ESG Ratings Explained: Why You Often Don't Get to Choose

The ESG Ratings Landscape in 2026: More Schemes, More Requests, Less Choice

A customer asks for an EcoVadis scorecard. An investor's portfolio review pulls your Sustainalytics score. A bank refinancing your credit line wants to see MSCI. None of these requests started with you. For most companies in 2026, that is the actual experience of ESG ratings. Not a strategic choice about which scheme best reflects your performance, but an inbox full of asks from people who chose the rating for you.

But that is not the whole picture. Some companies proactively go after a rating on purpose. They pursue EcoVadis Gold instead of waiting for a customer to request it, or opt into CDP disclosure a year before an investor asks, because getting ahead of the request beats waiting for it. Ambition explains a handful of the ratings on a company's plate. Inbound requests explain most of the rest.

An ESG rating is a third party's scored assessment of how a company manages environmental, social, and governance risks and impacts, built from disclosures, questionnaires, and public data. An ESG score is the output a specific rating produces: EcoVadis's medal, MSCI's letter grade, CDP's A to D scale. The rating is the process; the score is the result. Neither is the same as the ESG criteria or targets a company sets for itself, which is its own topic.

Most companies pulled into this system encounter a handful of names repeatedly: EcoVadis, CDP, MSCI ESG Ratings, Sustainalytics, and S&P Global's Corporate Sustainability Assessment. A smaller group also runs into sector-specific schemes, such as the World Benchmarking Alliance. Which of these show up on your desk depends less on your industry and more on who is asking. That distinction is worth making early: it decides how much control you actually have over which rating you need to answer.

Why ESG Ratings Suddenly Carry Operational Weight

A weak ESG rating rarely stays a sustainability problem for long. It sits inside what we at Sunhat call Market and Customer Compliance: the ratings, questionnaires, and due-diligence requests that customers and investors use to decide who stays on the shortlist. Miss the bar here and the consequence is not a lower number on an internal scorecard. It is a blocked RFP, a due-diligence flag on an investor's checklist, or a financing conversation that gets harder before it gets easier.

That is why the reader with a stake in this is rarely the sustainability team alone. A weak or late rating response reaches procurement, sales, and finance the same week it lands on a compliance desk. The business outcome at stake is revenue protected and the right to keep selling, not a checkbox. Executives who fund proof work across a company care less about which scheme is asked. They care about what happens to the deal, the loan, or the index inclusion if the answer is late or wrong.

{{cta-cs}}

The EU Now Regulates the Raters

Since 2 July 2026, ESG rating providers operating in the EU have been subject to Regulation (EU) 2024/3005, the EU's ESG Ratings Regulation. It is aimed squarely at the providers, not at the companies they rate. Article 1 describes its purpose as strengthening the integrity, transparency, and independence of ESG rating activities, and Article 2 confirms the obligations apply to ESG rating providers operating in the Union. Providers now need authorization from the European Securities and Markets Authority and must disclose their methodologies. They are also restricted from combining rating activities with services like consulting or credit ratings that could create a conflict of interest.

For the company being rated, the regulation hands over one concrete right rather than a seat at the table. Under Recital 12, you can request the dataset a provider used to produce your rating, so you can check the inputs are accurate. What you cannot do is use that access to argue your way to a better score. The regulation is explicit: a rated company should not be able to influence the methodology or the outcome in any way. That distinction matters. It means more transparency into how a score was built, not more leverage over what the score says.

This is also why the fragmented landscape described above is unlikely to simplify soon. A regulation that makes providers more accountable is not the same as a regulation that reduces how many of them you deal with. More disclosed, comparable methodologies make it easier for a customer or investor to justify asking for a specific scheme by name, which points toward more targeted requests, not fewer. For what this regulation means specifically for EcoVadis assessments, we have covered that in more depth separately.

The Rating Map: Who Asks for What

The fastest way to make sense of the landscape is to sort schemes by who is asking. That single distinction decides urgency, format, and how much say you have. Two broad groups cover most of what lands on a sustainability or compliance team's desk: schemes driven by customers and supply chains, and schemes driven by investors and lenders.

Each of these has a methodology worth understanding in depth once you know it applies to you. We have broken down what changed in MSCI's 2026 methodology update and how CDP scoring works. For EcoVadis specifically, our current coverage lives here.

Why Ratings Disagree with Each Other

A company can score well with one rating agency and poorly with another in the same year, for identical underlying performance. This is not a secret and not a Sunhat talking point. Researchers and industry bodies have documented for years that ESG rating agencies frequently disagree with each other about the same company, because each one weighs different indicators, sources different data, and defines materiality differently. The World Business Council for Sustainable Development has written directly about this tension, framing the honest question as whether ratings genuinely signal performance or simply reflect what each agency chooses to measure.

That disagreement is a reason to treat any single score with some skepticism. It is not a reason to stop responding to the ones you are asked for. A customer running supplier due diligence through EcoVadis does not care that MSCI would frame your risk differently; they care about your EcoVadis score. Each rating is real for the audience that requested it, even if none of them alone is a complete picture of your performance.

The Real Problem: You Get Asked for Several, Whether You Chose the First One or Not

The operational problem is rarely a single rating. It is the volume. Many companies working with Sunhat are already answering two or more schemes in the same year: an EcoVadis assessment for one customer, and an MSCI or Sustainalytics footprint tracked by an investor. Layer on supplier self-assessment questionnaires such as Sedex's SAQ, Drive's SAQ, or a customer's own portal, and the picture gets more crowded still. These are not technically ESG ratings, but they ask for the same underlying data: policies, certifications, emissions figures, supplier lists.

None of this happens on its own timeline either. The same team is often mid-cycle on mandatory reporting, a CSRD disclosure or a PPWR packaging data pull, each with its own deadline and its own portal. A team fielding an EcoVadis renewal, a Sustainalytics update, and three customer questionnaires in the same quarter is not solving one problem four times. It is one evidence problem, badly reused.

Some of this can be handed off entirely. Sunhat's Proof Services delivers the finished response end to end. We help with the retrieval, drafting, and quality checks, tuned to each scheme's methodology. Your team still sees and signs off on what goes out under the company's name, the same way you would with any submission you own.

How to Handle It Without Starting from Zero Each Time

You already have most of the evidence a new rating asks for. It is scattered across old submissions, policies, and disclosures rather than missing. Building one central Proof Library, tuned to whatever a new scheme asks for rather than rebuilt from scratch each time, turns scatter into speed and unlocks an answer in hours, not weeks. That is what actually solves the problem as the number of schemes keeps growing faster than any team can specialize in each one. This is what makes it possible to treat a new questionnaire as a matching exercise, not a project.

The same evidence typically stretches further than ratings. The disclosures a company already prepares for CSRD and ESRS reporting frequently answer the same underlying questions a rating questionnaire asks, just organized differently. A packaging composition record built for PPWR compliance can resurface just as easily in a customer's supply chain due diligence request or a CDP supply chain module. A company that knows where its evidence lives answers the second request in hours, not weeks.

None of this removes the judgment call at the center of every rating response. Someone still decides what evidence answers a question and signs off on it. Reusing one evidence base helps you answer whichever scheme is asking next, and shows exactly which document answers which question.

What This Means Going into 2027

As of August 2026, nothing points toward the ratings landscape consolidating. If anything, a more regulated and more transparent set of providers gives customers and investors more confidence to keep requesting the specific scheme that matters to them, rather than accepting a generic substitute. The realistic planning assumption for 2027 is the same one that applies today: more schemes will ask, not fewer. The companies handling this well are the ones that stopped treating each request as a one-off project.

Want to learn more about Sunhat's Proof solutions for your ESG reporting? Reach out to us!