026.

    Category: Governance | Published: 2026 | Reading time: 9 minutes

    AI Governance as an ESG Pillar

    AI governance is emerging as a critical fourth pillar of corporate ESG strategy in 2026, alongside environmental, social, and governance considerations. As organizations deploy generative AI, machine learning, and algorithmic decision-making systems across operations—from hiring to credit underwriting to supply chain optimization—regulators and investors are demanding transparency, bias testing, and accountability frameworks. The EU AI Act, NIST AI Risk Management Framework, and evolving board-level oversight requirements establish AI governance as non-negotiable ESG infrastructure, distinct from traditional IT governance and deeply integrated with risk management and compliance functions.

    Artificial intelligence is no longer a peripheral technology siloed in data science teams. By 2026, AI systems make or influence critical business decisions affecting employees, customers, suppliers, and communities. An insurance company’s AI underwriting model determines whether applicants access coverage. A retailer’s algorithmic hiring system filters which candidates advance to interviews. A financial institution’s credit model allocates capital across markets. A healthcare organization’s resource allocation AI determines patient prioritization. Each of these systems carries ESG risk: algorithmic bias can exclude protected groups, model opacity can obscure decision rationales, data poisoning can be exploited for competitive advantage, and system failures can trigger catastrophic operational disruption. Modern ESG governance must address these risks systematically.

    The Regulatory Inflection: EU AI Act, NIST Framework, and Board Accountability

    The legal landscape for AI governance crystallized in 2024–2026. The European Union’s AI Act, enacted in 2024 and entering enforcement in 2025–2026 across phased timelines, establishes binding requirements for high-risk AI systems. High-risk classification includes AI used in hiring, credit decisions, critical infrastructure control, and law enforcement. Requirements include algorithmic risk assessment, bias testing, model transparency, human oversight, and data governance. Non-compliance triggers substantial fines (up to €30 million or 6% of global revenue—whichever is greater).

    The U.S. National Institute of Standards and Technology released the AI Risk Management Framework (NIST RMF) in 2024, providing voluntary guidance on identifying, measuring, managing, and governing AI risks. While not binding, the NIST RMF has become the de facto standard referenced in regulatory frameworks globally—similar to how TCFD established climate risk reporting norms that preceded mandatory rules. Financial regulators (SEC, Fed, OCC), FTC guidance on algorithmic transparency, and emerging state-level AI laws all cite or incorporate NIST RMF concepts.

    Most significantly for ESG professionals: board-level AI oversight requirements are becoming standard governance expectations. SEC guidance on board cybersecurity expertise has expanded to signal expectations for board competency in AI risks. Major institutional investors (BlackRock, Vanguard, CalPERS) are explicitly demanding AI governance transparency in proxy voting and engagement. Companies without board-level AI governance committees or C-level officers with explicit AI accountability are being flagged as governance gaps by proxy advisors.

    Algorithmic Bias and Fairness: ESG-Specific AI Risks

    Algorithmic bias is fundamentally an ESG risk, not merely a technical risk. When an AI hiring system deprioritizes candidates from underrepresented backgrounds—whether through proxy variables (zip code correlating with race), historical training data patterns (reflecting past discrimination), or system architecture flaws (optimizing for metric that inadvertently encodes bias)—it directly undermines diversity and inclusion (DEI) commitments and exposes organizations to legal liability.

    Examples from 2025–2026 practice illustrate the exposure:

    • Credit and lending: Algorithmic credit scoring models deployed by financial institutions have been shown to systematically disadvantage borrowers from certain geographic regions or socioeconomic backgrounds, triggering ECOA (Equal Credit Opportunity Act) violations and algorithmic discrimination lawsuits.
    • Hiring and promotion: Recruiting AI systems trained on historical hiring data can systematically underweight applications from women or minorities if historical hires skewed male/majority. Organizations like Amazon famously discovered gender bias in recruiting AI trained on male-dominated past hires.
    • Insurance underwriting: Underwriting algorithms that use proxy variables (type of vehicle owned, neighborhood density) can inadvertently correlate with protected characteristics, creating actuarially defensible but ethically problematic outcomes.
    • Healthcare resource allocation: AI systems triaging patients or allocating ICU beds have been found to systematically disadvantage Black patients when trained on historical data that reflected healthcare disparities.

    ESG disclosure requirements now explicitly demand AI bias assessment. CSRD requires companies to address algorithmic discrimination as a social materiality issue. California CCPA and emerging state privacy laws include algorithmic bias disclosure. Investors increasingly ask about bias testing protocols, remediation timelines, and governance accountability for algorithmic fairness as part of ESG engagement.

    Model Transparency and Explainability: The Governance Standard

    A second critical ESG risk is model opacity. Black-box AI systems—neural networks, large language models, complex ensemble models—provide predictions or recommendations without explaining the reasoning. In high-stakes decisions (credit, hiring, healthcare, criminal justice), lack of transparency is increasingly unacceptable from an accountability perspective and increasingly illegal under emerging regulations.

    The EU AI Act explicitly requires explainability for high-risk systems. GDPR’s right to explanation requires that individuals subject to automated decisions have meaningful insight into the decision-making process. NIST RMF emphasizes transparency, interpretability, and auditability as core AI risk management functions. SEC climate disclosure guidance requires disclosure of models and assumptions in climate scenario analysis—foreshadowing expectations that non-climate AI systems will face similar transparency demands.

    ESG-specific transparency requirements include:

    • Model documentation: Clear documentation of AI system purpose, training data sources, algorithm selection, and performance metrics across demographic groups.
    • Governance controls: Processes for model validation, ongoing performance monitoring, and decision-making chains (where AI makes autonomous decisions vs. where human review is required).
    • Explainability mechanisms: For high-stakes decisions, capability to explain individual decisions in human-understandable terms—not merely aggregate model accuracy.
    • Audit trails: Complete logging of model changes, retraining events, performance drift detection, and remediation actions.
    • Stakeholder disclosure: Clear communication to affected parties (employees, customers, borrowers, patients) about algorithmic decision-making and their rights to review and challenge decisions.

    Organizations should reference bcesg.org’s Governance category for frameworks on board-level oversight and accountability structures for AI systems.

    Data Governance and Model Failure: Cybersecurity and ESG Convergence

    A third AI governance risk is data poisoning and model failure. Machine learning systems are vulnerable to adversarial attacks: malicious actors can deliberately inject corrupted training data, craft inputs designed to trigger model failures, or exploit system dependencies to cause cascading breakdowns. Financial trading algorithms, medical diagnosis systems, autonomous vehicles, and critical infrastructure controls are all vulnerable to AI-specific attack vectors.

    ESG governance must address AI-specific cybersecurity. Data governance frameworks should include protocols for: detecting poisoned training data, validating data source integrity, monitoring model performance for signs of attack, maintaining model versioning and rollback capabilities, and testing system resilience under adversarial conditions. This is distinct from traditional cybersecurity, which focuses on data theft or system access; AI-specific threats target the integrity and reliability of algorithmic decision-making itself.

    Board governance of AI should integrate traditional cybersecurity and risk management with AI-specific oversight: AI model governance committees, chief AI risk officers, model performance dashboards, and incident response protocols for AI system failures. Organizations without this integration risk discovering AI security gaps only after operational failures or regulatory enforcement actions.

    Responsible AI Frameworks: Building ESG-Aligned AI Governance

    Leading organizations are implementing responsible AI frameworks that integrate ethical principles, regulatory compliance, and business continuity. Key components include:

    1. AI governance structure: Board-level AI oversight (dedicated committee or integration into existing governance), C-level accountability (Chief AI Officer or Chief Risk Officer with explicit AI mandate), and cross-functional AI ethics committees spanning legal, compliance, HR, risk, and technical leadership.
    2. Risk assessment protocols: Systematic evaluation of AI systems for bias risk, explainability requirements, data governance needs, and cybersecurity vulnerabilities. Use NIST RMF or equivalent framework as the assessment baseline.
    3. Bias testing and remediation: For any AI system making decisions affecting human outcomes (hiring, credit, healthcare, insurance), implement bias testing across demographic groups. Document testing methodology, results, and remediation plans in ESG disclosure.
    4. Model transparency: Establish explainability thresholds: high-stakes decisions require human-interpretable explanations; lower-stakes decisions may accept less transparent models. Document thresholds and rationales.
    5. Data governance: Ensure data governance policies address training data provenance, validation, contamination detection, and access controls. Treat data quality as a governance function, not merely an operational detail.
    6. Ongoing monitoring: Implement performance monitoring for deployed models: detection of bias drift (model becomes less fair over time), accuracy drift (model performance degrades), and adversarial vulnerability. Establish alert thresholds and response protocols.
    7. Incident response: Develop AI-specific incident response protocols: procedures for detecting model failures, escalation and disclosure, remediation timelines, and stakeholder communication. Treat AI system failures with same severity as cybersecurity incidents.

    ESG disclosure should document governance structure, risk assessment frameworks, bias testing results (aggregated to protect privacy), and remediation timelines. This transparency signals to investors and regulators that the organization is proactively managing AI governance risks.

    Cross-Site Implications: AI Governance in Risk Management, Underwriting, and Healthcare

    AI governance affects multiple industry clusters. Risk management and insurance professionals must assess AI-specific risks in underwriting, claims processing, and capital allocation. RiskCoverageHub.com’s guidance on AI underwriting risks addresses how algorithmic systems affect pricing, selection, and discrimination risk in insurance contexts.

    Business continuity planners must incorporate AI system failures into operational resilience scenarios. Model failure, data poisoning attacks, or regulatory enforcement action forcing AI system shutdown can trigger operational disruption. ContinuityHub.org’s frameworks on AI as a business continuity risk detail integration of AI governance into operational resilience and disaster recovery planning.

    Healthcare facilities face specific AI governance complexity: medical device AI, diagnostic algorithms, resource allocation systems, and clinical decision support systems all carry high stakes. HealthcareFacilityHub.org’s resources on medical device cybersecurity and AI governance address healthcare-specific regulatory requirements and patient safety implications of AI system failures.

    Building AI Governance Capability in 2026

    Organizations should treat AI governance as urgent, not aspirational:

    1. Q1–Q2 2026: Establish board-level AI governance accountability and cross-functional AI governance committee. Conduct inventory of AI systems in current use (you will find more than initially recognized).
    2. Q2–Q3 2026: Prioritize high-risk AI systems (those affecting hiring, credit, underwriting, healthcare, critical infrastructure). Conduct bias testing and explainability assessment for top 10–20 systems.
    3. Q3–Q4 2026: Develop governance policies, data governance frameworks, and incident response protocols. Begin ESG disclosure preparation documenting governance structure and risk management approach.
    4. Q4 2026–Q1 2027: Extend assessment to remaining AI systems. Build monitoring infrastructure for deployed models. Prepare for ESG disclosures in 2027 annual reports.

    The regulatory and investor pressure on AI governance will only intensify through 2027–2028. Organizations treating it as a 2026 priority will develop governance maturity and competitive advantage; those deferring risk remediating quickly under regulatory pressure in 2027.

    Related Resources on bcesg.org

    Explore Related AI Governance and Governance Topics

    Cluster Cross-References

    For Insurance and Risk Management AI: RiskCoverageHub.com addresses AI governance in underwriting, claims processing, and capital allocation decisions, including algorithmic discrimination risk and regulatory compliance in insurance AI.

    For Business Continuity and Operational Resilience: ContinuityHub.org covers AI system failure scenarios, data poisoning risks, and integration of AI governance into business continuity planning and disaster recovery.

    For Healthcare-Specific AI Governance: HealthcareFacilityHub.org details medical device AI governance, clinical decision support system risk management, and patient safety implications of AI system failures.

    For Property and Infrastructure Context: RestorationIntel.com addresses AI applications in infrastructure assessment, property damage evaluation, and restoration planning relevant to AI governance in critical asset management.

  • Global ESG Regulatory Convergence: ISSB Adoption, Jurisdictional Mapping, and Interoperability

    Home > Regulatory Frameworks > Global Regulatory Convergence

    Global ESG Regulatory Convergence: ISSB Adoption, Jurisdictional Mapping, and Interoperability

    Updated October 6, 2026.

    If you map ISSB S1/S2 adoption across jurisdictions, this guide compares EU CSRD, California, SEC, and emerging climate disclosure regimes as of October 2026.

    Definition: Global ESG regulatory convergence refers to the increasing alignment of sustainability disclosure standards across jurisdictions around the ISSB (International Sustainability Standards Board) standards, which provide a globally consistent, investor-focused baseline for climate and broader environmental, social, and governance disclosure. As of March 2026, 20+ jurisdictions have adopted or are implementing ISSB standards, creating a framework for interoperability across regional standards (EU CSRD, SEC climate rule, California SB 253) while significant gaps and conflicts remain.

    The International Sustainability Standards Board (ISSB)

    History and Development

    The ISSB was formally established in 2022 under the International Financial Reporting Standards (IFRS) Foundation, building on the TCFD (Task Force on Climate-related Financial Disclosures) framework. The ISSB published two foundational standards in June 2023:

    • IFRS S1 (General Requirements): Overarching principles for identifying and disclosing material sustainability-related financial information
    • IFRS S2 (Climate): Specific requirements for climate-related disclosures aligned with TCFD; requires Scope 1, 2, and (in certain cases) Scope 3 GHG emissions reporting

    ISSB Standard Fundamentals

    The ISSB standards are grounded in key principles:

    • Double Materiality Assessment: Companies must disclose information material to investors (financial materiality) and information where company impacts are material to society/environment (impact materiality)
    • Investor-Centric Focus: Primary objective is providing investors with decision-useful information; non-financial stakeholders’ interests are secondary
    • Alignment with TCFD: IFRS S2 incorporates TCFD recommendations; companies already TCFD-compliant face minimal incremental burden
    • Industry-Specific Guidance: ISSB acknowledges material issues vary by industry; industry guidance is under development

    Global Jurisdictional Adoption Status (March 2026)

    Jurisdictions Adopting or Implementing ISSB

    As of March 2026, 20+ jurisdictions have announced adoption or implementation of ISSB standards. Key markets include:

    European Union

    The EU has adopted a convergence approach, integrating ISSB principles into the CSRD (Corporate Sustainability Reporting Directive). Large companies (>500 employees) must comply with CSRD starting 2024 (for certain companies) and 2025-2026 (for others). CSRD is more comprehensive than ISSB (covering social issues, board diversity, supply chain due diligence) but aligns on climate and environmental metrics.

    United Kingdom

    The FCA (Financial Conduct Authority) has announced alignment with ISSB standards for UK-listed companies. Transition from TCFD to ISSB-aligned requirements is underway, with full implementation expected 2025-2026. The UK Taxonomy also incorporates ISSB principles.

    Japan

    Japan has adopted ISSB standards. The Financial Services Agency requires large companies to adopt ISSB by 2030. Japan has also developed supplementary requirements addressing social issues material to Japanese stakeholders (female leadership, labor practices).

    Canada

    Canada has aligned with ISSB, requiring large companies to disclose climate-related information consistent with ISSB standards. Implementation timeline: 2024-2026 for Scope 1-2 emissions; Scope 3 phased in 2027-2028.

    Australia

    Australia has legislated climate disclosure requirements aligned with ISSB. The Treasury Laws Amendment (2023) requires all ASX-listed companies to disclose climate risks and emissions using ISSB/TCFD framework. Reporting begins 2024.

    Singapore

    Singapore has adopted ISSB-aligned standards. The SGX (Singapore Exchange) requires listed companies to comply with ISSB disclosure standards, with phased implementation through 2026.

    United States

    The SEC climate rule is partially aligned with ISSB on Scope 1-2 emissions but differs on Scope 3 requirements and materiality framework. The SEC has indicated longer-term convergence toward ISSB standards, but current rule proceeds independently due to US constitutional and regulatory constraints.

    Hong Kong

    Hong Kong has aligned disclosure requirements with ISSB. Listed companies on HKEX must comply with ISSB-aligned climate and sustainability standards.

    Partial Adoption and Emerging Markets

    Many other jurisdictions (Brazil, India, Indonesia, Mexico, South Korea, Taiwan, Thailand, Vietnam) have signaled adoption or are developing ISSB-aligned standards. However, implementation timelines vary, and full convergence remains years away. Some jurisdictions maintain parallel or alternative frameworks.

    Comparative Analysis: ISSB vs. Regional Standards

    Dimension ISSB (S1, S2) EU CSRD SEC Climate Rule California SB 253
    Scope 1-2 Emissions Required Required Required (2026) Required (2026)
    Scope 3 Emissions If material; phased Required for all companies If material; phased If material (40% threshold)
    Social Disclosure Limited (materiality-based) Comprehensive (governance, labor, human rights) Climate-only Climate-only
    Governance Disclosure Climate governance required Board diversity, executive comp linkage Climate governance required Implicit in adaptation planning
    Assurance Limited (ISSB S1/S2 silent) Limited assurance required Not mandated Not mandated
    Liability Standard Varies by jurisdiction Administrative penalties, director liability Securities fraud standards Strict liability (SB 261)

    Interoperability Challenges and Solutions

    Key Interoperability Gaps

    • Materiality Definitions: ISSB relies on investor materiality; CSRD requires double materiality assessment; these can produce conflicting scope and disclosure requirements
    • Scope 3 Treatment: ISSB requires Scope 3 “if material”; CSRD requires comprehensive Scope 3; EU/California stricter than ISSB baseline
    • Social Issues: ISSB focuses on climate; CSRD includes extensive social and governance disclosure; gaps exist in comparability
    • Assurance Requirements: CSRD mandates limited assurance; US and some other jurisdictions do not; creates inconsistent audit trails
    • Timeline Divergence: Jurisdictions have different phase-in schedules; companies face moving compliance deadlines

    Best Practice for Multi-Jurisdictional Compliance

    Companies operating in multiple jurisdictions should:

    • Map Regulatory Requirements: Create matrix of requirements across jurisdictions where you have material operations/disclosure obligations
    • Identify Strictest Standards: Implement data systems and disclosure processes satisfying the most stringent requirement (typically CSRD or California)
    • Use ISSB as Baseline: ISSB provides common foundation; add supplementary disclosures as required by specific jurisdictions
    • Leverage Technology: Sustainability reporting platforms with multi-standard mapping reduce compliance burden
    • Engage Stakeholders: Invest in investor and regulator engagement to understand evolving standards and expectations

    Barriers to Convergence

    Jurisdictional Sovereignty and Policy Divergence

    While ISSB provides a common language, full convergence is constrained by jurisdictional differences in climate policy priorities, social values, and regulatory philosophy. For example:

    • EU prioritizes just transition and social inclusion; requires board diversity and supply chain due diligence not in ISSB
    • US emphasizes investor protection; applies securities fraud standards inconsistent with ISSB liability frameworks
    • California imposes strict liability for misstatements, departing from ISSB approach
    • Emerging markets may lack capacity or resources to implement full ISSB standards

    Political Resistance and Business Advocacy

    Business groups in some jurisdictions (US, Australia, some Asian markets) continue to oppose aggressive climate disclosure, citing competitiveness concerns and constitutional objections. This political resistance has delayed or diluted ISSB adoption in certain regions.

    Emerging Standards and Future Directions

    Nature-Related Financial Disclosure (TNFD)

    The Task Force on Nature-related Financial Disclosures published its framework in 2023. As of March 2026, TNFD is complementing ISSB in progressive jurisdictions (EU, UK, Australia) by extending disclosure requirements to biodiversity and ecosystem impacts. Full ISSB integration of TNFD principles is expected 2026-2027.

    Social and Governance Standards

    ISSB is developing supplementary standards for material social and governance issues. Early drafts address human capital (labor practices, diversity), business conduct (anti-corruption, ethics), and supply chain governance. Finalization expected 2026-2027.

    AI and Emerging Risk Disclosure

    Regulators are considering requirements for disclosure of AI-related risks and governance. ISSB may expand to cover AI governance and risks in future iterations.

    Implementation Roadmap for Global Companies

    Year 1: Foundation (2025-2026)

    • Conduct jurisdictional regulatory mapping; identify applicable standards
    • Assess current disclosures against ISSB and applicable regional standards
    • Establish global ESG data infrastructure aligned with ISSB S1/S2 requirements
    • Pilot ISSB-aligned disclosure in one jurisdiction or business unit

    Year 2: Scale (2026-2027)

    • Roll out ISSB-aligned disclosures across all applicable jurisdictions
    • Address jurisdiction-specific requirements (CSRD social disclosure, California adaptation planning)
    • Obtain third-party assurance (limited or reasonable) of climate and emissions data
    • Engage investors and regulators on disclosure approach and feedback

    Year 3+: Optimization (2027+)

    • Integrate TNFD and emerging social/governance standards into disclosure framework
    • Leverage automation and technology to reduce reporting burden and improve data quality
    • Pursue continuous improvement in materiality assessment and disclosure depth
    • Monitor regulatory evolution and adjust disclosure strategy proactively

    Frequently Asked Questions

    Should my company adopt ISSB standards even if not required by regulation?
    Yes. ISSB provides a globally recognized baseline for ESG disclosure, facilitating investor understanding and capital market efficiency. Voluntary ISSB adoption demonstrates sustainability commitment and can enhance investor relations. Additionally, as more jurisdictions adopt ISSB-aligned standards, early adoption reduces future compliance burden.

    How do I reconcile ISSB materiality with CSRD double materiality?
    ISSB’s single materiality (investor-centric) is narrower than CSRD’s double materiality (investor + impact). To satisfy both, assess issues under both standards: include items material to investors (ISSB) plus items material to society/environment even if not investor-material (CSRD). This produces comprehensive disclosure satisfying strictest requirements.

    What is the interoperability between ISSB and EU CSRD?
    High interoperability on climate metrics (Scope 1-2-3 emissions); moderate on governance (CSRD requires board diversity, executive comp linkage); low on social issues (CSRD comprehensive, ISSB minimal). EU companies should start with CSRD requirements and supplement with ISSB where applicable.

    Will ISSB Scope 3 requirements eventually align with SEC and California?
    Likely, but with lag. SEC climate rule currently doesn’t mandate Scope 3; California requires Scope 3 if material (40%+). ISSB similarly requires Scope 3 “if material.” Convergence toward comprehensive Scope 3 reporting is probable over next 3-5 years as climate science and investor demand increase.

    How does TNFD integrate with ISSB?
    TNFD is complementary to ISSB. While ISSB focuses on investor-material sustainability risks/opportunities, TNFD addresses nature-related financial risks and dependencies. Integration of TNFD into ISSB standards is expected 2026-2027. For now, progressive companies disclose against both frameworks.

    Related Resources

    Learn more about related topics:

    ISSB Adoption Tracker: Which Jurisdictions Have Adopted IFRS S1 and S2 (2026)

    As of mid-2026, around 36 jurisdictions representing more than 60% of global GDP have adopted, are aligning with, or are progressing toward the ISSB’s IFRS S1 and IFRS S2 sustainability disclosure standards. Roughly 28 have formally adopted them on a voluntary or mandatory basis, with about 12 more committed to following. Adoption is rarely a direct copy of the global text: most jurisdictions enact a locally branded standard (UK SRS, Australia’s ASRS/AASB S2, Japan’s SSBJ, Canada’s CSDS, Brazil’s CBPS) built on IFRS S1/S2 as the baseline, then phase in mandatory reporting by company size between 2025 and 2030.

    Jurisdiction-by-jurisdiction adoption status

    Jurisdiction Local standard / route Status First reporting year Mandatory or voluntary
    Australia ASRS (AASB S1 & AASB S2) Adopted FY beginning on/after 1 Jan 2025 Mandatory (phased by size to 2027)
    United Kingdom UK SRS S1 & S2 (six UK amendments) Adopted (endorsed 25 Feb 2026) 2027 (proposed mandatory; voluntary now) Voluntary now; mandatory proposed from 2027
    European Union ESRS under CSRD (interoperable with ISSB) Aligning (interoperability mapping) FY2024 (large entities, phased) Mandatory (own ESRS regime, not direct ISSB)
    Japan SSBJ Standards (Application, Theme 1 & 2) Adopted FY ending Mar 2027 (largest firms) Voluntary FY2026; mandatory phased from FY2027
    Canada CSDS 1 & CSDS 2 Adopted 2025 (voluntary) Voluntary (mandatory securities rule walked back)
    Brazil CBPS 01 & 02 (CVM Resolution) Adopted 2024 (voluntary) Voluntary (2026 mandatory phase removed by CVM Res. 244)
    China (Mainland) CSDS Basic Standard (MOF) + exchange rules Aligning 2026 (FY2025 reports, large/dual-listed) Mandatory phased to full alignment by 2030
    Hong Kong SAR HKFRS S1 & S2 / HKEX listing rules Adopted FY beginning on/after 1 Jan 2025 Comply-or-explain; full adoption targeted 2028
    Singapore SGX-aligned ISSB climate disclosures Adopted FY2025 (listed issuers) Mandatory (Scope 3 from FY2026)
    Malaysia National Sustainability Reporting Framework (NSRF) Adopted 2025 (Group 1) Mandatory (phased: Group 2 2026, Group 3 2027)
    Nigeria IFRS S1 & S2 (FRC adoption roadmap) Adopted 2024 (voluntary) Voluntary to 2026; mandatory phased from 2027
    Hong Kong / Taiwan (Chinese Taipei) TWSE ISSB-aligned roadmap Adopted 2026 (largest listed companies) Mandatory (phased by capitalisation)
    South Korea KSSB draft standards (ISSB-based) Proposed 2026 onward (under consultation) Mandatory expected (timeline being finalised)
    Türkiye TSRS (Turkish Sustainability Reporting Standards) Adopted FY2024 Mandatory (above thresholds)
    Pakistan / Sri Lanka / Bangladesh National adoption of IFRS S1 & S2 Adopted 2025 (phased, voluntary first) Voluntary moving to mandatory
    United States No federal ISSB adoption (state rules e.g. California) Not adopted n/a (California SB 253/261 from 2026) Voluntary federally; some state mandates

    The global picture: how many jurisdictions, what share of the economy, and EU interoperability

    The IFRS Foundation reports that approximately 36 jurisdictions have adopted, used, or are taking steps toward the ISSB Standards, together representing well over half of global GDP (more than 60% by recent counts) and a large share of global market capitalisation and greenhouse gas emissions. Of the first batch of detailed jurisdictional profiles published, 14 of 17 set a target of fully adopting IFRS S1 and S2, while the rest target the climate-only requirements (IFRS S2) or partial incorporation. The dominant pattern is a national standard that uses IFRS S1/S2 as its baseline with limited local modifications, then phases mandatory reporting in by entity size over 2025-2030.

    The most important convergence point is the European Union. The EU does not adopt IFRS S1/S2 directly; it has its own European Sustainability Reporting Standards (ESRS) under the Corporate Sustainability Reporting Directive (CSRD), which use a double-materiality lens (impact on the world plus financial materiality) rather than the investor-focused single-materiality baseline of the ISSB. To avoid double reporting, the ISSB and EFRAG published joint interoperability guidance mapping the climate disclosures, so companies reporting under both ESRS and ISSB can do so efficiently. The ISSB’s financial-materiality definition in IFRS S1 is aligned with ESRS’s financial-materiality definition, with ESRS layering the additional impact-materiality assessment on top. This interoperability is the mechanism that lets the ISSB function as the global baseline while the EU’s broader regime sits alongside it.

    Frequently Asked Questions

    How many countries have adopted ISSB standards?

    As of 2026, roughly 36 jurisdictions have adopted, used, or are progressing toward the ISSB’s IFRS S1 and S2 standards. About 28 have formally adopted them on a voluntary or mandatory basis, with around 12 more committed to introducing them. Together these jurisdictions represent more than 60% of global GDP.

    Has the US adopted ISSB standards?

    No. The United States has not adopted IFRS S1 or S2 at the federal level, and the SEC’s own climate disclosure rule has faced legal and political challenges. Some US states have moved independently, most notably California’s SB 253 and SB 261, which impose climate and emissions disclosure obligations beginning in 2026, but these are state mandates rather than ISSB adoption.

    Are IFRS S1 and S2 mandatory?

    It depends on the jurisdiction. The ISSB itself only issues the standards; individual jurisdictions decide whether and when to make them mandatory. Australia, Singapore, Malaysia, China, Türkiye, and Hong Kong have mandatory or comply-or-explain regimes phasing in from 2025-2026, while the UK, Canada, Japan (initially), Brazil, and Nigeria start voluntary and move toward mandatory reporting over later years.

    How do ISSB standards relate to the EU ESRS?

    The EU uses its own European Sustainability Reporting Standards (ESRS) under the CSRD, not IFRS S1/S2 directly. ESRS applies double materiality (impact plus financial), whereas the ISSB baseline is investor-focused single (financial) materiality. The ISSB and EFRAG published interoperability guidance that maps the two for climate disclosures, so companies subject to both can report once and satisfy both regimes for the overlapping content.

    When did Australia’s ISSB-aligned reporting become mandatory?

    Australia’s mandatory climate reporting under the Australian Sustainability Reporting Standards (ASRS), built on AASB S1 and AASB S2 (which incorporate IFRS S1 and S2), applies to financial years beginning on or after 1 January 2025 for the largest entities, then phases in to additional groups from 1 July 2026 and 1 July 2027. It is one of the first major mandatory ISSB-aligned regimes in the world.

    What is the difference between the ISSB standards and a jurisdiction’s local version?

    The ISSB publishes IFRS S1 (general sustainability-related financial disclosures) and IFRS S2 (climate-related disclosures) as a global baseline. Jurisdictions typically enact a locally named standard, such as the UK SRS, Australia’s ASRS, Japan’s SSBJ, Canada’s CSDS, or Brazil’s CBPS, that uses the IFRS S1/S2 text as its foundation but adds local amendments, effective dates, transition reliefs, and scoping rules suited to that market. The substance stays largely aligned so disclosures remain globally comparable.

BC ESG

ESG Strategy, Sustainability Intelligence, and Business Continuity for Forward-Thinking Organizations

© 2026 BC ESG — Business Continuity, ESG & Sustainability Intelligence