Sign in Subscribe
Five Frontiers of Impact

From “Track It” to “Prove It”.

ESG regulations are shifting demand from “reporting” to “evidence”. For companies, increasingly, the challenge will be whether they can produce the underlying evidence for a specific product, facility, supplier, shipment or claim when asked.

Nachiketa Das

Nachiketa Das

— 13 min read
Share

The Simplification Paradox

Over the course of 2025 and 2026, the dominant narrative in ESG regulation has been that of simplification.

In December 2025, the European Financial Reporting Advisory Group (EFRAG) submitted its technical advice to the European Commission proposing a 61% reduction in mandatory European Sustainability Reporting Standards (ESRS) datapoints. With voluntary disclosures removed entirely, the total reduction exceeds 70%. In March 2025, the Securities and Exchange Board of India (SEBI) scaled back the mandatory BRSR Core value chain disclosures applicable to top 250 listed entities to voluntary, replaced "assurance" requirement with a more flexible "voluntary assurance or assessment" framework, and pushed the third-party verification timeline to FY2026-27. Similarly, the International Sustainability Standards Board (ISSB) has extended implementation reliefs including exclusion of S1 disclosures, comparable information and Scope 3 reporting in the first year across multiple jurisdictions.

This simplification has been explained as necessary for accelerating the adoption of these regulatory ESG disclosures by companies across respective regions. The paradox sits in what is happening at the same time.

A parallel set of regulations is demanding something categorically harder than disclosure. It is demanding proof. Proof at the level of the product. Proof at the level of the supplier. Proof at the level of the individual claim. Proof that can stand the scrutiny of a customs review, an external audit, or a court. And these demands are arriving from Washington, Brussels, New Delhi, Canberra and London. They span climate, trade, nature, packaging and labour. They are not coordinated. But they share one design principle: documented and verifiable evidence.

Reporting less under greater scrutiny is not a lighter burden. When fewer data points must be disclosed, each one carries more weight. The quality of judgement, methodology and controls around what remains become critical.

As I look at this evolving regulatory landscape, I see five frontiers across which companies will face impact. And each one demands a different kind of evidence from a different part of the business.

The Five Frontiers

For companies having to comply with increasingly granular data demands on sustainability issues; the impact sits across five frontiers, each requiring a different evidence trail.

Article content
The five frontiers of regulatory demands from companies on sustainability issues

Let's dive in.

Frontier 1 - Corporate: Can you prove what you report?

Regulators across countries have established their demand for ESG disclosure. ESRS, BRSR, ISSB IFRS S1 & S2 and its regional versions, SB 253 & SB 261, Federal Decree-Law No.11. While not an exhaustive list, this is the traditional universe of mandated ESG disclosures. For companies, especially ones with global operations and/or value chains, the question has always been: what must be disclosed? While the recent wave of simplification is helping narrow this answer; a harder question is being asked.

Can you substantiate what you disclose?

The ESRS Omnibus did not eliminate disclosure obligations. It narrowed them, concentrated them around material issues, and placed greater reliance on company judgement to define materiality. Where the standard previously prescribed the datapoints, the revised framework asks companies to determine what is relevant.

That judgement must be documented, defensible, and capable of surviving external review. An auditor examining a smaller set of disclosures examines each one more closely, not less.

SEBI's BRSR adjustment is the clearest illustration of the simplification paradox. Value chain disclosures are now voluntary, and assessment is permitted alongside assurance. But the obligation to maintain credible, third-party-supported data behind material BRSR Core disclosures has not moved. Companies choosing assessment over assurance are accepting a lighter process, while remaining exposed if the methodology behind their numbers cannot be traced and defended.

Singapore’s SGX RegCo. Malaysia's National Sustainability Reporting Framework. Indonesia’s PSPK 1 & 2. Sri Lanka’s SLFRS S1 & S2. Australia’s AASB S1 & S2. ISSB adoption is following the same playbook across Asia-Pacific: phased roll-out, transitionary exemptions in year one, complete adoption from year two onwards, followed by third-party assurance mandate.

The evidence standard is converging. While the jurisdiction differs, the demand is the same. From a company perspective, having to disclose fewer datapoints under greater scrutiny is a harder challenge.

Frontier 2 - Product: What is embedded in your product?

This is where the "prove it" imperative becomes structurally different.

The EU Carbon Border Adjustment Mechanism (CBAM) entered its definitive compliance phase on 1 January 2026. Where CBAM structurally shifts away from traditional annual GHG emissions reporting is its requirement for establishing the embedded carbon in a specific tonne of steel, aluminium, cement, fertiliser, or electricity. That is a different question. It requires different data, and a different data infrastructure to produce.

A corporate GHG inventory aggregates emissions across the organisation and produces a number for an annual report. CBAM works in the opposite direction. It requires emissions data at the facility level, the process level, and the product level, for specific consignments crossing into the EU. The ESG report asks what a company emits. CBAM asks what emissions are embedded in a specific transaction and how was that number derived.

Where companies cannot produce verified actual emissions, the default values apply. Under Commission Implementing Regulation (EU) 2025/2621, the default values are set at the 90th percentile of observed sectoral data, with a mandatory markup of 10% above the country-sector average in 2026. This rises to 20% in 2027, and 30% from 2028 onward. The longer a company defers building verified data, the wider the gap between what it pays and what a verified submission would have cost. And that gap compounds with every passing compliance year.

In the UK, the Finance Act 2026, establishes a UK Carbon Border Adjustment Mechanism effective from 1 January 2027. This covers aluminium, cement, fertiliser, hydrogen, and iron and steel imports; and carries the same embedded-carbon verification requirements as importers into the EU. For exporters serving both markets, the implication is a dual CBAM obligation across two separate regulatory regimes.

India is creating the same demand domestically. The Carbon Credit Trading Scheme (CCTS), established under the Energy Conservation (Amendment) Act, 2022, has introduced legally binding emission intensity reduction targets for nine hard-to-abate sectors: aluminium, cement, chlor-alkali, fertilisers, iron and steel, petrochemicals, pulp and paper, refineries, and textiles. As of August 2026, approx. 745 entities are covered under the scheme across three phases of notification. CCTS requires gate-to-gate, facility-level greenhouse gas emission intensity per unit of production, verified by a Bureau of Energy Efficiency (BEE)-accredited third-party agency and reported across standardized forms covering production output, energy consumption, and process emissions.

For Indian exporters the convergence is immediate. An Indian steel company serving EU and the UK markets now faces three independently motivated, but structurally identical, demands. CCTS requires verified emission intensity per tonne for India's BEE. CBAM requires verified embedded carbon per consignment for EU and UK customs. Different regulators, different jurisdictions, different instruments. The same underlying data architecture. A company that builds its evidence infrastructure for one is substantially positioned for the other. A company that does not, fails on all three.

This product-level demand extends beyond just carbon. Regulation (EU) 2024/1781, the EU's Ecodesign for Sustainable Products Regulation (ESPR), establishes a framework for product-specific eco-design requirements covering energy use, repairability, durability, and material content. Adopted in April 2025, the first Working Plan, covering period from 2025 to 2030, established the sequence of delegated acts across priority product groups, including textiles and apparel, electronics, and furniture. Implemented basis a Digital Product Passport, this requires manufacturers and importers bringing products into the EU to establish machine-readable data records capturing a product's sustainability attributes across its life cycle. This needs product-level verifiable data, not assertions.

These regulations make one thing clear:

ESG data is no longer only moving upward into an annual report. It is moving sideways, into products, transactions, contracts, and customs processes. A company can have an excellent, externally assured sustainability report and simultaneously face significant CBAM cost exposure and CCTS non-compliance because its emissions data was never built for facility-level, production-normalized attribution.

This is an evidence problem, and it requires an evidence architecture.

Frontier 3 - Origin: Where did it come from?

A third category of proof that is emerging, backed by Regulation (EU) 2023/1115, the EU Deforestation Regulation, is one that questions the origin of the product.

Operators and traders placing cocoa, coffee, palm oil, soy, rubber, cattle products, and wood on the EU market must prove those goods are deforestation-free. Establishing this requires geolocation coordinates for every plot of land where the commodity was produced, mapped against satellite data, submitted as valid Due Diligence Statements through the EU's information system. This evidence chain flows all the way from the EU retailer shelf to the farm in Asia where the commodity was grown. Given the complexities involved in establishing such traceability, enforcement has already been deferred once to enable simplification and smooth transition. Going forward, large and medium operators face enforcement from 30 December 2026. Micro and small operators start 30 June 2027. Non-compliance carries fines of up to 4% of annual EU turnover, product confiscation, and market exclusion.

This is multi-tier traceability applied to nature risk. Supplier engagement programs, deforestation policy statements, and sourcing commitments do not constitute verifiable data and compliance. The regulation asks for proof of origin, traceable to GPS coordinates.

Frontier 4 - Conduct: Can you prove your supply chain meets required conditions?

On human rights issues, regulators are applying a different principle. Rather than requiring companies to prove that their supply chains are clean, it is assumed that they are not.

Under the rebuttal presumption of the Uyghur Forced Labor Prevention Act (Public Law 117-78); goods produced wholly or in part in Xinjiang, or by entities on the UFLPA Entity List, are presumed to have been made with forced labour. Importers into the US must rebut that presumption with affirmative, clear and convincing evidence. As of August 2026, the UFLPA Entity List stood at 187 entities. According to the US Customs and Border Protection's enforcement statistics, over 43,700 shipments have been reviewed between June 2022 and July 2026 (representing over USD 4.12 billion in goods). The denial rate for those unable to meet the evidentiary standard stood above 60% of shipments reviewed. Rebutting the presumption requires origin documentation, chain-of-custody records, and supplier and facility-level evidence, all held to a standard that US CBP official can review and accept.

Similarly, Regulation (EU) 2024/3015, the EU Forced Labour Regulation (enforcement starts 14 December 2027) prohibits placing on, or making available in, the EU market any goods made with forced labour, whether produced inside or outside the EU. Unlike a disclosure regime, this is a market ban. There are no size thresholds and no sector exemptions. The regulation empowers EU investigative authorities to conduct proactive assessments of supply chains in geographic areas and sectors with elevated forced labour risk. Companies found in breach face withdrawal of goods from the market, destruction, donation, or export prohibition.

Conduct standards across jurisdictions are moving from aspirational to enforceable and supplier self-declarations are not sufficient under these regulations. Only documented evidence and traceable audit trail counts.

Frontier 5 - Claims: Can you substantiate what you say?

This frontier applies when a company makes a public sustainability statement. Low carbon. Sustainable. Recyclable. Net-zero aligned. Deforestation-free. Responsibly sourced. No forced labour. Regulators across multiple jurisdictions are now asking one question about each of those claims.

What evidence supports the claim made by the company?

Directive (EU) 2024/825, the Empowering Consumers for the Green Transition (EmpCo) Directive, applies across all EU member states from 27 September 2026. it bans generic environmental claims such as, "eco-friendly", "sustainable", "natural", unless supported by verified evidence. Self-certified sustainability labels are restricted.

In the UK, effective April 2025, the Digital Markets, Competition and Consumers Act 2024, grants the Competition and Markets Authority powers to levy fines of up to 10% of a company's worldwide annual turnover or £300,000 for misleading environmental claims (whichever is greater). The Economic Crime and Corporate Transparency Act 2023, starting 1 September 2025, makes failure to prevent fraud (including making false sustainability representations for commercial advantage) a corporate criminal offence for large organizations.

Similarly, India has rolled out its Guidelines for Prevention and Regulation of Greenwashing and Misleading Environmental Claims, 2024, which requires all environmental claims to be substantiated based on statutorily certified and verifiable information. Under Section 18 of the Consumer Protection Act, 2019, penalties can be levied up to INR 10 lakh for a first offence, with higher penalties for repeated or particularly harmful claims.

EU Regulation (EU) 2025/40, the Packaging and Packaging Waste Regulation, adds a materials dimension to the claim frontier. Effective 12 August 2026, food-contact packaging on the EU market must demonstrate PFAS compliance through independent laboratory data and traceable technical documentation. From 2030, all packaging must contain minimum post-consumer recycled content, traced from waste source through the recycling process to the finished packaging for every SKU placed on the market. A recycled label without that trace is a violation.

India's plastic waste EPR system demonstrates what happens when tracking exists without verification. CPCB's findings, cited before the National Green Tribunal in July 2024 and documented by the Centre for Science and Environment in October 2024, identified approximately 700,000 fraudulently generated EPR certificates. A regime built on self-reported data without independent verification generated fraudulent claims at industrial scale. The Plastic Waste Management (Amendment) Rules 2026 now require independent verification by Registered Environment Auditors, digital audit trails, and GST cross-linkage for automated detection.

The key learning: a system built on tracking and self-reporting without a verification architecture is not compliance. It is a claim without evidence that may very well be found lacking.

Globally, the enforcement of evidence-backed claims is already building. And companies are being made to pay.

Australia's Federal Court, following proceedings by the Australian Securities and Investments Commission, ordered Mercer Superannuation to pay AUD 11.3 million in August 2024 false representations about ESG exclusions in its Sustainable Plus products. Active Super paid AUD 10.5 million in 2025 for misrepresenting the exclusion of fossil fuels, gambling, and Russian investments from its sustainable options. Australia's competition regulator, the ACCC, penalized Clorox Australia AUD 8.25 million for false ocean-plastic claims on packaging. In the United States, the Securities and Exchange Commission (SEC) imposed a USD 25 million civil penalty on DWS for materially misstating how ESG factors were integrated into its investment process amongst other things. In Germany, Apple was ordered to stop claiming carbon neutrality for certain models of its Apple Watch for inadequate offset mechanism.

The pattern is consistent across jurisdictions. The first enforcement action sets the evidentiary standard which companies are expected to uphold. Subsequent cases arrive faster once this is established. The EmpCo Directive’s enforcement window opens 27 September 2026, and the first EU judgement under it will define what verifiable evidence looks like for an environmental claim in the EU.

What makes the fifth frontier also the most structurally significant is that the same underlying evidence infrastructure supports ESG reporting, product compliance, market access, marketing claims, sustainable finance, and regulatory defence. A single gap anywhere in the system creates exposure across all of them.

The Real Shift

Traditional ESG infrastructure was designed for reporting standards and was built around the corporate entity. Data moved upward through business units into group aggregates, and into an annual report. The new regulatory architecture is breaking that model apart. Companies now need evidence at the level of the facility, the product, the consignment, the supplier, the farm, and the individual claim.

A company with an excellent, assured sustainability report may still be unprepared for every one of these demands. Regulations now require data to move sideways into transactions, contracts, customs declarations, and product specifications.

That is not a reporting upgrade. It is an operational one. And it requires a different degree of maturity.

Five Stages of ESG Maturity

The transition from tracking to proving follows a pattern.

  • Stage 1 - Claim: Some commitments exist, key targets are published and sourcing policies are drawn up. So far, the intent precedes the infrastructure to support it.
  • Stage 2 - Track: Measurement systems are in place, the GHG inventory is done, supplier questionnaires are sent, and ESG data is aggregated and reported annually. By now organisations can report, but cannot yet prove, all information. Most medium-sized companies sit here.
  • Stage 3 – Evidence & Controls: Data collection across the organisation is redesigned for audit-readiness. Source data is retained, not just outputs. Methodologies are documented and applied consistently. Ownership of each datapoint is assigned and the evidence trails run from metric to source. This is where companies build controls.
  • Stage 4 - Assure: An independent party reviews the control environment, tests the underlying data, and forms an opinion. The company can now produce something investors, regulators, and counterparties can rely on. Most large companies are here, but only from a corporate reporting perspective.
  • Stage 5 - Decide: This is where the company-, asset-, product-, supply-chain-level evidence infrastructure becomes a decision asset. A company with verified facility-level emissions data knows which assets carry the highest marginal abatement cost. A company with CCTS-compliant MRV infrastructure is positioned for CBAM without rebuilding from scratch. A company with EUDR-compliant supply chain traceability has a real-time view of nature risk that competitors relying on supplier declarations do not. Stage 5 is where compliance expenditure starts delivering returns.

The transition between the stages is not a sustainability team’s individual challenge. Moving from Stage 2 to Stage 3 requires a “controls” build that typically sits inside finance and operations. Finance owns the data governance that makes evidence audit-ready. Operations or Procurement owns the supply chain architecture that produces the origin and conduct proof. Legal or Secretarial owns the claims substantiation framework that keeps communications defensible. Sustainability or ESG is the bridge between them all. Companies that see this merely as a sustainability project are setting themselves up for failure. This is an enterprise risk exercise.

Conclusion

The simplification of ESG disclosure in 2025 and 2026 is real. It is also beside the point.

The unit of analysis in ESG regulation has changed. Where reporting frameworks asked about the company, the new generation of regulations asks about the product, the shipment, the supplier, the claim, the transaction.

The challenge going forward is not producing a better sustainability report. It is building an evidence system that can answer different questions, at different levels of the business, from a single traceable foundation.

Such a system does not yet exist in most organizations. And the regulations demanding it are not waiting.

References

Read more