Environmental ESG is the operating system underneath every climate claim a company makes. It is not a report and it is not a single standard. It is a stack of three layers that do different jobs: a management system that decides what the organization controls, a measurement standard that decides how emissions and other impacts are counted, and disclosure standards that decide what gets published and to whom. When any layer is missing, the layers above it produce numbers nobody can defend.

The reason this guide needs a 2026 edition is that almost every layer of the stack is mid-transition at once. ISO published a new edition of ISO 14001 in April 2026. GRI’s climate and energy standards are replaced on 1 January 2027. The GHG Protocol’s first full revision is planned for publication in late 2028, which means the 2004 text governs until then. Europe has narrowed the CSRD’s scope while keeping its deadlines, and in the United States the federal climate rule is stayed and proposed for rescission while California’s first filing deadline is 10 November 2026. The dates are not background. In this field, the dates are the content.

This guide works through the stack in order: the topic architecture, the management system, the measurement substrate, the disclosure map, the European scope reset, the United States as it actually stands in October 2026, and the target and assurance rules that separate a program from a press release. It closes with the failure modes — each one documented, each one avoidable.

The topic architecture: seven topics, three definitional homes

The environmental pillar covers climate and greenhouse gases, energy, water and effluents, waste and circularity, pollution and chemicals, biodiversity and ecosystems, and product lifecycle. No single standard defines all seven. Each topic lives in a GRI topic standard, an ESRS topical standard, an ISO standard, or some combination — and the combinations are not symmetrical.

The gap in that table is the one most programs miss. A company that “covers the GRI environmental topics” has usually built climate, energy, water, and waste reporting — and has no chemicals-and-pollution system at all, because GRI distributes pollution across three standards while ESRS E2 names it directly. If the business handles substances of concern, the pollution topic is a management system of its own, not a disclosure line.

The management system: ISO 14001:2026 is the published standard

ISO 14001 is the layer that turns environmental topics into organizational machinery. Its structure — context, leadership, planning, support, operation, performance evaluation, improvement — is built around two working records: the register of environmental aspects and impacts (what the organization’s activities touch, and how significantly) and the register of compliance obligations (the laws, permits, and commitments the organization must meet). Those registers are the program. Everything else — objectives, audits, reviews — operates on them.

The current edition is ISO 14001:2026, published 15 April 2026. The 2015 edition and its 2024 climate amendment are withdrawn on ISO’s catalog. Existing certificates do not expire with the publication: the accreditation transition, set by Global Accreditation Cooperation’s mandatory document of September 2026, runs three years and ends 30 April 2029. Certification bodies must declare their transition readiness by 31 January 2027, and new or initial accredited certifications are issued only against the 2026 edition from 31 October 2027.

Three calendars run inside this layer, and confusing them is a standard management failure. The internal audit and management review are requirements of the standard itself, run at intervals the organization plans. External certification — voluntary, and performed by an accredited certification body, never by ISO — follows surveillance audits, usually annual, and recertification, usually every three years. A greenhouse-gas assurance engagement is a third calendar entirely, run by different people under different standards. A certificate is not an inventory, and an inventory opinion is not a management review.

The measurement substrate: a 2004 standard, a 2028 horizon

Every disclosure regime in this guide counts carbon through the GHG Protocol. IFRS S2 still requires measurement “in accordance with the Greenhouse Gas Protocol: A Corporate Accounting and Reporting Standard (2004)” unless a jurisdiction or exchange requires a different method. The 2015 Scope 2 Guidance and the 2011 Scope 3 Standard — with its fifteen categories, from purchased goods and services to investments — complete the substrate. Carbon accounting across scopes 1, 2, and 3 is covered as its own discipline elsewhere on this site; what matters here is the revision state, because programs are being designed today against rules that change mid-flight.

The Protocol’s published plan, as of October 2026: a consolidated public consultation covering scope 1, scope 2, scope 3, and market instruments is slated for the second quarter of 2027, as part of the joint GHG Protocol–ISO corporate standard planned for publication in the fourth quarter of 2028, following the ISO–GHG Protocol partnership announced 9 September 2025. Nothing in that plan is a current requirement. The scope 2 work shows the direction: the Independent Standards Board recorded majority support in July 2026 for developing two market-based methods with differentiated requirements — one built on hourly matching, deliverability, and incrementality, one maintaining the 2015 approach — with optional-versus-required still an open question. A scope 3 “category 16” for uncaptured value-chain activities exists only as a working-group proposal in a 31 March 2026 progress update that the Board had not yet approved for consultation. Programs that claim category 16 or tiered data-quality disclosure is already mandatory are ahead of the Protocol.

One mechanic in the current text decides whether reported progress is real: the base-year recalculation policy. The Corporate Standard requires a policy, applied symmetrically to increases and decreases, that recalculates the base year when structural changes (mergers, divestments, outsourcing), methodology improvements, or significant errors would otherwise break comparability. Organic growth is not a structural change. The Standard deliberately does not set the numeric significance threshold. SBTi does — 5 percent — and that number becomes the operational test in the target section below.

The disclosure map: three layers, three materialities

IFRS S2 is the investor layer: climate-related risks and opportunities that could affect the entity’s prospects, effective for annual periods beginning on or after 1 January 2024 where jurisdictions adopt it. Its December 2025 amendments — reliefs and clarifications for scope 3 category 15 financed emissions, GICS disaggregation, and partial jurisdictional method relief — are effective for periods beginning on or after 1 January 2027. They amend IFRS S2. They are not the GHG Protocol’s new standard, and conflating the two is the most common drafting error in 2026 compliance memos.

GRI is the impact layer: an organization’s effects on the economy, environment, and people, whether or not those effects are financially material to investors. Its succession calendar is exact. GRI 101 Biodiversity took effect 1 January 2026. GRI 102 Climate Change and GRI 103 Energy, both published in 2025, replace the GHG disclosures of GRI 305 and all of GRI 302 respectively on 1 January 2027, with early adoption encouraged. GRI 305-6 (ozone-depleting substances) and 305-7 (NOx, SOx, and other significant air emissions) are not part of that handover — they stay, and a climate chapter that drops them has silently dropped pollution.

ESRS is the legal layer for companies in the CSRD’s scope: double materiality, impacts and financial effects together, in standards adopted as Commission Delegated Regulation (EU) 2023/2772. The simplified annex adopted in Delegated Regulation (EU) 2026/1563 was published in the Official Journal on 21 September 2026, enters into force on 10 November 2026, and applies to financial years beginning on or after 1 January 2027. Note the naming trap: the 2023 text calls E5 “Resource use and circular economy”; the 2026 annex table calls it “Circular Economy and Resource Use.” Both strings are law. They are the same standard.

Europe’s scope reset: narrower, not gone

Two directives did two different things, and compressing them into “the CSRD was delayed” produces bad compliance advice. The stop-the-clock directive, (EU) 2025/794 of 14 April 2025, moved the second application wave to financial years starting on or after 1 January 2027 and the third wave to 1 January 2028. It did not postpone wave one. Its transposition deadline was 31 December 2025; that deadline has passed, and EUR-Lex’s notification record still showed no notified measures for six Member States when checked for this guide — a directive is not national law until the Member State writes it, so the delay must be verified country by country.

The content directive, (EU) 2026/470 of 24 February 2026, in force since 18 March 2026, cuts the regime’s scope: individual and group reporting narrows to undertakings exceeding both €450 million net turnover and 1,000 employees on average, with transposition due by 19 March 2027 and application for financial years from 1 January 2027. Wave-one companies below the new test fall out from financial year 2027 — not retroactively out of their 2024–2026 obligations. Listed SMEs as a class leave the regime, value-chain companies up to 1,000 employees are protected from information requests beyond the voluntary standard, and the third-country turnover threshold rises to €450 million. One more date belongs in every EU compliance calendar: the Commission must adopt the CSRD’s limited-assurance standards under the amended Audit Directive no later than 1 July 2027. Those standards do not exist yet, and they are not ISSA 5000.

The United States in October 2026: stayed federally, live in California, extended at EPA

The SEC’s climate disclosure rule was adopted on 6 March 2024, stayed by the Commission itself on 4 April 2024 before its 28 May 2024 effective date ever became operative, left undefended when the Commission voted to end its defense on 27 March 2025, held in abeyance by the Eighth Circuit, and proposed for rescission on 29 May 2026, with comments closing 3 August 2026. As of this guide’s publication there is no final rescission and no vacatur. The rule is not “overturned” and it is not in force; the SEC’s 2010 climate guidance was expressly not stayed, and ordinary materiality disclosure under the securities laws was never repealed.

California is where the live obligation sits. SB 253 (Health and Safety Code § 38532) covers US-formed entities with total annual revenues in excess of $1 billion doing business in California; SB 261 (§ 38533) sets the threshold at $500 million and excludes insurers. CARB’s published deadline for the first SB 253 report — scope 1 and scope 2 only, prior fiscal year — is 10 November 2026, under an initial regulation counsel reports was approved by the Office of Administrative Law on 12 October 2026. First-year relief is written into the rule: the 2026 report may use information the entity already possessed or was collecting on or before 5 December 2024, or a letterhead statement that it held none. The statutory assurance ladder — limited assurance for scope 1 and 2 from 2026, reasonable from 2030 — is in the statute, while CARB’s September 2026 guidance places the assurance design in a second rulemaking; whether an assurance report must accompany the November filing is therefore not settled in CARB’s published text. Penalties are capped at $500,000 per reporting year for SB 253, with a good-faith shield for scope 3 misstatements. SB 261 is a different posture: the Ninth Circuit enjoined its enforcement on 18 November 2025, CARB’s 1 December 2025 advisory suspends enforcement of the missed 1 January 2026 posting date, and no merits decision had issued as of mid-October 2026. Its $50,000 cap is real and currently unenforceable.

At EPA, the Greenhouse Gas Reporting Program still exists. The rescission EPA proposed on 16 September 2025 remains a proposal. What is in force is a deadline: reporting-year 2025 reports moved from 31 March 2026 to 30 October 2026 by a February 2026 final rule, and then to 10 March 2027 by an interim final rule published and effective 14 October 2026. Part 98 reporters have a live obligation due 10 March 2027 unless a later final rule removes it.

Targets and assurance: where the numbers get tested

Science-based targets are the main target architecture, and the criteria in force matter more than the brand. SBTi’s Corporate Near-Term Criteria V5.3.1, in effect since 14 April 2026, set the operating tests: a significance threshold of 5 percent or less for base-year recalculation; where scope 3 is at least 40 percent of the total inventory, near-term targets must collectively cover at least 67 percent of scope 3; exclusions are capped at 5 percent of scope 1 and 2 and 5 percent of scope 3; and carbon credits must not be counted as reductions toward near-term targets — credits enter only for neutralizing residuals under the net-zero criteria. The Corporate Net-Zero Standard V2.0 was published 11 June 2026, but validation against it opens 1 February 2027; submissions under V1.3.1 and the near-term criteria remain open until 31 January 2028. A target “validated against V2.0” in 2026 is a claim that cannot be true yet.

Assurance has its own ladder and its own calendar. ISSA 5000, the IAASB’s sustainability assurance standard, is effective for periods beginning on or after 15 December 2026 — a date that has not arrived; ISAE 3410, the GHG-specific standard, is withdrawn from the same date, and ISAE 3000 (Revised) ceases to be the IAASB sustainability standard then, surviving only where a jurisdiction has not adopted ISSA 5000. Limited assurance concludes in the negative form — nothing has come to the practitioner’s attention — on deliberately limited procedures; reasonable assurance concludes as an opinion. Neither is interchangeable with California’s statutory ladder (limited from 2026, reasonable from 2030) or with the EU’s forthcoming delegated limited-assurance standards (due by 1 July 2027). A program that names which ladder, which standard, and which date it is on is a program. A program that says only “externally assured” is a sentence.

Failure modes, documented

Scope 3 cherry-picking. A boundary that includes business travel and commuting while purchased goods and use of sold products sit outside fails the arithmetic above wherever scope 3 is material: the 2011 Scope 3 Standard sets a minimum boundary per category, SBTi caps exclusions at 5 percent and tests coverage at 67 percent, and IFRS S2 requires disclosure of which of the fifteen categories are included. Silence about omitted categories is the reporting form of the same failure.

Intensity masking absolute growth. Intensity targets can improve while absolute emissions rise. United Airlines’ own 2025 reporting states both halves: absolute gross emissions increased, while intensity per revenue tonne-kilometre fell 13.5 percent against 2019 and rose 0.3 percent against 2024. SBTi’s criteria history concedes the mechanism for scope 3 physical-intensity targets. Quoting the intensity line without the absolute line is the masking; the cure is printing both, as United’s report does.

Credit over-reliance and credit fraud. Beyond the target rules (credits do not count toward near-term reductions; the Oxford Principles require emissions cuts first and a shift to durable removals by 2050; the Integrity Council’s Core Carbon Principles label requires both an eligible program and an approved methodology — 13 programs and 41 methodologies approved as of July 2026), the enforcement record shows why credits are a high-integrity purchase. In autumn 2024 the SEC, CFTC, and DOJ acted against CQC Impact Investors: the SEC’s 2 October 2024 order found that manipulated cookstove-project data produced roughly six million credits — about 30 percent of previously certified credits — that should not have been issued, in connection with a $250 million equity sale. Test the underlying data, the registry, and the claim boundary before the purchase, not after the order.

Restatements without a firing policy. Barry Callebaut’s September 2024 restatement replaced a published per-tonne reduction claim that was based on the previous methodology, after a more conservative land-use-change attribution raised cocoa’s contribution; the limited assurance it obtained expressly excluded net figures and removals. VHB’s methodology and boundary revision moved its 2023 scope 3 from 21,241 to 15,140 tCO2e — a 29 percent change from method alone. Restatement is not the scandal; a recalculation policy that does not fire at a 29 percent methodology swing is. The Corporate Standard requires the policy. SBTi sets its tripwire at 5 percent.

Frequently asked questions

Is ISO 14001:2015 still the current standard?

No. ISO 14001:2026 was published on 15 April 2026 and the 2015 edition is withdrawn on ISO’s catalog. Certificates to the 2015 edition remain valid through the accreditation transition, which ends 30 April 2029; from 31 October 2027, new accredited certifications are issued only against the 2026 edition.

Has the GHG Protocol been replaced?

No. The 2004 Corporate Standard, the 2015 Scope 2 Guidance, and the 2011 Scope 3 Standard remain the texts in force, and IFRS S2 still names the 2004 standard. A consolidated consultation is slated for the second quarter of 2027 and a joint GHG Protocol–ISO corporate standard for the fourth quarter of 2028. Both dates are plans, not publications.

Did the EU cancel the CSRD?

No. It narrowed it. Directive (EU) 2026/470 limits reporting to undertakings above both €450 million net turnover and 1,000 employees, for financial years from 1 January 2027 once Member States transpose (by 19 March 2027). The stop-the-clock directive moved waves two and three to 2027 and 2028 financial years. Wave one was not postponed, and wave-one companies below the new thresholds remain in scope until financial year 2027.

What must a US company actually file in late 2026?

Three live items, none of them the SEC rule: a first SB 253 scope 1 and 2 report to CARB by 10 November 2026 if the company exceeds $1 billion in revenue and does business in California; EPA Greenhouse Gas Reporting Program reporting-year 2025 reports by 10 March 2027 for Part 98 reporters; and whatever state, contractual, and listing obligations apply independently. SB 261 posting is enjoined; the SEC rule is stayed and proposed for rescission, not final.

The pillar in the set

This guide is the environmental volume of a three-part set. Its companions are Social Responsibility in ESG: The Complete Professional Guide and Governance in ESG: The Complete Professional Guide. The three share one logic: each pillar is a management system before it is a disclosure, and the disclosure is only ever as good as the registers, boundaries, and policies underneath it. Build the E pillar in that order — aspects and obligations first, measurement second, publication last — and the reporting deadlines in this guide become outputs of a running system instead of annual emergencies.