Is ESG Regulation Moving Faster Than Your Governance Can Keep Up? 

More than 40 jurisdictions are moving towards ISSB-based sustainability reporting. Boards now face a governance problem, not simply an ESG problem 

ESG regulation is expanding faster than many organisations’ governance systems are adapting. 

By August 2026, the IFRS Foundation reported that ISSB Standards were being adopted or otherwise used in more than 40 jurisdictions. Earlier in the year, it confirmed that requirements were already in effect in 19 jurisdictions, while many others were developing regulatory roadmaps. 

At the same time, the European Union has revised its sustainability reporting regime, the UK has finalised UK Sustainability Reporting Standards S1 and S2, financial regulators are embedding ESG into risk management and stress testing, and regulators are sharpening their response to greenwashing. 

No single global index proves that ESG regulatory expansion is literally the fastest-growing governance risk. However, few governance issues are expanding simultaneously across so many dimensions: disclosure, risk management, product governance, internal controls, strategy, assurance, investment, data and board accountability. 

That is why boards should stop treating ESG regulation as the sustainability team’s compliance problem. 

It is becoming an enterprise governance problem. 

The danger is not simply that an organisation might miss a disclosure requirement. The greater risk is that regulatory expectations expand faster than decision rights, data systems, internal controls and board oversight can respond. 

Read More: ESG Materiality & Risk Assessment 

Executive Takeaway 

The regulatory expansion surrounding ESG creates governance risk because organisations increasingly need to manage several moving parts at the same time: 

• More jurisdictions are introducing sustainability requirements, often using ISSB Standards as a common baseline while adapting them to local markets. 

• Regulation is moving beyond reporting, particularly in financial services, where ESG risks are increasingly entering risk management, stress testing and product governance. 

• European sustainability rules are being simplified rather than abandoned, meaning organisations must continually reassess what applies instead of relying on yesterday’s compliance model. 

• Boards need better evidence, because regulatory expectations increasingly depend on materiality judgements, reliable data, controls and demonstrable oversight. 

• Cross-border businesses face fragmentation risk, since similar requirements may have different scope, timing, transition reliefs and enforcement arrangements. 

• Greenwashing risk is becoming a governance issue, particularly where public claims, product design and underlying evidence do not align. 

The organisations most exposed are not necessarily those doing the least on ESG. In many cases, they are organisations doing a great deal without a sufficiently coherent governance system connecting strategy, disclosure, data and accountability. 

1. The first risk is regulatory velocity 

The scale of change is difficult to ignore. 

In February 2026, the IFRS Foundation said nearly 40 jurisdictions had already taken steps to adopt or otherwise use ISSB Standards, with requirements in force in 19. By August, it was referring to adoption or use across more than 40 jurisdictions. 

This matters because organisations no longer have the luxury of treating sustainability reporting as a stable technical framework that changes every few years. 

Instead, governance teams need to track: 

• New standards 

• Jurisdiction-specific implementation dates 

• Scope thresholds 

• Transition arrangements 

• Assurance requirements 

• Listing rules 

• Sector regulation 

• Changes in regulatory interpretation 

• Voluntary standards that may later become mandatory 

The IFRS Foundation’s jurisdiction profiles illustrate how differently markets are approaching the same global baseline. Australia, Brazil, Ghana, Hong Kong, Japan, Kenya, Malaysia, Mexico and other jurisdictions have each developed or are developing their own approaches. 

Therefore, the governance challenge is not simply keeping up with regulation. 

It is maintaining a reliable view of which regulation applies to which part of the organisation, from when, and with what evidence requirement. 

Explore More: ESG Reporting and Disclosure 

2. Regulatory convergence does not mean regulatory uniformity 

The growth of ISSB-based standards should eventually improve comparability. Nevertheless, global convergence should not be confused with identical rules. 

Jurisdictions can adopt, adapt or otherwise use ISSB Standards in different ways, which means scope, timing and proportionality may vary. 

The UK provides a useful example. The Government published final UK SRS S1 and S2 on 25 February 2026. The standards are currently available for voluntary use, while the Government and Financial Conduct Authority consider their future application to specific companies. 

Meanwhile, the FCA consulted in early 2026 on replacing existing listed-company climate disclosure rules with requirements more closely aligned to international sustainability standards. 

For multinational organisations, this creates a familiar but difficult governance problem. A common reporting architecture may be desirable, yet each jurisdiction can create additional requirements around timing, assurance, materiality or scope. 

Consequently, organisations need a central ESG governance model that can accommodate local variation rather than separate compliance exercises operating independently. 

3. Europe has simplified ESG reporting, but the governance challenge remains 

European sustainability regulation has attracted intense attention because it expanded the scope and depth of corporate sustainability reporting. 

In July 2026, the European Commission adopted revised European Sustainability Reporting Standards as part of the Omnibus simplification programme. Mandatory datapoints were reduced by more than 60%, while total datapoints fell by more than 70%. The Commission estimates that reporting costs could fall by more than 30% per company. 

This is significant. 

However, boards should be careful about drawing the wrong conclusion. Simplification does not mean that sustainability reporting has ceased to matter. Rather, the focus is moving towards more proportionate disclosure, stronger materiality judgement and lower unnecessary administrative burden. 

Companies still need to understand sustainability-related risks and opportunities, impacts on people and the environment, material information and governance responsibilities. 

Therefore, an organisation that built its ESG governance model around a large checklist may now need to redesign it. 

A strong governance system should be capable of becoming simpler when regulation becomes simpler. 

Otherwise, the organisation merely accumulates legacy compliance processes. 

Read More: ESG Strategy Development 

4. ESG regulation is moving beyond disclosure 

Perhaps the most important development is that ESG regulation increasingly affects how organisations manage risk, rather than simply what they report. 

For European banks, the European Banking Authority’s Guidelines on the management of ESG risks became applicable from January 2026. The guidelines require institutions to identify, measure, manage and monitor ESG risks and establish plans addressing risks associated with the transition towards a climate-neutral economy. 

In addition, the European Supervisory Authorities published joint guidelines on ESG stress testing in January 2026. Those guidelines are intended to embed ESG considerations within supervisory stress-testing approaches for banking and insurance. 

This changes the board-level conversation. 

An ESG risk can no longer be treated solely as something disclosed in the sustainability section of an annual report. It may affect: 

• Risk appetite 

• Capital planning 

• Scenario analysis 

• Product strategy 

• Credit decisions 

• Investment decisions 

• Operational resilience 

• Remuneration 

• Internal controls 

• Board reporting 

Once regulation enters those areas, sustainability becomes part of mainstream governance architecture. 

Explore More: ESG Integration in Investment Decisions 

5. Greenwashing is becoming a product governance risk 

The regulatory expansion is also reaching the way organisations design and sell products. 

In June 2026, the European Banking Authority revised its product oversight and governance guidance to make ESG and greenwashing risks more explicit for retail banking products. The changes address areas including internal control functions, target markets, distribution channels and the information given to distributors. 

This is an important development because it moves greenwashing away from the communications department. 

A misleading sustainability claim can originate much earlier in the product lifecycle. For example, the problem may arise because: 

• Product criteria are poorly defined. 

• ESG characteristics are not supported by evidence. 

• Marketing descriptions exceed the underlying methodology. 

• Distribution channels misunderstand the product. 

• Governance functions fail to challenge claims. 

• Customer expectations do not match product design. 

Therefore, boards should view greenwashing as a risk involving product governance, controls and evidence, not simply reputation. 

The question should not be whether the marketing team has approved the wording. 

It should be whether the organisation can substantiate the claim. 

6. The data problem is becoming a governance problem 

ESG regulation relies heavily on information that organisations have historically managed less rigorously than financial data. 

Emissions may come from facilities teams, workforce information from HR, supply-chain information from procurement and social impact data from individual programmes. Meanwhile, climate scenarios may depend on external models, and financed emissions may rely on information supplied by counterparties. 

As regulation expands, weaknesses in this information architecture become governance risks. 

Where ESG regulatory risk typically appears 

The governance issue is not whether organisations can collect more ESG data. 

It is whether they can establish ownership, controls and accountability around the data that matters. 

Read More: ESG Reporting and Disclosure 

7. Assurance raises the stakes 

As sustainability reporting becomes more formal, assurance increasingly matters. 

A 2025 IFRS Foundation survey of regulators and standard setters found that 39% of responding jurisdictions planned to require assurance over sustainability-related disclosures, with most of those jurisdictions expecting limited assurance initially. 

This has important implications for governance. 

When an assurance provider examines ESG information, management may need to demonstrate: 

• Where the data originated 

• Which methodology was used 

• Who approved it 

• Which estimates were applied 

• What internal controls operated 

• How exceptions were handled 

• Whether the reporting boundary was consistent 

• What evidence supports management’s judgement 

That is very different from producing an attractive sustainability report. 

It requires audit trails. 

Consequently, organisations should design ESG reporting processes as repeatable control systems rather than annual publication projects. 

8. The greatest risk may be fragmentation inside the organisation 

The regulatory landscape is fragmented externally, but the more serious weakness may be fragmentation internally. 

Different teams often own different pieces of ESG compliance: 

• Sustainability manages reporting. 

• Legal monitors regulation. 

• Finance manages selected metrics. 

• Risk assesses exposure. 

• Procurement controls supplier information. 

• HR manages workforce data. 

• Investor relations communicates with markets. 

• Compliance interprets conduct requirements. 

• Internal audit reviews controls. 

Each function may perform its role competently while the organisation as a whole lacks a coherent ESG governance model. 

This creates gaps between responsibility and accountability. 

For example, who determines whether a sustainability claim is sufficiently evidenced before publication? Who decides whether an emerging ESG requirement is financially material? Who owns remediation when an assurance provider identifies a control weakness? 

If the answer is unclear, regulatory expansion will magnify the problem. 

A mature operating model should therefore establish: 

• Board oversight 

• Executive accountability 

• Regulatory horizon scanning 

• Data ownership 

• Materiality governance 

• Control ownership 

• Disclosure approval 

• Escalation processes 

• Assurance responsibilities 

The objective is not to create another ESG committee. 

It is to make accountability visible. 

9. Boards need regulatory horizon scanning, not annual updates 

Traditional governance calendars often assume that regulation can be reviewed periodically. 

ESG regulation challenges that model because changes are happening across multiple jurisdictions at different stages. 

In 2026 alone, the regulatory environment included final UK Sustainability Reporting Standards, revised European Sustainability Reporting Standards, FCA consultation on listed-company sustainability disclosures, European ESG risk-management requirements for banks and new guidance addressing greenwashing within retail financial products. 

A board does not need to debate every technical development. 

However, it does need a reliable process for distinguishing regulatory noise from developments that change the organisation’s exposure. 

A useful ESG regulatory dashboard should show 

• Regulation or standard 

• Relevant jurisdiction 

• Current status 

• Effective date 

• Entities affected 

• Business impact 

• Current readiness 

• Accountable executive 

• Key gaps 

• Required board decision 

• Next review date 

This moves regulatory monitoring from passive awareness to governance intelligence. 

10. International expansion multiplies ESG regulatory exposure 

Cross-border growth used to create predictable governance challenges around tax, employment law, entity compliance and financial regulation. 

Increasingly, it also creates sustainability obligations. 

A group entering a new jurisdiction may discover that its reporting, climate, due diligence or product obligations differ materially from those applying at headquarters. 

Furthermore, ISSB adoption creates both opportunity and complexity. A global baseline should reduce unnecessary fragmentation, yet the IFRS Foundation acknowledges that jurisdictions need flexibility around adoption pathways, transitional reliefs and local implementation. 

Therefore, multinational organisations need two things simultaneously: 

Global consistency and local regulatory intelligence. 

Central ESG policy without local implementation creates compliance risk. Conversely, fully decentralised reporting can produce inconsistent methodologies, duplicated work and weak group oversight. 

The governance challenge is finding the right balance. 

11. Regulatory expansion creates strategic trade-offs 

It would be easy to conclude that organisations should simply spend more on ESG compliance. 

That is not necessarily the right answer. 

Regulation carries cost, and boards have a responsibility to ensure that resources are used proportionately. The European Commission’s 2026 ESRS revisions are themselves evidence that regulators recognise excessive reporting complexity can impose unnecessary burdens. 

Therefore, the governance objective should not be maximum ESG infrastructure. 

It should be appropriate ESG infrastructure. 

Boards need to distinguish between: 

• Mandatory requirements 

• Likely future requirements 

• Investor expectations 

• Voluntary commitments 

• Strategic ESG information 

• Legacy reporting that no longer adds value 

In some cases, stronger governance may mean doing less. 

For example, a company may rationalise overlapping metrics, remove obsolete disclosures or consolidate multiple regulatory trackers into one enterprise system. 

Effective governance is not measured by the size of the ESG programme. 

It is measured by whether the programme manages the organisation’s actual exposure. 

The Lumorus View 

ESG regulation becomes a governance risk when external requirements change faster than internal accountability. 

The real danger is not the existence of more regulation. Businesses have always operated within changing regulatory environments. 

The risk appears when regulation grows across several functions and nobody has a complete view. 

One team understands the disclosure requirement, another owns the data, a third manages the risk and the board receives a summary after the important implementation decisions have already been made. 

That is not simply an ESG problem. 

It is a governance design problem. 

Strong governance connects regulatory intelligence with decision rights, materiality, data, controls and board oversight. Therefore, the first question should not be how much more do we need to disclose? 

It should be: 

Do we have the governance infrastructure needed to understand and manage what is changing? 

12. What boards should do now 

Boards do not need to become sustainability reporting specialists. However, they do need enough visibility to understand whether regulatory expansion is being managed systematically. 

Five actions should be priorities. 

1. Map the regulatory perimeter 

Identify sustainability requirements across every material jurisdiction, entity and regulated activity. 

2. Assign clear accountability 

Determine who owns horizon scanning, implementation, data, controls and final disclosure. 

3. Conduct an ESG regulatory gap analysis 

Compare regulatory requirements with existing governance, data and reporting capability. 

Read More: ESG Materiality & Risk Assessment 

4. Integrate ESG regulation into enterprise risk 

Material regulatory developments should feed into risk assessment, strategy and investment decisions rather than remain inside sustainability reporting. 

Explore More: ESG Integration in Investment Decisions 

5. Build reporting for repeatability 

Processes should produce reliable information every reporting cycle rather than depending on annual data collection exercises. 

Five questions for the next board meeting 

A board can quickly test its exposure by asking: 

1. Which ESG regulations apply to each significant part of our organisation today, and which could apply within the next three years? 

2. Who has enterprise-level accountability for monitoring and interpreting those changes? 

3. Where do our most significant ESG regulatory gaps sit: governance, data, controls, products or disclosure? 

4. Which public sustainability claims would be hardest for us to evidence if challenged tomorrow? 

5. Can our current ESG governance model scale as regulation expands across more jurisdictions and business activities? 

If management cannot answer these questions clearly, the board has already identified a governance weakness. 

The Bottom Line 

ESG regulation is no longer a narrow reporting issue. 

It is spreading across corporate disclosure, financial services supervision, risk management, stress testing, product governance, greenwashing controls, investment decision making and assurance. 

At the same time, more than 40 jurisdictions are moving towards adoption or other use of ISSB Standards, the UK is developing its own implementation pathway and Europe continues to refine its sustainability reporting architecture. 

This does not mean every organisation should respond by building a larger ESG department. 

It means governance needs to become more connected. 

Boards need visibility over the regulatory perimeter, clear ownership of implementation and reliable evidence that material obligations are being addressed. Management needs reporting systems capable of producing consistent information, while sustainability, finance, risk, legal and governance functions need to operate as parts of one control environment. 

The organisations most exposed will not necessarily be those that ignored ESG. 

They may be those that expanded ESG activity without expanding the governance infrastructure underneath it. 

Regulation can change quickly. Accountability cannot afford to catch up afterwards. 

How Lumorus can help organisations manage ESG regulatory expansion 

Lumorus helps boards, investors and leadership teams connect sustainability regulation with governance, strategy, risk and credible disclosure. 

Rather than treating each regulatory change as a separate reporting project, we help organisations build more resilient ESG operating models through: 

• Regulatory exposure and materiality: ESG Materiality & Risk Assessment 

• Strategy and governance: ESG Strategy Development 

• Data, reporting and disclosure: ESG Reporting and Disclosure 

• Capital allocation and investor decisions: ESG Integration in Investment Decisions 

• Stakeholder expectations: Stakeholder Engagement 

• Evidence of social outcomes: Social Impact Measurement and Management 

A practical starting point is an ESG Regulatory Gap Analysis, which can identify what applies, where governance and data weaknesses sit, and which issues deserve priority. 

About Lumorus 

Lumorus is a UK headquartered global governance, ESG, company secretary and advisory firm supporting organisations across Europe, Africa, Asia, the Caribbean, Canada, the Middle East and international markets. 

For more than 10 years, we have helped boards, investors and leadership teams strengthen governance, accountability, sustainability and organisational resilience. 

As ESG regulation expands, organisations need more than regulatory awareness. They need governance systems capable of translating regulatory change into clear accountability, reliable data and defensible decisions. 

Is ESG regulation moving faster than your governance infrastructure? 

Contact Lumorus to discuss an ESG Regulatory Gap Analysis and build a more resilient approach to sustainability regulation, reporting and accountability. 

Email: [email protected] 

Lumorus: Better Business, Built on Purpose. 

Sources 

• IFRS Foundation – August 2026 update on the adoption or other use of ISSB Standards across more than 40 jurisdictions. 

• IFRS Foundation – Jurisdictional Readiness Assessment Guide, including 19 jurisdictions with requirements already in effect. 

• IFRS Foundation – Jurisdiction profiles covering global sustainability disclosure implementation. 

• European Commission – Revised European Sustainability Reporting Standards adopted in July 2026. 

• UK Government – Final UK Sustainability Reporting Standards S1 and S2. 

• Financial Conduct Authority – Proposals to align UK listed issuers’ sustainability disclosures with international standards. 

• European Banking Authority – Guidelines on the identification, measurement, management and monitoring of ESG risks. 

• European Supervisory Authorities – Joint Guidelines on integrating ESG risks into supervisory stress testing. 

• European Banking Authority – 2026 product oversight and governance guidance addressing greenwashing risks in ESG-related retail banking products.