ESG Compliance: What US Businesses Need to Know

An ESG request can arrive from a regulator, a customer, an investor, or your own leadership team. Before collecting information, establish where it comes from. ESG compliance depends on understanding which requirements apply, what response is expected, and what evidence supports it.

That distinction affects deadlines, responsibility, and review. A contractual reporting obligation needs different treatment from an optional questionnaire. A public sustainability commitment needs support even when no regulation required the company to make it.

For US businesses, the practical starting point is an applicability assessment. This guide explains how to connect relevant requirements with accountable people, reliable records, and a process for keeping decisions current.

What Is ESG Compliance?

ESG compliance means meeting applicable requirements concerning environmental, social, and governance matters. Those requirements may arise under laws, regulations, or contracts. Voluntary standards and company commitments also need oversight, but they should be identified separately.

Environmental matters include pollution controls, resource use, and emissions information. For example, an applicable wastewater permit may specify discharge limits, monitoring, and reporting, as explained in the EPA’s NPDES permit guidance.

Social matters include workforce conditions and supplier labor risks. The Department of Labor’s FLSA guidance illustrates how covered employers’ responsibilities include wage-and-hour records. A workforce policy alone does not demonstrate that those responsibilities have been fulfilled.

Governance concerns include oversight, ethical conduct, and disclosure controls. Evidence might include delegated responsibilities, review records, and documented responses to identified problems.

The distinction between ESG compliance vs ESG reporting is straightforward: compliance means meeting applicable requirements; reporting means communicating information. Ratings are assessments made using a particular provider’s methodology.

Publishing a sustainability report or receiving a favorable rating does not establish legal compliance. Similarly, a voluntary commitment is not automatically a statutory duty, but public statements about progress still need accurate wording and supporting evidence.

Which ESG Requirements Apply to Your Business?

Identify where the requirement comes from

Classify each item before deciding how to respond:

• Law or regulation: identify the operative provision and current status.

• Contract or customer request: determine whether an agreement requires the response or the request is nonbinding.

• Voluntary standard: record why the organization uses it and which version applies.

• Internal policy or public commitment: identify the approved promise, scope, and responsible team.

A customer questionnaire and a signed reporting clause are not equivalent. Likewise, choosing a reporting standard does not make that standard universally mandatory.

Check the entity, activities, and thresholds

Review legal entities and group structure, public or private status, operating locations, business activities, industry rules, thresholds, exemptions, and cross-border exposure. Examine contractual commitments alongside this legal assessment.

Company size alone is insufficient. A smaller business may have operational permit obligations, while a larger organization may fall outside a particular disclosure regime.

Use an applicability register to capture the decision. These entries are hypothetical; the owners are illustrative.

Replace relative review dates with calendar dates when implementing the register. Link each entry to the source, assessment, and relevant records.

“Not applicable” needs a documented reason. Record unresolved questions as pending, assign a reviewer, and set a decision date. Do not let uncertainty silently become an exemption.

ESG Reporting Requirements in the United States

Is ESG reporting mandatory in the US? Some reporting is mandatory for organizations that meet particular requirements. There is no single obligation requiring every US business to publish a comprehensive ESG report.

Federal disclosures and the SEC climate rules

The SEC adopted climate-disclosure rules in 2024, stayed them during litigation, and ended its litigation defense in 2025. Its May 2026 rescission remains identified as a proposal in the official materials reviewed on November 6, 2026. Ending litigation defense was not repeal.

Other securities-disclosure requirements remain relevant, including disclosure of material climate-related matters when required by existing rules. The SEC’s proposed rescission release expressly discusses those continuing obligations.

California emissions and climate-risk reporting

SB 253 addresses greenhouse gas emissions; SB 261 addresses climate-related financial risk. Neither should be screened out merely because a company is privately held.

Under California’s final regulation order, applicability uses entity-level gross receipts, the lesser of two previous fiscal years, and defined California business connections. Specified intercompany transactions are excluded. Exemptions include qualifying nonprofits, insurance businesses, government entities, and certain entities with narrowly limited California activities.

The initial regulation became effective October 12, 2026, according to the Office of Administrative Law’s notice register.

These positions reflect the cited official sources.

For SB 253, section 96076 determines the applicable preceding fiscal year. First-year alternatives include existing emissions information or, where its conditions are met, a company-letterhead non-reporting statement. Scope 3 is not required for 2026. CARB’s 2026 submission guidance also explains enforcement discretion concerning available information and assurance. This flexibility does not repeal the underlying law.

When international requirements affect US businesses

The Corporate Sustainability Reporting Directive (CSRD) and European Sustainability Reporting Standards (ESRS) can affect qualifying US groups and EU subsidiaries. The 2026 amendments entered into force March 18, with reporting-related national transposition generally due March 19, 2027. Entity-specific implementation still matters.

Separate direct legal exposure from customer or group information requests. These selected regimes are not an exhaustive inventory of ESG regulations in the US or abroad.

How ESG Reporting Frameworks Fit Into Compliance

ESG reporting frameworks organize disclosures. A business may adopt a standard voluntarily, accept it contractually, or encounter it through a legal regime. Identify which situation applies before treating its provisions as mandatory.

The IFRS Foundation’s introduction to ISSB standards explains their investor focus. The ISSB maintains the SASB Standards; IFRS S1 requires companies to refer to and consider relevant SASB guidance.

Financial materiality concerns information relevant to decisions about providing resources to the business. Impact materiality concerns significant effects on people, the environment, and the economy, reflected in the GRI Standards.

Double materiality considers both perspectives. Under the ESRS materiality provisions, a matter can be material from either perspective; it need not satisfy both.

An ESG materiality assessment helps select reporting topics. It does not remove applicable legal duties concerning topics that receive less attention in the report.

How to Manage ESG Compliance in Practice

Assign owners and define the evidence

Appoint an accountable program lead supported by legal or compliance, finance, operations, HR, procurement, and communications. No single job title fits every organization.

Extend the applicability register with deadlines, data owners, reviewers, evidence links, and escalation routes. Link detailed working records rather than creating a competing register.

Specify what demonstrates performance. Workforce evidence might include payroll checks and training records. Governance evidence might include approvals and documented follow-up. A policy establishes expectations; it does not prove implementation.

Set data boundaries and quality checks

Define the entities, sites, reporting periods, and metrics covered before collecting data. Preserve source records, calculation methods, assumptions, and estimates. Control versions and investigate inconsistent figures.

For emissions, the GHG Protocol’s scope definitions distinguish:

• Scope 1: direct emissions from owned or controlled operations.

• Scope 2: emissions from generating purchased or acquired electricity, steam, heating, or cooling consumed by the business.

• Scope 3: other indirect emissions across the upstream and downstream value chain.

Carbon accounting measures emissions. A climate risk assessment examines potential physical and transition effects on the business, such as disruption or changing market conditions. One does not substitute for the other.

Reliable ESG data governance also needs responsibility for resolving errors. Establish data ownership and governance so reviewers can trace figures to an accountable source.

Review disclosures and environmental claims

Reconcile proposed statements with supporting records. Check whether a claim concerns a product, facility, selected operations, or the whole company. State limitations clearly and retain approval.

The FTC’s Green Guides summary cautions against broad, unqualified claims such as “green” or “eco-friendly.” The Guides address environmental marketing claims; they are not a universal ESG certification standard.

This review helps address greenwashing risks from unsupported or misleading claims. Apply comparable discipline to workforce and governance statements: do records support claims about training coverage or supplier screening?

Internal review differs from independent external assurance. Determine whether assurance is required, its scope, and the applicable level under the particular regime or agreement.

Retain records and respond to changes

Keep source data, calculations, approvals, submissions, correspondence, and traceable versions. Set retention periods using applicable requirements and policies.

Someone reviewing a submission should be able to reconstruct its basis. Use a consistent approach to preparing compliance evidence, including records of review and unresolved exceptions.

Monitor regulatory, contractual, organizational, and methodology changes. Assign corrective actions, verify whether they work, and provide role-appropriate training when responsibilities or processes change.

Example: Responding to a Customer’s ESG Questionnaire

Consider a hypothetical US private supplier asked by a large customer to provide emissions figures, workforce-policy information, and governance documentation.

1. Define the request. Procurement confirms the deadline, requested reporting period, entities, facilities, and whether figures must be company-wide or customer-specific.

2. Review the contract. Legal checks whether an agreement requires the response, permits supporting-document requests, or specifies a reporting method.

3. Assess direct duties separately. Compliance checks the supplier’s own legal exposure. The customer’s legal obligations do not automatically become the supplier’s direct legal obligations.

4. Assign data owners. Operations handles energy records, HR addresses workforce information, and compliance provides governance documentation.

5. Collect evidence and identify gaps. The team discovers that one leased facility’s electricity information is incomplete. It records the gap instead of presenting a partial total as complete.

6. Review and approve. The supplier checks whether estimation is permitted, explains exclusions and assumptions, and obtains approval before submission.

7. Preserve the response. Procurement retains the submitted version, supporting records, customer correspondence, and agreed follow-up actions.

The response should also distinguish having a policy from implementing it. If the questionnaire asks whether all employees received training, attaching the policy alone does not answer the question.

This process gives the supplier a defensible account of what it knows, what remains uncertain, and what it has agreed to provide next.

ESG Compliance Checklist

Use these questions to review the process:

• Have we identified relevant legal entities, operating locations, and activities?

• Have we classified each item as law, contract, request, standard, or commitment?

• Have we documented applicability, exclusions, unresolved questions, and current regulatory status?

• Have we assigned accountable owners, reviewers, deadlines, and escalation routes?

• Have we defined reporting boundaries, methods, assumptions, and permitted estimates?

• Have we checked data quality and substantiated environmental, workforce, and governance claims?

• Have we recorded approvals and retained submissions with traceable supporting evidence?

• Have we scheduled updates and tracked corrective actions through verification?

Record gaps against the existing applicability register, with an owner and next action. Prioritize unresolved applicability decisions and approaching deadlines.

Completing this ESG compliance checklist does not establish legal compliance. Its purpose is to reveal missing decisions, evidence, or follow-up.

Put ESG Requirements Into Practice

Start with one real requirement or customer request. Record its source, applicability, responsible owner, deadline, and supporting evidence. Test whether another person could understand the decision and reproduce the response from those records.

Then extend that approach across the organization, updating it as requirements and operations change.

For teams developing their understanding of ESG principles, reporting approaches, governance, and responsibilities, explore US Compliance Institute’s ESG and sustainability compliance training. Training supports informed work; it does not certify organizational compliance.