ESG Reporting: Build Your Proof for CSRD, VSME, EcoVadis, CDP and Every Request in Between

What Is ESG Reporting and Why Does It Matter?

ESG reporting is a stream of questions from regulators, customers, rating platforms, banks and investors, each asking for environmental, social and governance information in its own format. The companies that cope best treat those questions as one job. They build the proof once and reuse it for every answer.

The terms overlap, which causes confusion. Sustainability reporting is the older, broader label for disclosing a company's environmental and social impact. ESG reporting frames the same content around what investors and business partners use to judge risk. CSRD reporting is the legal obligation under the EU Corporate Sustainability Reporting Directive, and it is only one part of the picture rather than the whole of it.

That shift matters because the regulatory driver shrank while the commercial one grew. The Omnibus I package cut the number of companies in CSRD scope sharply, but the questions from customers and ratings did not stop. For most small and mid-sized companies, the reason to report is now a customer, a tender or a rating, not a law.

Prof. Maximilian Müller teaches accounting and reporting at the University of Cologne and is Co-Founder of the Sustainability Reporting Navigator. On our Talking Proof podcast, he put the stakes plainly: "Reporting should not be a document you upload to the website and then carry on as before." Reporting earns its effort when it steers the business and answers the people who ask.

Who Asks for ESG Data, and What Each One Wants

Seven groups ask for ESG data, and each one wants something slightly different. The content overlaps far more than the formats do, which is why the same team ends up answering the same question many times. The table below shows who asks, what they want and what happens when no answer arrives.

The two kinds of ESG ratings work differently. Supplier ratings like EcoVadis and CDP rely on what you submit, so your evidence decides the score. Investor ratings like MSCI or Sustainalytics mostly assess listed companies from public information, so the quality of what you publish shapes the result. Since July 2026, the EU regulates ESG rating providers more closely.

What we hear from our customers: We spoke with sustainability, quality and compliance teams in more than 380 conversations between July and November 2026. One complaint came up again and again: every customer asks the same questions in a different format. Multiple companies told us that in some instances nobody inside the company even knows how many questionnaires arrive each year, because they land with sales, quality and legal as well as sustainability.

Must Report, Gets Asked, Chooses to: Where Your Company Stands

Every company now sits in one of three groups. Some must report under a law, such as the CSRD in the EU or ISSB-based rules in a growing number of other jurisdictions. Many more get asked by customers, ratings and banks without a legal duty. Others choose to report because it wins business or financing. Knowing your group tells you which rules apply and what evidence to prepare first.

Which Laws Require ESG Reporting

The CSRD is the best-known reporting law, but it is not the only one. These are the rules that create a legal duty to disclose ESG information for most international companies today:

• CSRD (EU): companies with more than 1,000 employees and more than 450 million euro net turnover. First reports under the revised rules cover financial year 2027.
• EU Taxonomy (EU): companies in CSRD scope disclose which share of their turnover, capital and operating expenditure counts as environmentally sustainable, inside the sustainability statement. Simplified templates apply from FY2026: about 64% fewer data points for non-financial companies, and activities below 10% of turnover, capital or operating expenditure need no alignment assessment.
• CSDDD (EU): the due diligence directive now covers companies with more than 5,000 employees and more than 1.5 billion euro net turnover. Companies must comply from 26.07.2029, and the first reports cover financial years starting on or after 01.01.2030.
• ISSB-based rules (global): 28 jurisdictions had adopted the ISSB standards by April 2026, and 12 more planned to.
• California SB 253 (US): US companies with more than 1 billion dollars in annual revenue that do business in California report Scope 1 and 2 emissions. The first reports were due 10.11.2026. The related climate risk law SB 261 is on hold pending appeal. California's Office of Administrative Law approved CARB's initial regulation on 12.10.2026, which confirms the deadline.

What Changed in 2026, and What It Means for ESG Reporting

The Omnibus I Directive, Directive (EU) 2026/470, entered into force on 18.03.2026 and raised the CSRD thresholds. Two delegated regulations adopted on 03.07.2026 followed: a revised, slimmer ESRS and an EU voluntary standard that replaces the VSME recommendation. Both were published in the Official Journal on 21.09.2026. The voluntary standard has been available since 24.09.2026, and the revised ESRS entered into force on 10.11.2026. Together, they change ESG reporting in four ways.

• Reporting moves from mandated to requested. Far fewer companies must publish a CSRD statement, but customers, ratings and banks keep asking. ESG data has to be ready on demand all year, not once at year end.
• The voluntary standard becomes the common language of supply chain data. CSRD companies cannot demand more than the voluntary standard from partners with up to 1,000 employees. That value chain cap makes the standard the default format for supplier data, while rating and bank requests stay outside it. EFRAG released an updated digital template for it in November 2026.
• Leaner ESRS raise the bar on focus. The revised standards cut mandatory disclosures and allow a simpler double materiality assessment from financial year 2027. Fewer data points mean every remaining figure gets more attention from auditors and readers.
• Assurance stays limited, but evidence still counts. The planned move to reasonable assurance is gone, and limited assurance standards are due by 01.07.2027. Auditors and customers still expect a trail from every figure back to its source.

The details per wave and per company type live in our CSRD Knowledge Hub, the ESRS Knowledge Hub and our Omnibus overview.

Out of Scope Does Not Mean Out of Questions

Some companies do stop. A few companies in our recent conversations told us that falling out of CSRD scope removed their main reason to report, and they paused the ESG work. Others described the opposite: the mandate went away, and the customer requests kept coming, now passed down the supply chain by larger customers with their own duties.

The deciding question is not whether a law applies. It is who will ask you for ESG data in the next twelve months, and what happens to the business if you cannot answer. If the honest answer is "nobody important," pausing might seem a legitimate choice. If customers, ratings or lenders are on that list, the work continues, only with a different scope.

ESG Reporting Frameworks at a Glance

These are the frameworks, standards and ratings companies get asked about most often. The list is not exhaustive, since sector initiatives and national codes add more, but it covers the bulk of the requests we see. They differ in legal status and audience, yet they draw on the same underlying evidence: energy and emissions data, workforce figures, policies and governance documents. Each row links to a deeper guide where we have one.

Two practical consequences follow. First, a supplier answering EcoVadis, CDP and voluntary standard requests already holds most of the evidence a CSRD report would need. Second, the frameworks reward the same thing: documented policies, measured results and a clear owner for each figure. Choosing a framework matters less than building a proof layer that serves all of them, and that turns a pile of separate requests into one job.

What Goes into an ESG Report

An ESG report answers four questions in a fixed order: who you are, what matters, what you do about it and how you measure progress. The depth changes by framework, but the anatomy stays the same. That shared anatomy is what makes evidence reusable.

• Basis for preparation and business model: company, scope of consolidation, sites and value chain.
• Materiality: which sustainability topics matter for the company and its stakeholders, and why.
• Policies: written commitments on climate, environment, workforce, human rights and business conduct.
• Actions: what the company does to implement those policies.
• Targets: what it wants to achieve, by when, against which baseline.
• Metrics: energy, emissions, water, waste, workforce, health and safety, and governance figures.
• Governance: who is responsible, and how the board oversees sustainability.

The voluntary standard's Basic Module covers this anatomy at entry level, with core metrics and a short description of practices. The ESRS cover it in full depth, with double materiality and many more data points. Focus beats completeness at every level. Not everything is equally important.

Targets deserve special attention, because they are what customers and banks check over time.

From Data to Proof: What Makes ESG Information Hold Up

ESG data becomes proof when anyone can trace it back. Every figure needs a source document, an owner who produced it, an approval from someone accountable and a version that shows when it was valid. Without those four, a number is a claim. With them, it holds up with an auditor, a rating analyst or a customer's procurement team.

This is where most companies lose time and points. Many companies in our recent conversations described ESG assessments that still run on chasing data across departments by spreadsheet and meetings. Another dozen and more described losing rating points on formalities rather than substance: a missing logo, a document dated too long ago, a policy without a clear scope. The practice behind the document was sound. The proof was not.

Svea Scherleithner, Global Head of Sustainability at Heraeus Precious Metals when we recorded our Talking Proof podcast episode with her, put the standard plainly: "Sustainability reporting follows the same principles: comparability, traceability, auditability." Finance teams have worked this way for decades. ESG data needs the same discipline, from Scope 1 and 2 upward.

Why Published ESG Data Becomes a Liability Without Proof

Published ESG data no longer stays in the report. Marketing reuses it in product claims, sales reuses it in tenders, and the EU rules on empowering consumers for the green transition (EmpCo) prohibit generic environmental claims that a company cannot substantiate. A figure that cannot be traced back is a risk wherever it travels. At Sunhat, we build the infrastructure for this. We help you produce, approve and defend your own proof with our comprehensive Proof Platform.

One Evidence Base, Many Requests

The most efficient way to handle ESG reporting is to separate evidence from answers. Evidence is collected, approved and versioned once, in one place. Answers are mapped from that evidence to each request: the CSRD report, a voluntary standard data request, an EcoVadis questionnaire, a CDP response or a customer's spreadsheet. When evidence changes, every answer that depends on it can be updated.

Our conversations show why this matters. Nine companies told us the same evidence has to serve several frameworks. Seven described re-entering one internal data set into every customer portal by hand. Twelve said sustainability sits on top of an existing job in quality, EHS or energy management, so every duplicated hour comes out of someone's day job.

The overlap has limits, and it pays to be honest about them. Frameworks define metrics differently, cut them at different levels of detail and ask at different depths. A rating questionnaire and a customer portal rarely ask the identical question, and a good mapping shows you exactly where they differ. Reuse works at the level of evidence: the same energy invoice, the same policy, the same approval. The answer still has to be mapped to each request's wording and definition.

Where AI Already Helps

AI fits ESG work well, because the same topics recur in different question formats across ratings, questionnaires and reports. But AI that drafts an answer without a source creates a new claim. AI that finds the approved evidence and proposes the mapping creates verified proof and saves hours without adding risk. The difference is not the model. It is whether the AI works from your approved evidence or from the open internet.

At Sunhat, we built Proof AI around that difference. It is grounded in thousands of successful sustainability submissions, verified audit outcomes and approved evidence, which is what separates it from a general-purpose chatbot.

Every answer the Response Agent proposes shows the exact document and page behind it, and your team reviews and signs off before anything leaves the company. The time savings come from reuse, not from writing faster, because every later request that asks for an approved figure starts from the approved answer.

How Customers Run It in Practice

Several of our customers run their ESG reporting this way, each from a different starting point.

EnBW had to collect ESG data from more than 500 investments across the group, while investor relations questionnaires kept arriving at several departments at once. In its ESGgo! project, EnBW consolidated CSRD, EU Taxonomy, CDP and investor questionnaires on one Proof Platform, with about 80 workspaces and more than 300 active users. Its first ESRS-compliant sustainability statement, in the 2024 annual report, used data collected in Sunhat, and auditors review answers with their sources, owners and timestamps directly in the platform. As Julia von Wietersheim, Senior Manager Investor Relations, put it: "Today, thanks to Sunhat, we can often find the right answers and evidence in seconds."

PALM, a European paper, packaging and recycling group with 38 production sites, faced a growing stream of EcoVadis, CDP and individual customer requests, answered separately by quality teams at each site. PALM harmonized its ESG data in a central, audit-ready database with workspaces for nearly 20 group companies. Several PALM companies improved their EcoVadis scores by 8 to 22 points, and sales teams now answer customer inquiries directly.

OQEMA, a chemical distributor with 47 locations in 25 countries, collected sustainability data through static Excel sheets and had to report at subsidiary, country and holding level for EcoVadis. With Sunhat, OQEMA ran 10 data collection campaigns across 27 entities and received 1,100 data points, building a reusable library for EcoVadis, CDP and its upcoming CSRD reporting.

{{cta-cs}}

The ESG Reporting Cycle, Step by Step

An ESG reporting cycle works best as one annual process that feeds every requester, rather than separate projects for each. The steps below apply whether you report under the CSRD, the voluntary standard, another national rule or only for customers and ratings.

1. Map your requesters. List every regulator, customer, rating, bank and investor that asked for ESG data last year, with format and deadline.
2. Decide scope and depth. Pick the framework that sets your floor, usually the ESRS, the voluntary standard or your national standard, and run a materiality assessment at the depth it requires.
3. Assign owners. Give every topic and metric a named owner in the function that holds the data, from HR to energy management.
4. Collect and approve evidence once. Store source documents, figures and approvals in one place, with versions and validity dates.
5. Map evidence to each request. Reuse approved evidence for the report, the voluntary standard request, the rating and the customer questionnaire.
6. Answer, publish and file. Submit each answer and keep a record of what went where and when.
7. Review and reuse. After each cycle, check where points were lost or questions repeated, and close the gaps before the next one.

A typical year has fixed peaks. Annual reports and sustainability statements close in the first months of the year. CDP opens its disclosure cycle in spring. EcoVadis reassessments follow each company's own cycle, and customer requests arrive all year, rarely on a schedule. Planning the evidence work around those peaks keeps teams out of firefighting mode and delivers answers before the deadline, not on it.

Tool, Team or Service: Who Does the Work?

Every company has to decide who carries the ESG reporting work, and there are three honest options. The right one depends on capacity more than on knowledge.

Your own team with spreadsheets. This works for a small number of requests and a stable team. It breaks when requests multiply, when the one person who knows where everything sits leaves, or when an auditor asks for the trail.

Your own team with software. An AI-backed Proof Software takes over collection, versioning, approvals and mapping, so the team spends its time on judgment rather than copy and paste. This fits teams that want control and have the hours to operate a tool.‍

A delivered service. Proof Services that deliver the outcome, from the report to the completed questionnaire, on the same evidence base. This fits companies where sustainability is an add-on to another job and resources are spread thin.

Conclusion: Transform ESG Reporting into Lasting Proof for Business Success

ESG reporting after the Omnibus is smaller in law and larger in practice. Fewer companies must publish a CSRD statement, while more get asked by customers, ratings, banks and investors. The companies that win those conversations are the ones that can answer any request quickly, with proof that holds up.

That is a solvable problem. You already did most of the work: the evidence exists in most companies, spread across finance, HR, EHS, quality and procurement. Bringing it into one evidence base, with owners and approvals, turns ESG reporting from an annual scramble into a reusable asset, and we help teams get there. It protects revenue, shortens sales cycles and frees hours for improvement instead of data entry.

Next Steps:

1. Map your requesters. List who asked you for ESG data in the last twelve months, in which format and by when.
2. Build one proof library. Collect, approve and version your core evidence once, aligned with the voluntary standard and your main rating.
3. See how Sunhat runs it. Book a meeting and see how our Proof Software maps your proof layer to every request or how our Proof Services take over the work for you.