Environmental, social, and governance obligations have moved firmly from the world of voluntary corporate responsibility into the domain of hard law. For businesses operating across the US, EU, and beyond, understanding what ESG compliance now legally requires is no longer optional. Whether you run a large multinational corporation or a mid-size company supplying into regulated markets, the practical legal consequences of falling behind on esg reporting, disclosure requirements, and supply chain due diligence are real: financial penalties, restricted market access, and investor pressure that translates directly into the cost of capital. Consulting a qualified corporate lawyer early in the compliance process is increasingly how boards are managing the governance risk that accompanies this shifting regulatory landscape.
This guide covers what ESG and corporate law obligations look like in 2026 across the major jurisdictions, which businesses are in scope, what the key reporting frameworks require, and what a practical compliance strategy looks like for companies navigating this environment.
The Shift from Voluntary to Mandatory: What Changed
For most of the last decade, esg disclosures were largely voluntary. Businesses adopted frameworks like the Global Reporting Initiative or the Carbon Disclosure Project at their own pace and to the degree they chose. That era is now ending. By 2026, the era of voluntary, qualitative sustainability reports is giving way to mandatory, quantified disclosures that must meet audit-ready standards and, in many cases, be verified by third parties with limited assurance or, in future cycles, reasonable assurance.
The drivers are clear. Institutional investors managing trillions in global capital markets have made esg performance a condition of investment rather than a preference. Regulatory frameworks in the EU, California, and an expanding list of jurisdictions have given these investor expectations the force of law. Corporate law is also evolving: fiduciary duties are increasingly being interpreted to include board-level oversight of long-term esg risks, meaning directors can face personal accountability for governance failures around climate risks and sustainability reporting.
The result is a compliance landscape that is complex, jurisdiction-specific, and moving quickly. For multinational corporations managing operations across multiple regulatory environments, the challenge is not just understanding each framework but building governance practices that can satisfy several of them at once.
The EU Framework: CSRD, CS3D, and What They Require
Corporate Sustainability Reporting Directive (CSRD)
The Corporate Sustainability Reporting Directive is the most comprehensive sustainability reporting mandate currently in force for companies operating in or supplying into the EU. Under the European Sustainability Reporting Standards that sit beneath the CSRD, companies must report on both financial materiality, meaning how esg issues affect financial performance, and impact materiality, meaning how their business affects society and the environment. This double materiality requirement goes significantly further than most US frameworks, which focus primarily on investor-facing disclosure.
By 2026, the CSRD’s scope has been recalibrated through the EU’s Omnibus simplification proposals. The thresholds have been raised and timelines adjusted, with the practical effect that approximately 85 to 90 percent fewer companies now face direct mandatory requirements than originally anticipated. However, non-EU parent companies and non-EU companies with significant EU revenue remain in scope, and the extraterritorial reach of these obligations continues to affect US companies, particularly large companies with eu subsidiaries or significant EU operations. The requirement to obtain limited assurance of disclosures, with an eventual move toward audited verification, remains in place.
Corporate Sustainability Due Diligence Directive (CS3D)
The EU Corporate Sustainability Due Diligence Directive requires large firms to conduct human rights and environmental due diligence across their supply chains. Following the Omnibus revision, the first group of companies now has until July 2028 to comply, a one-year delay from the original timeline. Despite this postponement, the direction of travel is clear: businesses will be legally required to map, assess, and address adverse human rights and environmental impacts throughout their entire value chain, not just their own direct operations. The penalty cap has also been revised downward from 5 percent to 3 percent of a company’s net worldwide turnover. As our overview of corporate governance obligations explains, these obligations are increasingly shaping board-level risk management structures across sectors.
For businesses operating globally, the CS3D means that supply chain contracts will need to embed human rights and environmental compliance requirements as legally binding obligations that cascade down through sub-suppliers. This is not a future concern. Companies that supply into EU-regulated businesses are already receiving audit questionnaires and minimum ESG performance requirements from their customers as a direct consequence of these upstream legal obligations.
California’s Climate Laws: Scope and Penalties
California’s SB 253, the Climate Corporate Data Accountability Act, and SB 261, the Climate-Related Financial Risk Act, represent the most significant climate-related disclosure requirements currently in force for companies operating in the United States. Crucially, they apply to both public and private companies based on global revenue thresholds rather than California-specific operations, which makes them far broader in reach than most businesses initially appreciate.
Under SB 253, companies with over $1 billion in global revenue doing business in California must disclose their Scope 1 and Scope 2 greenhouse gas emissions beginning in 2026, with Scope 3 emissions required from 2027. The California Air Resources Board oversees enforcement, with civil penalties for non-compliant companies reaching up to $500,000 per year. Third-party assurance is required, with limited assurance initially and reasonable assurance expected by 2030 for Scope 1 and Scope 2 data.
SB 261 applies to companies with more than $500 million in global revenue. It requires publication of a biennial climate-related financial risk report aligned with ISSB or TCFD standards, starting January 1, 2026. Penalties for non-compliance reach up to $50,000 per reporting year. Together, these two laws are estimated to cover approximately 75 percent of Fortune 1000 companies and around 10,000 businesses in total, making them the most immediately actionable esg compliance obligations for US companies in 2026.
Both laws face ongoing legal challenges questioning California’s authority to impose climate disclosure rules on companies that operate nationally. Despite this, the California Air Resources Board continues its formal rulemaking process and has indicated it will exercise enforcement discretion for companies demonstrating good faith compliance efforts in the first reporting cycle.
Global Reporting Frameworks: ISSB, GRI, TCFD, and SASB
Understanding the reporting frameworks that underpin these legal obligations is essential for building a compliance strategy that works across jurisdictions. The International Sustainability Standards Board, established under the IFRS Foundation, has become the closest thing to a global baseline for sustainability-related financial disclosures. With 17 jurisdictions having adopted or finalized ISSB implementation by 2026 and over 36 moving toward mandatory ISSB-aligned reporting, ISSB alignment is increasingly essential for US companies accessing international capital markets. The Sustainability Accounting Standards Board has been integrated into the ISSB framework, bringing its industry-specific esg metrics across 77 sectors into what is now the standard expectation for US companies reporting to institutional investors.
The Task Force on Climate-related Financial Disclosures framework has been fully incorporated into the ISSB’s IFRS S2 climate disclosure standard. While the TCFD as a standalone body has been disbanded, its four-pillar structure of governance, strategy, risk management, and metrics continues to shape how climate-related financial risk disclosures are structured globally. California’s SB 261 explicitly allows alignment with either ISSB or TCFD standards, making familiarity with both frameworks a practical necessity.
The Global Reporting Initiative remains the world’s most widely adopted sustainability reporting framework, particularly among companies reporting on their broader environmental and social impact beyond pure investor-facing financial disclosure. Its double materiality approach aligns with the CSRD’s requirements and is particularly relevant for companies managing stakeholder expectations alongside regulatory compliance.
What ESG Compliance Requires Inside Your Business
Board-Level Oversight and Governance Structures
ESG compliance has transitioned from a reporting exercise managed by sustainability teams to a board-level governance responsibility. Corporate law is increasingly interpreting fiduciary duties to include oversight of long-term esg risks, which means board directors face direct accountability for governance failures in this area. Establishing a dedicated sustainability committee with clear reporting lines to the board, defined responsibilities for esg data collection and verification, and integration of esg considerations into core business planning is now a baseline expectation rather than a leading practice.
Audit-Ready Data and Third-Party Verification
ESG data must now meet audit-ready standards. This means building internal controls around how emissions data, social performance metrics, and governance disclosures are collected, reviewed, and signed off. The shift from qualitative narrative reporting to quantitative data verified with limited assurance under multiple regulatory frameworks requires investment in data management systems, clear audit trails, and in many cases the appointment of third-party assurance providers. Companies that have been preparing their esg data infrastructure for the last two years are significantly better positioned than those treating compliance as a documentation exercise.
Supply Chain Due Diligence
Regulations are shifting focus from a company’s own operations to its entire value chain. The CS3D, the EU Deforestation Regulation, and California’s Scope 3 emissions requirements all push obligations upstream and downstream into supply chains. As we cover in our article on corporate legal services for businesses, this supply chain dimension of ESG compliance requires a structured approach to supplier engagement, contractual due diligence obligations, and verification mechanisms that many businesses are still building out.
In practice, this means updating supplier contracts to include explicit esg compliance obligations, establishing audit and reporting requirements for key suppliers, and building systems for traceability across commodity supply chains. The EU Deforestation Regulation, which requires plot-level origin data for specific commodities to verify they are deforestation-free, is one of the most technically demanding examples of this trend.
The US Regulatory Picture: Federal Uncertainty, State Momentum
The federal ESG regulatory landscape in the United States remains in significant flux. The SEC’s landmark climate disclosure rules, adopted in March 2024, are currently stayed pending litigation. In March 2025, the SEC voted to end its defense of those rules in court, signaling a substantial policy shift under the current administration. The practical consequence is that, for now, there is no federal mandate compelling most US companies to make climate-related financial disclosures.
However, state-level momentum is moving in the opposite direction. California’s laws are the most immediate and consequential, but New York, Washington, Illinois, and Minnesota are all advancing similar esg legislation. The fragmented nature of US regulatory requirements creates a compliance challenge for in scope companies that must track obligations across multiple state frameworks while managing uncertainty at the federal level. Non-EU companies with EU operations face an additional layer of obligations under the CSRD and CS3D that operate independently of whatever the SEC ultimately does or does not require.
For asset managers and financial institutions, the picture is further complicated by the political attention that ESG investing continues to attract at both the state and federal level, with anti-ESG legislation in some states creating direct conflicts with the compliance obligations imposed by other jurisdictions. Managing this contradiction requires legal counsel experienced in both corporate governance and the evolving regulatory framework across multiple markets.
Managing ESG Compliance as a Corporate Governance Priority
The legal obligations around ESG compliance in 2026 are substantial, jurisdiction-specific, and continuing to evolve. For multinational corporations managing operations in multiple markets, the challenge is building governance structures, data systems, and contractual frameworks that satisfy overlapping mandatory requirements without creating operational bottlenecks or unnecessary compliance risk.
Leaders in Law connects businesses with qualified corporate lawyers experienced in ESG regulatory requirements across the EU, US, and international markets. Whether you are navigating CSRD obligations, preparing for California’s climate disclosure requirements, or building supply chain due diligence frameworks, our network includes the specialist legal expertise your compliance strategy requires.
Frequently Asked Questions
Are ESG disclosures mandatory for US companies in 2026?
It depends on the company’s size, where it operates, and its exposure to international capital markets. California’s SB 253 and SB 261 impose mandatory climate disclosure requirements on companies above specified global revenue thresholds doing business in California, regardless of where they are headquartered. Federal SEC rules remain stayed pending litigation. Companies with EU operations or significant EU revenue may also fall within scope of the CSRD and CS3D. The practical reality for most large companies is that mandatory esg disclosures apply through at least one of these frameworks.
What is the difference between CSRD and CS3D?
The Corporate Sustainability Reporting Directive governs what companies must disclose about their ESG performance, covering both how ESG issues affect financial performance and how the company impacts society and the environment. The Corporate Sustainability Due Diligence Directive governs what companies must do, requiring active human rights and environmental due diligence across supply chains. CSRD is a reporting obligation. CS3D is an operational and governance obligation. Both apply to large companies with substantial EU operations or revenue.
What are the penalties for non-compliance with California’s climate laws?
Under SB 253, companies that fail to disclose greenhouse gas emissions as required can face civil penalties of up to $500,000 per year. Under SB 261, companies that fail to publish their climate-related financial risk report face penalties of up to $50,000 per reporting year. Both laws apply to public and private companies based on global revenue thresholds.
What is the ISSB and why does it matter?
The International Sustainability Standards Board, established under the IFRS Foundation, has developed a global baseline for sustainability-related financial disclosures. With 17 jurisdictions having adopted or finalised ISSB implementation by 2026 and over 36 jurisdictions moving toward mandatory alignment, ISSB-aligned reporting has become a practical requirement for US companies accessing international capital markets. The ISSB framework incorporates both the Sustainability Accounting Standards Board’s sector-specific metrics and the TCFD’s climate disclosure structure.
Which companies are in scope for the EU’s CSRD?
Following the Omnibus simplification, CSRD scope has been significantly narrowed. The revised thresholds focus on large companies meeting specific employee count and revenue criteria. Non-EU parent companies with EU subsidiaries or significant EU revenue remain in scope. Many non-EU listed small and medium enterprises also face obligations under the European Sustainability Reporting Standards. Companies should confirm their precise obligations with qualified legal counsel, as the thresholds and timelines have changed from the original CSRD text.
How should a board approach ESG governance in 2026?
Corporate law is increasingly interpreting fiduciary duties to include oversight of long-term ESG risks, making board directors directly accountable for governance failures in this area. Best practice in 2026 includes establishing a dedicated sustainability committee with board-level reporting, integrating esg considerations into core business planning rather than treating them as a separate CSR function, ensuring audit-ready data infrastructure is in place, and assigning executive-level accountability for compliance with jurisdiction-specific obligations. Greenwashing risk should also be treated as a governance matter, as regulatory and litigation activity targeting overstated ESG claims is increasing across the EU, UK, and US.
What does limited assurance mean in ESG reporting?
Limited assurance is a standard of third-party verification that provides a moderate level of confidence that ESG disclosures are free from material misstatement. It is less demanding than reasonable assurance, which involves more extensive testing and is the standard used in financial audits. Many mandatory ESG frameworks, including California’s SB 253 and the CSRD, begin with limited assurance requirements and transition toward reasonable assurance over time. Businesses should be building their internal data controls and audit trail infrastructure to support these requirements now.
