LAW: Corporate Governance and Regulatory Compliance
Introduction to ESG: What the Legal and Regulatory Framework Requires From Employers
Environmental, Social, and Governance (ESG) has moved from voluntary reporting to a structured legal obligation in multiple jurisdictions. SEC climate disclosure rules, EU CSRD requirements, state-level mandates, and litigation exposure are reshaping what organisations must disclose, measure, and demonstrate. This article provides a grounded introduction to the ESG legal framework for compliance, legal, and operations professionals.
Legal Disclaimer: This article provides educational information about ESG regulatory frameworks, not legal advice. ESG disclosure requirements vary significantly by jurisdiction, company size, industry, and listing status. Organisations should consult qualified legal counsel before making decisions about ESG reporting obligations, disclosure strategies, or compliance programmes.
$21T
ESG Assets Under Management
Global ESG-labelled assets under management exceeded $21 trillion in 2023, driven by institutional investor mandates, regulatory pressure, and growing demand for sustainability-linked capital products.
Global Sustainable Investment Alliance, 2023
50,000+
Companies Under EU CSRD
The EU Corporate Sustainability Reporting Directive applies to over 50,000 companies operating in the EU, including non-EU parent companies with significant EU revenue, making it the broadest mandatory ESG reporting framework in the world.
European Commission, CSRD Overview, 2024
3
Scope Categories for Emissions
The GHG Protocol divides emissions into Scope 1 (direct), Scope 2 (purchased energy), and Scope 3 (value chain). Scope 3 disclosure, which encompasses supply chain and customer emissions, is now mandatory under several frameworks and is the most complex to measure and verify.
GHG Protocol, Corporate Value Chain Standard
1. What ESG Is and Why It Has Become a Legal Matter
Environmental, Social, and Governance (ESG) refers to three categories of factors used to evaluate an organisation’s exposure to non-financial risk and its impact on the world beyond financial returns. Environmental factors include climate risk, emissions, water use, biodiversity, and supply chain environmental impact. Social factors include labour practices, worker safety, human rights in the supply chain, data privacy, and community relations. Governance factors include board composition, executive compensation, anti-corruption controls, transparency, and shareholder rights.
For most of its history, ESG was a voluntary reporting exercise. Companies published sustainability reports, adopted frameworks like the Global Reporting Initiative (GRI) or the Sustainability Accounting Standards Board (SASB), and disclosed ESG metrics at their own discretion and to varying standards. That era is ending. Beginning with the EU’s Non-Financial Reporting Directive in 2014, continuing through California’s climate disclosure laws in 2023, and accelerating with the SEC’s climate disclosure rule finalized in 2024, ESG has acquired legally binding disclosure obligations, audit requirements, and enforcement mechanisms.
Key Legal Frameworks at a Glance
EU CSRD
Mandatory for large EU companies from 2025; non-EU companies with EUR 150M+ EU revenue from 2028. Requires third-party assurance.
SEC Climate Disclosure Rule
Finalized March 2024. Requires climate risk disclosure, Scope 1 and 2 emissions for large accelerated filers, and financial statement footnotes on climate-related impacts.
California SB 253 and SB 261
SB 253 requires Scope 1, 2, and 3 disclosure for companies with $1B+ US revenue doing business in California. SB 261 requires climate financial risk reports. Both effective 2026.
2. The Three Pillars: What Each One Requires
E: Environmental
Environmental obligations now span climate risk identification and quantification, greenhouse gas emissions measurement across all three scopes, physical and transition risk assessment, water and biodiversity impact, and supply chain environmental due diligence. The EU’s Corporate Sustainability Due Diligence Directive (CSDDD) adds a legal duty of care for environmental harm caused by suppliers.
- Scope 1, 2, and 3 greenhouse gas emissions inventory
- Physical and transition climate risk assessment aligned to TCFD
- Net-zero targets with credible transition plans
- Supply chain environmental due diligence
GHG Protocol Corporate Standard
S: Social
Social disclosure requirements cover workforce practices (pay equity, health and safety, diversity metrics), human rights due diligence in the supply chain, and community impact. The EU’s CSRD European Sustainability Reporting Standards (ESRS) require detailed workforce data including turnover rates, collective bargaining coverage, and gender pay gap. The UK Modern Slavery Act requires supply chain human rights reporting for companies with GBP 36M+ turnover.
- Workforce health, safety, and wellbeing metrics
- Pay equity and gender pay gap reporting
- Supply chain human rights due diligence
- Modern slavery and forced labour statements
UK Modern Slavery Act 2015
G: Governance
Governance requirements address board-level accountability for sustainability strategy, executive pay links to ESG performance, anti-corruption and anti-bribery controls, cybersecurity governance, and tax transparency. Under CSRD’s ESRS G1 standard, companies must report on business ethics, corporate culture, lobbying activities, and supplier payment practices. SEC rules require disclosure of material governance risks and board expertise in climate matters.
- Board-level ESG oversight and climate expertise
- Anti-corruption and anti-bribery programme disclosure
- Executive compensation linked to ESG targets
- Tax transparency and country-by-country reporting
EU CSRD ESRS Standards, 2024
3. Compliance Requirements by Framework
The following table summarises the primary mandatory ESG frameworks applicable to organisations operating in major markets. Voluntary frameworks (GRI, SASB, TCFD) are excluded as they are increasingly incorporated by reference into mandatory regimes.
European Commission, CSRD | SEC Climate Disclosure Rule, 2024
4. Penalties and Enforcement: What Non-Compliance Costs
ESG enforcement is no longer theoretical. Regulators in the EU, UK, and US have imposed penalties for greenwashing, misrepresentation of ESG credentials, and failure to meet mandatory disclosure requirements.
FTC Green Guides | EU CSRD Enforcement Framework
5. GHG Emissions Scopes: The Core of Environmental Compliance
Greenhouse gas accounting under the GHG Protocol Corporate Standard divides emissions into three scopes. Every major mandatory ESG framework references this taxonomy, making it foundational to any emissions disclosure programme.
Emissions Scope Complexity and Disclosure Requirement
Scope 1: Direct Emissions (owned sources)
Lowest complexity
Combustion in owned or controlled sources (boilers, company vehicles, on-site processes). Measurable from utility and fuel records. Required by SEC rule for large accelerated filers and all California SB 253 companies.
Scope 2: Purchased Energy Emissions
Moderate complexity
Indirect emissions from purchased electricity, heat, steam, or cooling. Calculated using market-based or location-based methods. Required alongside Scope 1 under SEC rule, CSRD, and California SB 253.
Scope 3: Value Chain Emissions (15 categories)
Highest complexity
All indirect upstream and downstream value chain emissions across 15 defined categories including purchased goods and services, business travel, employee commuting, use of sold products, and end-of-life treatment. Typically 70-90% of total corporate emissions. Required under California SB 253 and CSRD. Data collection requires supplier engagement.
GHG Protocol, Corporate Value Chain (Scope 3) Accounting and Reporting Standard
6. The Social Pillar: What ESG Requires From Employers
The social pillar of ESG creates the most direct obligations for people operations, HR, and safety teams. While investor-focused ESG frameworks emphasise disclosure, the legal requirements in this area carry operational duties, not just reporting ones.
Worker Health and Safety Metrics
CSRD’s ESRS S1 (Own Workforce) requires disclosure of work-related injury rates, fatality rates, days lost, and the percentage of workers covered by a health and safety management system. These are now auditable disclosures, not voluntary benchmarks. US companies subject to CSRD through EU operations must integrate OSHA recordkeeping data into ESG reports.
ESRS S1, Own Workforce Standard
Pay Equity and Gender Pay Gap
The EU Pay Transparency Directive (2026) requires companies with 250+ employees to report the gender pay gap and provide pay range information to job applicants. The UK already requires gender pay gap reporting for employers with 250+ employees. Under CSRD, companies must disclose pay equity policies and the ratio of CEO compensation to median worker pay.
EU Pay Transparency Directive, 2023
Supply Chain Human Rights Due Diligence
The EU CSDDD and Germany’s Supply Chain Due Diligence Act (LkSG, in force since 2023) impose legal obligations to identify, prevent, and address human rights violations in supply chains. The US Uyghur Forced Labor Prevention Act (UFLPA) creates a rebuttable presumption that goods produced in Xinjiang involve forced labor and prohibits their import. These are operational obligations, not disclosure ones.
US CBP, UFLPA Enforcement
Key Takeaways
ESG Is Now a Legal Obligation, Not a Voluntary Exercise
The era of voluntary ESG reporting is ending. CSRD, the SEC climate rule, and California’s SB 253 create mandatory disclosure obligations with audit requirements and enforcement mechanisms. Companies that have treated ESG as a marketing exercise face significant compliance risk.
Non-EU Companies Are Not Exempt From CSRD
Any non-EU company with EUR 150M or more in EU net revenue and either an EU subsidiary or EU-listed securities will be subject to CSRD from FY2028. US, UK, and other non-EU companies doing significant business in Europe must begin building data collection and assurance capabilities well before the deadline.
Scope 3 Is the Hardest and the Most Consequential
Scope 3 emissions typically represent 70-90% of a company’s total carbon footprint and require supplier engagement, data collection across the value chain, and modelling for categories without direct data. Companies that have not begun Scope 3 data collection face multi-year catch-up timelines before California’s 2027 deadline.
Greenwashing Enforcement Is Accelerating
The SEC, FTC, and EU consumer protection authorities have all signalled and in some cases acted on greenwashing enforcement. Marketing claims about sustainability, net-zero commitments, and ESG credentials that are not supported by documented evidence create regulatory and litigation exposure that did not exist five years ago.
The Social Pillar Creates Operational Obligations
Supply chain human rights due diligence under CSDDD and UFLPA, gender pay gap reporting, and worker health and safety disclosure under CSRD are not just reporting requirements. They require operational programmes, supplier audits, and workforce data collection that HR and operations teams must own.
Assurance Requirements Are Raising the Bar on Data Quality
CSRD requires limited assurance from an independent auditor for sustainability disclosures, with reasonable assurance expected by 2028. The SEC climate rule requires attestation for Scope 1 and 2 disclosures. Data quality, audit trails, and internal controls for ESG metrics must meet the same standards as financial reporting.
Frequently Asked Questions
Does ESG apply to private companies?
Yes, increasingly. While most mandatory ESG frameworks initially target large public companies, private companies are affected through three channels: as suppliers to large companies required to collect Scope 3 data from their value chains; as entities doing business in California that meet the SB 253 revenue thresholds (which apply to all companies regardless of listing status); and through EU CSRD’s direct application to large EU-based companies regardless of listing status. Private equity-backed companies and those planning future public offerings face similar preparedness expectations.
What is double materiality and why does it matter for CSRD?
Double materiality requires companies to assess and disclose sustainability matters from two directions: financial materiality (how sustainability risks affect the company’s financial performance) and impact materiality (how the company’s activities affect people, the environment, and society). This is more demanding than the single materiality concept used in US financial reporting, which focuses only on what is material to investors. CSRD requires companies to conduct a formal double materiality assessment before determining which ESRS topics to report on.
What happened with the SEC climate disclosure rule?
The SEC finalized its climate disclosure rule in March 2024, but its implementation has been subject to legal challenge. Multiple lawsuits were filed by industry groups and state attorneys general, and the SEC voluntarily stayed the rule pending litigation review. As of mid-2026, the rule remains subject to legal uncertainty. Companies should monitor developments closely and build climate disclosure capabilities that position them to comply regardless of the litigation outcome, given that California’s SB 253 imposes similar requirements independently of the SEC rule.
What is the difference between TCFD, CSRD, and ISSB?
TCFD (Task Force on Climate-related Financial Disclosures) was a voluntary framework for climate disclosure that has been widely adopted and incorporated by reference into mandatory regimes. CSRD is the EU’s mandatory reporting directive that uses European Sustainability Reporting Standards (ESRS). The ISSB (International Sustainability Standards Board) issued IFRS S1 and S2 in 2023, providing global baseline sustainability and climate disclosure standards that many jurisdictions are incorporating into their own regulatory frameworks. TCFD has been formally disbanded as ISSB has absorbed its function.
What does ESG mean for worker safety and OSHA compliance?
Under CSRD’s ESRS S1, companies must disclose the number of work-related fatalities, the injury rate, the rate of recordable work-related injuries, and the number of days lost. These disclosures must cover all employees and, to the extent data is available, contractors on the company’s premises. For US companies with EU operations, OSHA 300 log data becomes ESG reporting input that will be reviewed by auditors. A poor safety record is now not only an OSHA compliance problem but an auditable ESG disclosure.
What is greenwashing and how does it create legal risk?
Greenwashing is the practice of making misleading claims about the environmental or sustainability credentials of a product, service, or organisation. Legal risk arises from multiple sources: the FTC’s Green Guides regulate environmental marketing claims in the US and allow enforcement action for unsubstantiated claims; the EU Green Claims Directive (proposed) would require pre-approval for environmental claims on products; and securities law in both the US and EU treats material misrepresentation in ESG disclosures as fraud. Several enforcement actions and class actions have already been filed globally against companies whose ESG claims were inconsistent with their actual practices.
Where should a company start with ESG compliance?
A practical ESG compliance starting point has four elements: first, determine which mandatory frameworks apply based on jurisdiction, company size, listing status, and revenue thresholds; second, conduct a gap assessment of current data collection capabilities against disclosure requirements; third, prioritise Scope 1 and 2 emissions accounting, which are required earliest and form the foundation for Scope 3 work; and fourth, engage qualified legal counsel and a sustainability assurance provider early, as both are required for CSRD compliance and building those relationships takes time. Legal counsel should be involved in any public ESG claim made before the compliance programme is fully verified.
Government and Regulatory Sources
Government and Regulatory Sources
- European Commission. Corporate Sustainability Reporting Directive (CSRD): framework overview, ESRS standards, assurance requirements, and phased scope.
- European Commission. European Sustainability Reporting Standards (ESRS): the twelve standards covering environment, social, and governance disclosure topics under CSRD.
- SEC. (2024). The Enhancement and Standardization of Climate-Related Disclosures for Investors: final rule text and compliance timeline.
- California SB 253. Climate Corporate Data Accountability Act: Scope 1, 2, and 3 disclosure requirements for companies with $1B+ US revenue.
- FTC. Green Guides: guidance on environmental marketing claims and the legal standards for substantiation of sustainability representations.
- US CBP. Uyghur Forced Labor Prevention Act (UFLPA): import prohibition and due diligence requirements for supply chains touching Xinjiang.
Industry and Research Sources
- GHG Protocol. Corporate Value Chain (Scope 3) Accounting and Reporting Standard: the definitive reference for Scope 3 emissions classification and measurement methodology.
- Global Sustainable Investment Alliance. (2023). Global Sustainable Investment Review: source for $21 trillion ESG AUM figure and regional breakdown.
- IFRS Foundation. IFRS S1 and S2 Sustainability Disclosure Standards: the ISSB global baseline standards for sustainability and climate disclosure adopted by multiple jurisdictions.
Related VelSafe Articles
Related VelSafe Articles
- Introduction to cGMPs: What Every Worker in Pharmaceutical and Medical Device Manufacturing Needs to Know
- Hand, Wrist, and Finger Safety: Workplace Injury Insights for Organisations
- FDA Inspection Interviewing Techniques: 10 GMP Compliance Tips
- Global Regulatory Strategy for Medical Device Manufacturers: QMSR, EU MDR, and AI Devices
VelSafe Compliance Resources
ESG Compliance Is Now a Legal Function, Not Just a Reporting One
From CSRD assurance requirements to California Scope 3 deadlines and CSDDD supply chain due diligence, ESG has moved into the legal and operational core of how organisations must be run. VelSafe covers workplace safety law, regulatory compliance, and governance frameworks for compliance, legal, and operations teams.
Browse Law Articles
