The esg & climate law tracker is a practical reference for founders, executives and legal teams navigating an increasingly complex web of sustainability obligations. Across the European Union, the United Kingdom, the United States, Asia-Pacific and beyond, regulators are introducing mandatory climate disclosure, supply chain due diligence and net-zero reporting requirements at an accelerating pace. Missing a filing deadline or misclassifying a reporting obligation can expose a business to regulatory penalties, reputational damage and restricted access to capital markets. This guide maps the key regulatory frameworks by region, explains what each requires, identifies who is in scope, and outlines the practical steps businesses should take to stay compliant.
ESG law - short for environmental, social and governance regulation - is the body of rules that compels companies to measure, disclose and, in some cases, reduce their environmental and social impacts. Climate law is the subset focused specifically on greenhouse gas emissions, climate-related financial risk and transition planning. Until recently, most ESG reporting was voluntary. That has changed fundamentally. Mandatory frameworks now cover tens of thousands of companies worldwide, and the number is growing each reporting cycle.
The practical consequence for international businesses is that a single corporate group may simultaneously face obligations under the EU Corporate Sustainability Reporting Directive, the UK Sustainability Disclosure Standards, the US Securities and Exchange Commission climate rules, and equivalent regimes in Australia, Singapore or Japan. Each framework has its own scope thresholds, disclosure templates, assurance requirements and enforcement mechanisms. Treating them as interchangeable is a common and costly mistake.
For boards and compliance teams, the priority is to map which frameworks apply, identify the first reporting deadline, and build data collection processes before that deadline arrives. Many companies underestimate the lead time required: gathering Scope 3 emissions data across a supply chain typically takes twelve to eighteen months the first time.
The EU has the most comprehensive mandatory ESG framework currently in force. The Corporate Sustainability Reporting Directive - commonly called CSRD - replaces the earlier Non-Financial Reporting Directive and dramatically expands the scope of mandatory sustainability reporting. Large public-interest entities were the first to report under CSRD, followed by other large companies, and then listed SMEs on a phased schedule. The directive requires companies to report in accordance with the European Sustainability Reporting Standards, which cover climate, biodiversity, social matters and governance in granular detail.
CSRD reports must be included in the management report and are subject to limited assurance by an accredited auditor. A non-obvious requirement is that the assurance must be provided by a statutory auditor or audit firm, not merely a sustainability consultant. Companies that have previously relied on voluntary assurance arrangements will need to engage their audit firm early to confirm scope and capacity.
The EU Taxonomy Regulation sits alongside CSRD. It is a classification system that defines which economic activities qualify as environmentally sustainable. Companies subject to CSRD must disclose what proportion of their turnover, capital expenditure and operating expenditure is aligned with the taxonomy. Taxonomy alignment is technically demanding: it requires demonstrating that an activity meets specific technical screening criteria and does no significant harm to other environmental objectives.
The Sustainable Finance Disclosure Regulation - SFDR - applies to financial market participants and financial advisers. It requires entity-level and product-level disclosures about how sustainability risks are integrated into investment decisions. Asset managers, insurers and pension funds operating in the EU must classify their products under SFDR';s tiered framework and publish detailed pre-contractual and periodic disclosures.
The EU Corporate Sustainability Due Diligence Directive - CS3D - adds a further layer. It requires large companies to identify, prevent and address adverse human rights and environmental impacts across their value chains. CS3D is distinct from CSRD: CSRD is about reporting what a company does; CS3D is about requiring companies to act. Both apply to non-EU companies with significant EU turnover, making this a genuinely extraterritorial obligation.
In practice, founders of non-EU companies should consider whether their EU revenue or employee headcount triggers CSRD or CS3D obligations even if they have no EU subsidiary. The thresholds are set at the group level, and the EU has made clear that enforcement will extend to third-country companies meeting the criteria.
The UK has developed its own sustainability disclosure architecture following its departure from the EU. The Financial Conduct Authority';s Sustainability Disclosure Requirements - SDR - apply to UK-authorised asset managers and require them to classify investment products using defined sustainability labels. The labels are legally defined and carry specific criteria; misuse of a label is a regulatory breach.
UK-listed companies and large private companies are subject to mandatory climate-related financial disclosures aligned with the Task Force on Climate-related Financial Disclosures framework - commonly called TCFD. TCFD disclosures cover governance, strategy, risk management and metrics and targets across four pillars. The UK was among the first jurisdictions to make TCFD-aligned reporting mandatory rather than voluntary, and its requirements have progressively extended to a wider population of companies.
The UK Transition Plan Taskforce - TPT - has published a disclosure framework for credible climate transition plans. While transition plan disclosure is not yet universally mandatory in the UK, the Financial Conduct Authority has signalled that listed companies will be expected to disclose against the TPT framework. A common mistake is treating a transition plan as a marketing document rather than a technical disclosure: the TPT framework requires specific information about decarbonisation levers, capital allocation and governance accountability.
The UK is also developing its own UK Sustainability Reporting Standards, which are expected to align closely with the International Sustainability Standards Board standards - ISSB - while incorporating UK-specific modifications. Companies reporting under TCFD today should monitor the transition to ISSB-aligned standards, as the disclosure templates and assurance requirements will evolve.
For international groups with UK operations, a practical scenario to consider is a US-headquartered company with a UK-listed subsidiary. That subsidiary will face UK TCFD and SDR obligations independently of whatever the parent reports in the US. Coordination between group-level and subsidiary-level reporting is essential to avoid inconsistencies that regulators or investors will scrutinise.
If your business is navigating overlapping UK and EU sustainability obligations, contact info@vlolawfirm.com. We can help structure the setup correctly the first time.
The US regulatory landscape for climate disclosure is more fragmented than the EU or UK. The Securities and Exchange Commission has adopted rules requiring public companies to disclose material climate-related risks, greenhouse gas emissions and the financial effects of severe weather events in their annual reports. The rules apply to domestic registrants and foreign private issuers listed on US exchanges. However, the rules have faced legal challenges, and the scope of mandatory Scope 3 emissions disclosure has been subject to revision. Companies should monitor the current status of the rules and their phase-in schedule.
Separately, California has enacted its own climate disclosure laws that apply to companies doing business in the state above defined revenue thresholds. The California Climate Corporate Data Accountability Act requires large companies to disclose Scope 1, Scope 2 and Scope 3 greenhouse gas emissions. The California Climate-Related Financial Risk Act requires biennial climate risk reports. These state laws apply to both public and private companies, which is a significant departure from the SEC framework and catches many private businesses off-guard.
A non-obvious requirement in the US context is that California';s laws apply to companies "doing business in California," a standard that can be met by having customers, employees or operations in the state even without a California-incorporated entity. Many international companies with US sales operations will fall within scope without realising it.
Beyond California, other US states are developing or considering their own sustainability disclosure requirements. The result is a patchwork that requires companies to track both federal and state obligations simultaneously. In practice, companies that build their disclosure infrastructure to meet the most demanding applicable standard - currently California';s - will generally satisfy less demanding requirements as well.
The Asia-Pacific region has moved rapidly toward mandatory climate disclosure, with several jurisdictions now requiring ISSB-aligned reporting. Singapore';s Accounting and Corporate Regulatory Authority and the Singapore Exchange have introduced mandatory climate reporting for listed companies, with a phased extension to large non-listed companies. Singapore';s framework is explicitly aligned with the ISSB';s IFRS S1 and IFRS S2 standards, which cover general sustainability-related financial disclosures and climate-specific disclosures respectively.
Australia has enacted mandatory climate-related financial disclosure legislation. Large companies and financial institutions are required to prepare annual climate statements covering governance, strategy, risk management and metrics and targets. The Australian framework follows ISSB standards and includes a liability regime for misleading climate statements, which is a stronger enforcement mechanism than many other jurisdictions currently employ.
Japan';s Financial Services Agency has introduced mandatory sustainability disclosure requirements for listed companies through amendments to the Cabinet Office Ordinance on Disclosure of Corporate Affairs. Japanese listed companies must disclose sustainability information - including climate-related matters - in their annual securities reports. The Tokyo Stock Exchange has also issued guidance encouraging companies to disclose against TCFD recommendations.
Hong Kong';s Securities and Futures Commission and the Hong Kong Stock Exchange have published a roadmap for mandatory ISSB-aligned climate disclosure for listed issuers. The phased implementation schedule means that larger issuers face earlier deadlines, with smaller issuers following in subsequent reporting cycles.
A practical scenario for an international group with operations across Singapore, Australia and Japan is that each subsidiary may face different disclosure templates, assurance standards and filing deadlines, even though all three are nominally aligned with ISSB. Local legal counsel in each jurisdiction is necessary to confirm the precise requirements and timelines.
Beyond disclosure, a growing number of jurisdictions are introducing mandatory human rights and environmental due diligence obligations that require companies to assess and address risks in their supply chains. The EU';s CS3D is the most comprehensive example, but it is not alone. Germany';s Supply Chain Due Diligence Act - the Lieferkettensorgfaltspflichtengesetz - requires large companies to identify, prevent and remediate human rights and environmental risks throughout their supply chains. France';s Duty of Vigilance Law imposes similar obligations on large French companies. Norway';s Transparency Act requires companies to conduct due diligence on human rights and decent work conditions.
These laws share a common architecture: companies must publish a due diligence policy, conduct risk assessments, implement preventive and remedial measures, and report publicly on their findings. The differences lie in scope thresholds, the depth of supply chain coverage required, and the enforcement mechanisms available to regulators and affected parties.
A common mistake among international companies is treating supply chain due diligence as a procurement compliance exercise rather than a legal obligation with its own reporting and documentation requirements. Regulators in Germany and France have begun enforcement actions, and the EU';s CS3D will introduce civil liability for companies that fail to prevent harm they could have identified through adequate due diligence.
The practical implication for non-European companies supplying into EU markets is significant. Even if a non-EU supplier is not directly subject to CS3D, its EU customers will be required to conduct due diligence on the supplier';s practices and may impose contractual obligations as a result. Preparing for these contractual demands in advance - by building ESG data collection and reporting capacity - reduces friction in commercial relationships and protects market access.
For assistance mapping your supply chain due diligence obligations across multiple jurisdictions, contact info@vlolawfirm.com. We can assist with documents and filings.
An effective cross-border ESG compliance programme begins with a regulatory mapping exercise. This means identifying every jurisdiction in which the corporate group has operations, revenue or listed securities, and determining which ESG frameworks apply in each. The mapping should cover disclosure obligations, due diligence obligations and any sector-specific requirements - for example, financial services firms face additional obligations under SFDR and equivalent regimes.
Once the applicable frameworks are identified, the next step is a gap analysis: comparing what the company currently measures and reports against what each framework requires. For most companies, the largest gaps are in Scope 3 emissions data, supply chain human rights information and biodiversity impact assessment. These gaps take time to close, and the gap analysis should be completed well before the first reporting deadline.
Data governance is a critical and often underestimated component. ESG data must be collected, verified and stored in a way that supports external assurance. Many companies discover that their existing financial reporting systems are not designed to capture non-financial data at the granularity required by CSRD or ISSB standards. Investing in data infrastructure early avoids the scramble that typically occurs in the months before a first report is due.
Assurance requirements vary by framework and jurisdiction. CSRD requires limited assurance from the outset, with a pathway to reasonable assurance in future. ISSB-aligned frameworks in Australia and Singapore also contemplate assurance. Companies should engage their auditors early to understand the scope of assurance required and the documentation that will be needed to support it.
Governance accountability is a recurring theme across all major ESG frameworks. Boards are expected to demonstrate oversight of climate and sustainability risks, and disclosure documents must name the governance body responsible. A non-obvious requirement is that board-level oversight must be substantive, not nominal: regulators and investors will scrutinise whether the board has the expertise and processes to exercise genuine oversight.
Which ESG framework applies to my company if it operates in multiple jurisdictions?
The answer depends on where your company is incorporated, where it is listed, where it generates revenue and where it has employees. A company incorporated outside the EU but generating significant EU revenue may be subject to CSRD and CS3D as a third-country company. A company listed on a US exchange faces SEC climate rules regardless of its country of incorporation. A company doing business in California faces state-level disclosure obligations even if it is not publicly listed. The practical approach is to conduct a jurisdiction-by-jurisdiction regulatory mapping exercise, starting with the jurisdictions where the company has the largest footprint. Overlapping obligations are common, and the most demanding applicable standard often sets the effective compliance baseline for the group.
How long does it take to prepare for mandatory ESG reporting, and what does it cost?
The lead time for first-time mandatory ESG reporting is typically twelve to twenty-four months for a company starting from scratch. The longest lead times are associated with Scope 3 emissions data collection, supply chain due diligence documentation and engaging an assurance provider. Professional fees for ESG reporting readiness projects vary widely depending on the size of the company, the number of jurisdictions involved and the complexity of the supply chain. Costs generally range from the low tens of thousands for a focused gap analysis to the mid-to-high hundreds of thousands for a full implementation programme at a large multinational. State registration and filing fees, where applicable, are typically modest compared to professional fees. Companies that invest in scalable data infrastructure early tend to reduce ongoing compliance costs significantly.
Can a company use a single ESG report to satisfy multiple regulatory frameworks?
A single integrated report can satisfy multiple frameworks if it is structured carefully, but it cannot be identical across all jurisdictions. CSRD requires reporting in accordance with the European Sustainability Reporting Standards, which are more granular than ISSB standards in some areas. ISSB-aligned frameworks in Singapore and Australia use different templates. The SEC requires disclosure in specific sections of the annual report on Form 10-K or Form 20-F. The practical approach is to build a core disclosure document aligned with the most comprehensive applicable standard - typically CSRD for EU-exposed companies - and then prepare jurisdiction-specific supplements or mappings that demonstrate compliance with each additional framework. This reduces duplication while ensuring that each regulator';s specific requirements are met.
ESG and climate law has moved from voluntary best practice to mandatory compliance across the world';s major economies. The regulatory landscape is complex, overlapping and evolving, but the direction of travel is clear: disclosure requirements will expand, due diligence obligations will deepen, and enforcement will intensify. Companies that build robust compliance programmes now - rather than waiting for the first enforcement action - will be better positioned to access capital, retain customers and manage regulatory risk.
VLO Law Firms advises international clients on ESG and climate law compliance across global jurisdictions. We can assist with regulatory mapping, disclosure readiness, supply chain due diligence frameworks, and cross-border compliance programme design. To request a consultation, contact: info@vlolawfirm.com