Your Customers' Regulator Just Said What It Will Be Checking

Last week, the European Securities and Markets Authority (ESMA) published its European Common Enforcement Priorities for 2026, the annual list of issues that Europe's securities enforcers will focus on when they review listed companies' annual reports. Sustainability statements prepared under the European Sustainability Reporting Standards (ESRS) are on the list again, with two priorities: continuing progress in applying materiality assessment, and providing connected information on impacts, risks and opportunities (IROs), policies, actions and targets (PATs), and metrics.

On its face, this is a document for listed issuers, their auditors and their audit committees. For a mid-market ingredient supplier in New Jersey or Ohio, it can look a long way from home.

It isn't. Read closely, ESMA's full statement is a detailed description of what Europe's largest brands will have to demonstrate about their value chains in the next reporting cycle. A good share of that evidence has to come from their suppliers.

EFRAG writes the standards. ESMA checks the work.

Two European acronyms come up in nearly every conversation about the Corporate Sustainability Reporting Directive (CSRD), and they are easy to blur together. They do very different jobs.

EFRAG is a private association that serves as the European Commission's technical advisor on corporate reporting. It drafted the original ESRS, and in December 2025 it delivered its technical advice on a simplified version. EFRAG does not make law: the Commission takes its advice and adopts the standards through delegated acts, as it did with the simplified ESRS this summer. EFRAG also publishes implementation guidance, including IG 1 on materiality assessment and IG 2 on the value chain, which helps companies apply the standards but is not legally binding.

ESMA is the EU's financial markets regulator and supervisor. It does not write the ESRS. It works with national enforcers across the European Economic Area to examine how listed companies actually apply reporting requirements in their annual financial reports. Each year it sets common priorities so that enforcers in Paris, Frankfurt and Amsterdam are looking at the same things. When enforcers find material misstatements, they take enforcement action, and ESMA later reports on what they found.

Put simply, EFRAG and the Commission decide what a sustainability statement should contain. ESMA and national enforcers decide whether a given company's statement measures up.

This year's statement shows the handoff clearly. The simplified ESRS, developed under the EU's Omnibus simplification package, were drafted by EFRAG and adopted by the Commission this summer. Companies may use them for FY2026, and they become mandatory for FY2027. ESMA's role is to tell issuers to be transparent about which version they used and to be ready for the new standards next year.

Two practical points follow. ESMA's priorities apply directly to companies with securities admitted to trading on EEA regulated markets, not to every CSRD reporter. But ESMA explicitly urges auditors to consider the priorities as well, and because they are drawn from what enforcers have actually seen in filings, they tend to shape practice well beyond the listed population.

Materiality is still the foundation

This is the third straight year ESMA has put materiality on its list. Its reasoning is simple: the double materiality assessment determines which impacts, risks and opportunities a company reports on, so everything else in the sustainability statement rests on it.

The most pointed observation this year concerns balance. ESMA has seen issuers describe their positive impacts in far more detail than their negative ones, and it wants both treated with the same rigor.

ESMA also wants clearer disclosure of how IROs were identified and assessed, and it is explicit that this must cover the company's own operations and its upstream and downstream value chain.

For a supplier, the key phrase is "upstream value chain." That is you. A cosmetics brand cannot credibly describe how it assessed impacts in its raw material supply without knowing something about where those materials come from, how they are processed, what that processing emits and who does the work. And a requirement to give negative impacts equal weight means a supplier's marketing materials will not be enough. Brands need data that describes the downsides, too.

From impacts to targets, every link has to hold

The second priority is connectivity. ESMA expects a company's IROs, its policies, actions and targets, and its metrics to tell one consistent story. That applies to every topic, but for FY2026 enforcers will concentrate on ESRS E1 (climate change) and ESRS S1 (own workforce), because those topics are the most mature.

The statement points to the places where those links tend to break, and most of them sit where a company's commitments stop short of its value chain or its full footprint. ESMA expects those gaps to be disclosed rather than smoothed over.

Targets get particular attention. ESMA wants them clearly defined and transparent about progress, including when a target has been missed or the basis for measuring it has changed. On climate, it is pushing back on loose use of terms like "science-based" and "1.5 degrees" where companies have not shown that their targets actually meet those claims.

ESMA also looks ahead. With 2030 approaching, it expects that some companies will realize their 2030 targets are out of reach, and it wants that disclosed promptly. Enforcers are also checking that the risks a company names in its sustainability statement match the risks described elsewhere in its annual report.

Why this ends up on a supplier's desk

Most ingredient and packaging suppliers will never file an ESRS sustainability statement, and few will ever deal with ESMA or a national enforcer. Their customers will. For a beauty or personal care brand, purchased ingredients and packaging typically make up a large share of the climate footprint, which means the E1 disclosures enforcers are focusing on depend heavily on supplier data.

Start with targets. A brand with a Scope 3 reduction target now has to report it in absolute terms, explain its methodology, and account for any change in its baseline. When a brand swaps spend-based estimates for supplier-specific product carbon footprints, that is exactly the kind of methodology change ESMA wants explained. Brands will favor suppliers whose numbers are consistent from year to year, documented, and calculated on a basis they can defend to an auditor.

Next, coverage gaps. If a brand's climate IRO spans its value chain but its policy or target only reaches its own operations, it now has to say so in plain terms. Most brands would rather close that gap than disclose it, and the usual way to close it is a supplier engagement program. Those programs then become "key actions" in the sustainability statement, which ESMA expects to be tied to policy objectives and backed by resources. Supplier engagement stops being a procurement side project and becomes something an enforcer may read about.

Then there is 2030. As target years approach, brands must disclose when they will fall short. A brand whose Scope 3 trajectory depends on its suppliers has every reason to press those suppliers on reductions, and on proof of those reductions, before it has to tell investors the target is out of reach.

The S1 focus is about a brand's own employees, so it reaches suppliers less directly. But the materiality priority covers the whole value chain, and impacts on workers in the supply chain sit within that assessment.

Smaller suppliers do have some protection here. The value chain cap, which we covered earlier this month, limits what a CSRD reporter can require from companies with 1,000 or fewer employees. But it doesn't change what the brand has to show enforcers. Where supplier data is missing, the brand fills the gap with estimates, and a supplier that outperforms its industry average gets no credit for it in an estimate.

Reading ESMA from the supplier side

ESMA restates its commitment to simplification and burden reduction in this year's announcement, alongside its focus on investor protection. That pairing is the story of European sustainability reporting in 2026. The rules are getting narrower and more streamlined, and the scrutiny of what remains is getting sharper. It is disciplined reprioritization, not retreat, and the pressure on suppliers is becoming more specific rather than easing.

The most useful thing a supplier can do is read its largest customers' sustainability statements the way an enforcer would. Look at which upstream IROs they identify, which targets reach into Scope 3, and where their policies stop short of the value chain. Those are the places where data requests are coming from next.

Then make sure your own data would hold up to the same reading. Suppliers who can provide that make their customers' disclosures easier to defend, and that is a commercial advantage.

If your brand customers are working to connect their targets to their value chain, ADB Sustainability can help you be the supplier whose data makes that easier. We build GHG inventories and product carbon footprints, conduct LCAs, and prepare the EcoVadis and CDP submissions and ESG reporting that give brand customers evidence they can stand behind. Get in touch to talk about where your data stands today.