Category: Legal Design Thinking

  • The Cost of an Unprovable Corporate Claim

    The Cost of an Unprovable Corporate Claim

    The contract was not renewed. The notification arrived in three lines. The company was confident its pricing was competitive. Quality unquestioned. Delivery record clean. But it did not pass. A senior manager called the buyer’s contact. “Nothing wrong on your end. We just went in a different direction.” Six months later, the same buyer issued a new tender. The company was not invited.

    The Claim That Could Not Be Substantiated

    Every organisation makes claims. About the quality of its processes. About the reliability of its data. About the sustainability of its supply chain. About the governance structures behind its decisions. Most of those claims are made in good faith. Few are made with the evidence architecture required to substantiate them under independent scrutiny.

    And in a business environment where sustainability disclosures, supply chain representations, AI-assisted decisions and board statements are increasingly subject to verification, the gap between a claim and a provable claim is no longer merely a compliance question. It is an economic one.

    What an Unprovable Claim Actually Costs

    The cost of an unprovable corporate claim is rarely visible at the moment it is made. It becomes visible later. Sometimes much later. And by then, the cost has compounded. Consider what happens when a material claim cannot be substantiated under scrutiny.

    A tender is lost - not necessarily because the offering was inferior, but because the due diligence process revealed that the underlying data could not be verified. The buyer chose a supplier whose documentation required less remediation.

    An assurance engagement identifies a material evidence or control deficiency - not necessarily because the reported figures were wrong, but because the system that produced them could not provide sufficient appropriate evidence to support them. The cost of remediation may exceed the cost of building the system in the first place.

    A regulatory inquiry opens - not because the organisation intended to mislead, but because a public sustainability claim could not be substantiated at the time it was made. Legal costs, management time and reputational exposure follow.

    An investor due diligence process stalls - not because the business fundamentals are weak, but because governance documentation is incomplete and accountability structures cannot be demonstrated. The transaction timeline extends. Terms may be renegotiated. Value can be lost.

    In each case, the cost is not the claim itself. The cost is the absence of evidence to support it.

    The Compounding Effect

    What makes unprovable claims particularly expensive is not their immediate cost. It is the compounding effect of the problem remaining unaddressed. An organisation that loses a tender for reasons it does not understand may enter the next tender with the same gap. An organisation that receives an assurance finding without addressing the underlying system weakness may face similar evidence problems again.

    And one unprovable material claim should raise a broader question:

    What else in the organisation depends on evidence that has never been structured to withstand scrutiny? The problem does not resolve itself. It can compound - quietly and invisibly - until the cost of correcting it becomes significant.

    Why the Cost Remains Hidden

    EU buyers rarely say: “You did not pass because your evidence architecture was insufficient.”

    They may simply say: “We went in a different direction.”

    Regulatory scrutiny may begin with a request for documentation rather than an explicit statement that a claim was unprovable.

    Investors may not decline a transaction by saying: “Your governance cannot be demonstrated.” They may instead extend timelines, request additional evidence or seek changes to the transaction terms. In each case, the underlying issue may remain unspoken. And the organisation that does not understand the real reason continues operating with the same gap - and may pay the same cost repeatedly without knowing why.

    The Economic Logic of Defensibility

    There is an economic logic to defensibility that organisations are beginning to recognise. A system capable of substantiating material corporate claims does not only reduce legal exposure. It can reduce transaction friction. It can accelerate due diligence processes. It can reduce the cost of responding to assurance requests. It can protect management time. It can reduce friction in access to markets, counterparties and capital.

    And it can protect the individuals who made and approved material claims - because those claims were made within a system capable of demonstrating how they were produced, what evidence supported them and why reliance on them was reasonable. The cost of building that system is finite. The cost of not having it is open-ended.

    The Question Every Organisation Should Ask

    What are the material claims your organisation is currently making - about its sustainability performance, its supply chain, its governance or its AI-assisted decisions - that it could not substantiate under independent scrutiny tomorrow?

    If the answer is uncertain, the organisation does not have a documentation problem. It has an evidence gap. And that gap has a cost. The only question is whether the organisation discovers that cost on its own terms - or on someone else’s.

    Other blogs

    See other blogs

  • You can lose a tender before anyone even cites ESG as the reason

    You can lose a tender before anyone even cites ESG as the reason

    The formal notice arrived in three lines. The company was certain that its price was competitive. Quality was undisputed. References were solid. But it did not make it through.

    The director called the buyer's contact person. "It wasn't your fault. We just decided to go in a different direction." Six months later, the same buyer issued a new tender. The same company was not even invited.

    The Reason That Is Never Spoken

    On the EU market, there is a category of business risk that is rarely named precisely. It does not appear in the explanation of the decision. It does not appear in the notice on the outcome of the process. It is not heard in the phone conversation with the buyer. But it decides.

    An EU company that is subject to CSRD, CSDDD or internal ESG policies must be able to demonstrate that its value chain meets the standards it is itself required to meet.

    When it evaluates a supplier — whether it is a formal tender, contract renewal or new project — it is not only evaluating your offer.

    It is evaluating how easy it will be to fulfil its own obligations with you. If that is not easy — it walks away. Without explanation.

    What the EU Buyer Is Actually Measuring

    There are things a buyer says it measures. And there are things it actually measures. It says it measures: price, quality, delivery time, references. In reality, it measures: how much due diligence will cost, how much documentation is missing, how many questions remain unanswered, how much risk it takes on by including you in its report.

    A company that cannot demonstrate:

    • how its ESG data was generated
    • who verified it
    • what controls are in place
    • who is responsible for its accuracy

    -is not simply a company without ESG documentation.

    It is a due diligence cost that the buyer has to absorb. And buyers choose suppliers who minimize that cost — not increase it.

    Why This Is Not Said

    EU buyers rarely say "you did not pass because of ESG." The reasons are practical. A formal explanation of the decision may be subject to legal challenge. An informal explanation may raise uncomfortable questions about their own standards. It is simpler to say "we decided to go in a different direction." And move on. And the Balkan company that did not make it through is left with a question it cannot answer. And with a tendency to look for the problem in the wrong place — in price, policy, relationships. While the real reason remains unspoken.

    The Cost of an Invisible Reason

    The most expensive business risk is not the one you can see. The one you can see can be addressed. The most expensive is the one that is never named — and therefore never resolved. A company that loses a tender because its data and processes are not defensible — without knowing it — continues operating in the same way. It loses the next tender for the same reason. And the next. Until the pattern becomes irreversible.

    What Can Change — and When

    Defensibility is not built within a documentation submission deadline. It is not built the night before the deadline. It is built through a system that exists before the buyer asks the question. A company that has a documented, verified and defensible system of data and processes today enters every tender tomorrow with an advantage that a competitor cannot make up through speed. Because the advantage is not in the document attached to the offer. The advantage is in the system that created that document — and that can explain how, why and on what basis it was created.

    The Question Every Board Should Ask Today

    If your most important EU buyer had to justify tomorrow to an auditor or regulator why it does business with you:

    What would it show?

    If the answer is unclear — the problem is not your offer. The problem is the system behind every claim you make about your business. A tender can be lost for many reasons. But the reason that is never spoken — and never resolved — is the only one that keeps repeating.

    Other blogs

    See other blogs

  • You Don’t Lose an EU Contract Because of ESG. You Lose It Because Your Buyer Cannot Prove It Can Trust You.

    You Don’t Lose an EU Contract Because of ESG. You Lose It Because Your Buyer Cannot Prove It Can Trust You.

    The notification of the tender outcome arrived by email. Short. Formal. Without explanation.

    “We are unable to continue the cooperation.”

    The director was certain their offer had been competitive. The price was within range. The quality had been confirmed through years of cooperation. But the EU buyer chose another supplier. Not a cheaper one. Not a better one. A more defensible one. Trust Is Not a Feeling. It Is a System. Balkan companies exporting to the EU often believe that trust is a matter of relationships. Years of working together. Personal contacts. A good reputation in the industry. That used to be enough. It is not anymore.

    The Corporate Sustainability Due Diligence Directive has fundamentally changed the logic of supplier selection. An EU buyer subject to the CSDDD must control risks throughout its entire value chain. That means your buyer is not simply choosing your product or service. It is also choosing your ability to demonstrate that, by working with you, it can meet its own obligations. If you cannot do that — you are not simply a supplier without ESG documentation. You are a risk the buyer has to eliminate.

    What an EU Buyer Actually Checks

    When a serious EU buyer evaluates a supplier in its value chain, the question is no longer simply:

    “Is your product of good quality?”

    The question is:

    “Can you demonstrate that what you claim about your business is based on verifiable facts?”

    That includes:

    • how your sustainability data was generated
    • who verified it
    • what controls are in place
    • who is responsible for its accuracy
    • and whether an independent party could reach the same conclusion based on your documentation

    This is not an ESG questionnaire completed once a year. It is a test of systemic capability. And if your system cannot answer those questions — the buyer has a problem. And you are that problem.

    Why Does It Happen Quietly?

    Balkan companies rarely discover the real reason they lost an EU contract. The buyer does not say: “Your evidence architecture did not meet our due diligence standards.” It says: “We have decided to go in a different direction.” Or it says nothing at all. The risk is invisible. The consequences are felt. And by the time a company realises that the problem is in its system — rather than its price, quality or relationship — the contract has already been lost. Sometimes forever.

    The Difference Between a Supplier and a Defensible Partner

    In the EU market of 2026, there are two categories of suppliers. Those who have data. And those who can demonstrate that their data was generated through a controlled, verified and defensible process. The first category completes questionnaires. The second category builds trust. A buyer that must answer for its entire value chain — before an auditor, regulator or investor — will not choose the first category when it can find the second. Even when the first is cheaper.

    Trust as an Economic Asset

    This is not an abstract story about ESG. This is a story about who wins the business. A company that can demonstrate the origin of its data, control over its processes and accountability for its decisions — does not simply reduce risk for the buyer. It creates economic value measured in contracts, continuity and market access. A company that cannot — waits for an email notification. Without an explanation.

    The Question Every Board Should Ask Today

    If your most important EU buyer had to demonstrate tomorrow, before an auditor or regulator, that it can safely do business with you:

    What would it show?

    If the answer is unclear — the problem is not your product. The problem is the system behind every claim you make about your business. Trust is not built through statements. It is built through evidence.

    Other blogs

    See other blogs

  • The Company That Can Prove Its Decisions Has a Different Risk Profile

    The Company That Can Prove Its Decisions Has a Different Risk Profile

    One loses a contract renewal. The other wins new business from the same buyer. The difference was not price. It was not quality. It was not relationship.

    It was the ability to demonstrate, under scrutiny, why a material decision was reasonable — and to produce the evidence to prove it.

    Risk Is Not Only About What Can Go Wrong

    Most organisations manage risk by identifying what could fail and building controls to prevent it. That is necessary. It is not sufficient. There is a second dimension of risk that fewer organisations have addressed.

    When a decision is challenged — by an investor, a regulator, a counterparty, an assurance practitioner — can the organisation demonstrate why it acted reasonably?

    Not assert it. Demonstrate it. The difference between those two words is the difference between a statement and a proof.

    And in a business environment where sustainability disclosures, AI-assisted decisions, supply chain representations and board statements are increasingly subject to independent scrutiny, that difference carries economic consequences.

    What Scrutiny Actually Tests

    When a material corporate decision comes under scrutiny, the question is rarely whether the decision was correct.

    It is whether the process that produced it was controlled, documented and defensible. An assurance practitioner does not ask whether your Scope 3 number looks reasonable. They ask how it was produced, who verified it, what controls were applied and whether the evidence has been preserved. A regulator investigating a greenwashing claim does not ask whether you intended to mislead.

    Among other questions, they ask whether the claim was substantiated at the time it was made — though the precise standard will depend on the applicable jurisdiction and regulatory framework.

    An investor conducting due diligence does not ask whether your governance appears sound. They ask whether you can demonstrate that it functioned — through documentation, process records and accountability structures that existed before the question was asked.

    In each case, the underlying question is increasingly the same. Not what you claim. What you can prove.

    The Gap Most Organisations Have Not Closed

    Most organisations have invested significantly in compliance systems, reporting frameworks and risk controls. Very few have asked a different question.

    If any material decision, statement or data point in our corporate reporting were challenged tomorrow — could we demonstrate how it was produced, who verified it, what controls governed it and why it should be trusted?

    That question is not about compliance. It is about defensibility. And the gap between compliance and defensibility is where risk lives — quietly, invisibly, until scrutiny arrives.

    Why This Creates a Different Risk Profile

    An organisation that can demonstrate the defensibility of its decisions operates differently from one that cannot. It enters due diligence processes with less friction. It responds to regulatory inquiries with documented evidence rather than reconstructed narratives. It provides assurance practitioners with what they need before they ask for it.

    It gives investors and counterparties a basis for trust that goes beyond representation. It protects the individuals who approved material decisions — because those decisions were made within a system capable of demonstrating why they were reasonable. That is not a compliance advantage. It is a governance advantage. And increasingly, it is a commercial one.

    The Infrastructure Question

    Modern organisations invest in financial controls, cybersecurity systems, compliance programmes and reporting platforms. Each addresses a specific category of risk. But there is a category of infrastructure that fewer organisations have built. A system capable of demonstrating — at any point, to any legitimate challenger — why a material corporate decision, statement or data point should be trusted. Not because the organisation says so. Because the evidence shows it.

    That infrastructure does not replace compliance. It completes it. Because compliance tells an organisation what must be done. Defensibility infrastructure demonstrates that what was done can be proven.

    The Question Every Board Should Ask

    If your most material corporate decision from the last twelve months were challenged tomorrow — not in court, but by an investor, a regulator or a counterparty conducting due diligence — could your organisation demonstrate:

    • How that decision was reached?
    • Who was accountable for it?
    • What evidence existed at the time to support it?
    • And whether that evidence has been preserved in a form that survives independent scrutiny?

    If the answer is uncertain, the organisation does not have a compliance problem. It has a defensibility gap. And in a business environment where the scrutiny of corporate decisions is becoming more systematic, more rigorous and more consequential — that gap has a cost. The organisations that will navigate this period successfully will not necessarily be those that comply the most. They will be the organisations that can demonstrate not only what they did — but why they did it, who was accountable, and what evidence existed when the decision was made. That is defensibility.

    Other blogs

    See other blogs

  • If You Use AI for ESG Reporting, Who Is Legally Responsible?

    If You Use AI for ESG Reporting, Who Is Legally Responsible?

    Artificial intelligence may accelerate sustainability reporting. It does not transfer accountability.

    Management signed the assertions.

    The sustainability report was prepared with AI assistance. Data was aggregated, analysed and formatted by an automated system. The board approved the report. Management signed the assertions. Six months later, during an assurance engagement, one question was asked. “Who validated this output before it was disclosed?” No one had a clear answer. Not because the AI had failed. Because no one had defined who remained responsible for what the AI produced. That distinction is becoming one of the most important governance questions organisations will face.

    The Question Nobody Is Asking

    Organisations are adopting AI tools for ESG reporting at remarkable speed. Data aggregation. Materiality assessments. Narrative generation. Gap analysis. The efficiency gains are undeniable.

    The governance gap is growing just as quickly. Poor governance around AI is no longer only a legal exposure. It is becoming a commercial one. Investors increasingly examine governance quality. Customers increasingly ask how sustainability information is produced. Assurance practitioners increasingly expect organisations to demonstrate that AI-supported outputs remained under meaningful human control. Most organisations still treat AI as a productivity tool. Increasingly, regulators expect organisations to demonstrate that AI-supported decisions remain subject to effective governance and documented human oversight. The legal question is no longer whether AI was used. It is whether its use was governed. That distinction matters. A tool may fail. A governance failure belongs to people.

    Where the EU AI Act Changes the Conversation

    The EU AI Act signals a broader regulatory direction. Where AI systems fall within its scope, organisations are expected to establish meaningful human oversight that is documented, operational and assigned to competent individuals. Even where a particular ESG AI application does not fall within the Act’s high-risk classification, the governance question remains remarkably similar. If AI contributes to corporate disclosures, organisations should be able to demonstrate: Who reviewed the output. Who understood its limitations. Who exercised independent professional judgement. Who accepted responsibility before relying on it. That expectation does not depend solely on whether a specific legal obligation applies. It reflects a broader governance principle that organisations increasingly cannot ignore. Sometimes, one question from an assurance practitioner, regulator or investor is enough to reveal whether that governance actually exists.

    Where ESG and AI Accountability Intersect

    Sustainability disclosures are not neutral documents. They are governance statements made to investors, regulators, customers and the market.
    When AI contributes to those statements — whether by aggregating data, generating narratives or supporting materiality assessments — the question of accountability does not disappear. It simply changes direction. It moves toward the people who selected the technology. Toward those who reviewed the output. Toward those who approved the disclosure. Under the Corporate Sustainability Reporting Directive, sustainability reporting has become part of corporate governance rather than a purely operational reporting exercise. The EU AI Act reinforces another principle: technology does not remove human responsibility. Together, these developments expose a governance gap that many organisations have not yet recognised.

    The Governance Gap Few Organisations Have Closed

    Most organisations using AI in ESG reporting have not answered three fundamental questions. Who is responsible for validating AI-assisted ESG outputs before disclosure? What competence does that person require to exercise meaningful oversight? How is that review documented in a way capable of withstanding assurance, regulatory scrutiny or legal challenge? Without clear answers, AI risk has not been managed. It has merely been transferred into a process without identifiable accountability. From a legal perspective, responsibility follows the decision-maker — not the instrument used to reach the decision. AI changes the process. It does not change that principle. And when scrutiny begins, accountability always returns to the people who approved the outcome. It never remains with the technology.

    The Board Dimension

    Boards approving sustainability reports increasingly face a governance question rather than a technology question.
    Approving a sustainability report is not simply authorising a document. It is confirming that the information within that document was generated, reviewed and preserved through a process the organisation understands — and can defend. If AI contributed to that process, but governance over its use was never clearly defined, documented or supervised, the board may struggle to demonstrate why reliance on those outputs was reasonable. The EU AI Act does not create accountability for governance. It makes existing governance expectations more visible.

    Why This Is Also an Economic Issue

    Weak governance around AI does not only increase legal exposure. It affects business value.

    An organisation that cannot demonstrate control over AI-assisted sustainability information may face:

    • greater assurance costs
    • slower procurement processes
    • reduced investor confidence
    • increased regulatory scrutiny
    • diminished credibility with customers and business partners

    Trust has become an economic asset. Governance is increasingly the mechanism through which that trust is earned.

    What Accountability Actually Requires

    AI can accelerate ESG reporting. It cannot replace governance. Nor can it replace evidence.

    Responsible AI-assisted sustainability reporting requires:

    • documented human oversight identifying who reviews AI outputs, with what competence and under what authority
    • evidence demonstrating that AI operated within a controlled governance process rather than replacing informed human judgement
    • governance structures capable of demonstrating that every material sustainability statement was reviewed, challenged and approved before disclosure

    Technology may generate information. Only governance transforms information into something organisations can responsibly disclose.

    The Question Every Board Should Ask

    If tomorrow an assurance practitioner, regulator or investor challenged one AI-assisted statement in your sustainability report, could your organisation demonstrate:
    Who reviewed it? How it was reviewed? Why it was considered sufficiently reliable? Who accepted responsibility before it was disclosed? If the answer is uncertain, the problem is not the AI. The problem is the governance architecture surrounding it. Because in law, accountability does not follow the tool. It follows the decision to use it.

    PROOFA™ Evidence Architecture™

    Artificial and PROOFA™ Evidence Architecture™

    Artificial intelligence does not reduce the need for evidence. It increases it.

    PROOFA™ Evidence Architecture™ was developed as the first legal operational instrument integrating forensic methodology, ESG governance, Legal Design Thinking and evidence architecture into a single defensibility framework.

    It is not an AI governance framework. It does not regulate artificial intelligence. It structures the human accountability, evidentiary integrity and governance architecture that must exist before AI-assisted information becomes part of a corporate sustainability disclosure.

    Because organisations will not ultimately be judged by whether they used AI. They will be judged by whether they can demonstrate who remained accountable after they did.

    This article discusses governance considerations arising at the intersection of AI-assisted sustainability reporting and emerging European regulatory frameworks. References to the EU AI Act reflect its broader governance direction and should not be understood as suggesting that every AI application used in ESG reporting is automatically classified as a high-risk AI system under the Act.

    Other blogs

    See other blogs

  • Scope 3 Data: The Reason You Can Lose an EU Customer Before You Understand Why

    Scope 3 Data: The Reason You Can Lose an EU Customer Before You Understand Why

    The company submitted Scope 3 data to its EU partner. The partner included it in its sustainability report. During the assurance engagement, one question was asked. “What is this figure based on?” Silence filled the room. Not because the data did not exist. But because there was no system that could prove how it was generated.

    Scope 3 is not a number. It is a chain of accountability. Most Balkan exporters view Scope 3 as a calculation. You add up supplier emissions, add transportation, apply the appropriate emission factors, and get a number that goes into the report.

    But Scope 3 is not just a number. A number without a defensible methodology is not evidence. It is only a claim. The Corporate Sustainability Reporting Directive does not only require data disclosure. As sustainability reporting and assurance requirements mature, companies are expected to be able to demonstrate how the data was generated, what sources it is based on, who reviewed it, and what controls were applied before it was disclosed. That is the fundamental difference between information and defensible information.

    Where Balkan Exporters Actually Stand

    Today, two types of exporters are most commonly encountered in practice. The first provides data collected from different spreadsheets, estimates and industry averages.

    The second does not even have that. It sends certificates that are several years old, a director’s statement or partial documentation and hopes it will be sufficient. Both approaches have the same problem. An EU partner preparing a sustainability report must be able to explain how it arrived at every material data point and why it can be trusted. If the supplier cannot demonstrate this, the problem is no longer only on the supplier’s side. The problem moves to the buyer that includes that data in its own report. A supplier that cannot prove its data becomes a liability in the value chain. And companies seek to reduce liabilities - not increase them.

    The Weakness That Becomes Visible Only When Assurance Begins

    Scope 3, particularly emissions associated with purchased goods and services, is among the most complex areas of sustainability reporting. The reason is not a lack of data. The reason is its defensibility. During an assurance engagement, attention is not focused only on the number. Questions such as these are asked:

    • Where does the data originate?
    • What methodology was used to calculate it?
    • Who reviewed it?
    • What controls were applied?
    • Can its path from source to final disclosure be demonstrated?

    It is precisely on these questions that many systems begin to show their weaknesses. Not because the data does not exist. But because it was never structured to be verifiable.

    When Data Cannot Withstand Scrutiny

    The consequences are not always regulatory. Very often they are commercial - and they come faster. An EU partner may conclude that the submitted data is not sufficiently reliable to include in the report. It may classify it as an estimate with additional explanations. It may request extensive supplementary documentation. Or it may conclude that it is simpler to find a supplier with better-quality information.

    In concrete scenarios, it looks like this:

    The partner excludes your data from the report. Your contribution becomes “unavailable data” - a scope limitation in assurance terminology. The partner receives a qualified report. It begins looking for another supplier. The partner includes your data with a note that it is estimate-based. The auditor flags a methodological weakness. The partner must publicly explain the issue in its supply chain. It begins looking for another supplier. The partner includes your data without a note. The assurance process determines that it cannot be verified. The question moves toward the person who approved its inclusion in the verified report.

    In all three scenarios - a supplier that cannot prove its data loses its position in the chain.

    This Is No Longer a Regulatory Question

    Many Balkan companies still believe that CSRD does not affect them because they are not formal CSRD obligations. Formally, that may be true. From a market perspective, it means less and less. Your EU partners are subject to the requirements. Their obligations shape their supplier selection criteria. When they are required to provide reliable sustainability reporting, they will expect the same reliability standards from their value chain. Not because the law directly imposes this on you. But because without reliable data, they cannot fulfil their own obligations. That is why Scope 3 becomes a business issue long before it becomes a regulatory one.

    The Question Every Board Should Ask Today If your EU partner had to explain the origin of the Scope 3 data you provided tomorrow, would you be able to demonstrate:

    • how the data was generated
    • which methodology you used
    • who reviewed it
    • which controls were carried out before it was submitted
    • and why an independent party should trust it?

    If the answer is unclear, the problem is not the number. The problem is the system that produced that number.

    Scope 3 Will Become a Test of Trust

    Scope 3 data is not an accounting exercise. It is becoming a test of a company’s reliability within the European value chain. Companies that can demonstrate the origin, control and credibility of their data will become more desirable partners. Those that cannot will increasingly discover that the reason they lost a contract was not price. It was trust.

    PROOFA™ Evidence Architecture™ was developed precisely for this new phase of ESG - as the first legal-operational instrument that connects the forensic logic of evidence, sustainability reporting requirements and the principles of Legal Design Thinking into a unified defensibility architecture. Not as software. Not as a reporting tool. But as a system that enables information to become evidence before someone else starts examining it.

    Other blogs

    See other blogs

  • Board Liability in the Age of ESG Assurance

    Board Liability in the Age of ESG Assurance

    The board approved the sustainability report.

    Management signed the assertions.

    Six months later, the assurance practitioner asked one question.

    No one in the room could answer it.

    The report was accurate.

    The system that produced it was not defensible.

    That distinction is now a board-level problem.

    The Shift That Most Boards Have Not Yet Made

    For years, sustainability reporting was treated as a disclosure exercise.

    Collect the data. Prepare the report. Meet the deadline.

    Boards reviewed outputs.

    They rarely examined the systems that produced them.

    That approach was manageable when assurance expectations were limited and sustainability information existed outside the formal accountability structure of the organisation.

    That is no longer the case.

    As the Corporate Sustainability Reporting Directive embeds sustainability information into formal corporate reporting, and as the International Standard on Sustainability Assurance establishes the reference point for assurance engagements, the position of the board changes fundamentally.

    Sustainability information is no longer an operational matter reviewed by a specialist team.

    It is a governance matter for which the board is accountable.

    What Board Approval Actually Means

    Many directors still experience ESG report approval as a procedural step.

    Sign here. Move to the next agenda item.

    The legal and operational reality is different.

    When a board approves a sustainability report, it is not simply endorsing a document.

    It is asserting that the information contained in that document was generated, verified and preserved through a system capable of withstanding independent scrutiny.

    That assertion has consequences.

    If the system behind the report cannot demonstrate effective controls over data origin, verification procedures, governance responsibilities and evidence preservation — the board has approved something it cannot defend.

    And under mature assurance frameworks, that gap does not remain invisible for long.

    The Question Boards Are Not Asking

    Boards regularly discuss regulatory risk.

    They discuss reputational risk.

    They discuss financial exposure.

    They rarely ask the question that matters most in an assurance environment:

    If an assurance practitioner examined the system that produced this report — not the report itself — could we demonstrate that every material statement was generated through a controlled, verifiable and defensible process?

    That is not a reporting question.

    It is a governance question.

    And it belongs on the board agenda before the report is approved — not after scrutiny begins.

    Personal Exposure — Where Governance Becomes Individual

    Board liability in the context of ESG assurance is not abstract.

    When a sustainability statement becomes the subject of regulatory scrutiny, investor challenge or litigation, the inquiry does not stop at the level of the legal entity.

    It moves toward the individuals who approved the disclosure.

    The question shifts from:

    “Did the organisation get this wrong?”

    to:

    “Who approved a statement they could not substantiate?”

    Directors who have relied on the assumption that corporate liability shields personal accountability are encountering a different reality.

    As assurance standards mature and sustainability disclosures become increasingly material to investment decisions, regulatory compliance and legal exposure — the personal dimension of board approval becomes impossible to ignore.

    That responsibility cannot be delegated to the sustainability team.

    It cannot be delegated to software.

    It cannot be delegated to external consultants.

    It sits with the governance structure that approved the report.

    What Assurance-Ready Governance Actually Requires

    Assurance readiness is not achieved by possessing audit trails and documented workflows.

    Those are necessary. They are not sufficient.

    A board that is genuinely prepared for the assurance environment must be able to demonstrate that the organisation operates a control environment — not merely a reporting workflow.

    That means:

    Information is generated through defined processes with clear ownership.

    Data is subject to verification procedures designed to identify errors and unsupported assumptions.

    Evidence is preserved in a demonstrable state, protected from unauthorised alteration.

    Governance responsibilities, approvals and accountability mechanisms are formally established and documented.

    Without these elements, the board is approving a report it cannot defend.

    With them, approval becomes an informed governance act — not a procedural formality.

    The Governance Question for 2027

    The organisations that navigate this period successfully will not necessarily be those that produce the most comprehensive sustainability reports.

    They will be the organisations whose boards understood one thing early:

    Approving a report and being able to defend it are not the same act.

    The first requires a signature.

    The second requires a system.

    As assurance environments continue to mature, the question facing every board is no longer whether the report appears credible.

    It is whether the governance structure behind it can demonstrate why it should be.

    Other blogs

    See other blogs

  • Greenwashing is no longer a marketing problem - when does it become personal liability for management?

    Greenwashing is no longer a marketing problem - when does it become personal liability for management?

    The company stated that its supply chain was “fully aligned with sustainability standards.”

    The prosecutor asked a single question.

    There was no answer.

    This is no longer a story about poor communication.

    It is a story about how one sentence in marketing material can become evidence in a legal proceeding.

    Greenwashing has changed its address

    Until now, greenwashing was mainly a reputational issue.

    A journalist asks a question.
    An NGO publishes a report.
    The company apologizes and changes its PR agency.

    The Corporate Sustainability Due Diligence Directive ends that story.

    The directive does not ask companies to be honest in marketing.

    It asks something harder.

    To be able to prove - at any moment - how a claim was formed, who approved it, and on what verifiable facts it is based.

    Not only within the company.

    Across the entire value chain.

    When a company publicly claims it complies with sustainability standards but cannot show evidence of due diligence behind that claim, we are no longer talking about a marketing error.

    We are talking about a systemic failure.

    And systemic failures have legal consequences.

    From reputational to legal risk

    This is the point that most Balkan exporters to the EU market have not yet understood.

    The Corporate Sustainability Due Diligence Directive introduces civil liability for damage caused by failures in value chain due diligence.

    But the practical consequences go much further.

    When it is established that a public sustainability statement was false, and the company did not have a system capable of preventing or detecting it, the door opens to:

    • civil lawsuits from affected parties in the value chain
    • administrative penalties that can reach a significant percentage of global annual turnover
    • potential criminal liability in jurisdictions where false public statements, misleading business practices, or failure of oversight can trigger existing criminal law mechanisms

    For an exporter from the Balkans, this is not an abstract threat from Brussels.

    This is a risk that travels through contracts.

    With every EU partner who is required to apply due diligence across their entire supply chain - including you.

    Why “good faith” is legally irrelevant

    Directors often believe they are protected by good intentions.

    “We believed the supplier was compliant.”
    “We did not know about the violation.”
    “We acted in good faith.”

    Legally speaking, good faith without a documented process is not a defense.

    It is an admission that no system existed.

    The Corporate Sustainability Due Diligence Directive does not ask whether you believed everything was fine.

    It asks:

    “Did you have a process that could confirm it?”

    With documented steps.
    Identified risks.
    Mitigation measures.
    And evidence that can be shown to an independent body.

    If that process does not exist, the claim of “belief” stops being protection.

    It becomes evidence of negligence.

    Personal exposure of directors - when greenwashing stops being a PR issue

    This is where greenwashing changes category.

    When a public sustainability claim becomes the subject of an investigation, the focus does not stop at the company.

    It shifts toward the individual who:

    • approved the claim
    • signed the report
    • presented the company as compliant

    This is the moment when the question changes from:

    “Did the company make a mistake?”

    to:

    “Who personally approved a statement that turned out to be false?”

    Directors who are used to responsibility staying at the level of the legal entity are facing a new reality:

    Responsibility moves upward to them personally once it is established that no adequate due diligence process existed.

    What this means for Balkan exporters - today

    If your company exports to the EU, directly or through an intermediary, your partner is likely already required to obtain evidence of your due diligence process.

    Not a statement. Evidence.

    The question every board should ask today:

    If your public sustainability claim were challenged tomorrow - do you have a documented process that identified, assessed, and addressed the risk before it became harm?

    If the answer is unclear, the problem is not marketing.

    The problem is the system architecture behind every public claim.

    Greenwashing is no longer a communication style issue

    The 2027 market will not punish companies that poorly communicate sustainability.

    It will punish companies that cannot prove that behind every claim there was a process capable of verifying it - before someone else does.

    Greenwashing is no longer a reputational issue.

    It has become a test of whether management can prove it knew - or should have known - what stands behind the claim it approved.

    And in law, that difference often decides between mistake and liability.

    Other blogs

    See other blogs

  • ISSA 5000 Will Not Test Your ESG Report - It Will Test Your System

    ISSA 5000 Will Not Test Your ESG Report - It Will Test Your System

    For years, sustainability reporting has been evaluated primarily through the lens of disclosure.

    Organisations focused on whether required metrics were reported, whether narratives were coherent, and whether sustainability statements aligned with applicable reporting frameworks.

    That era is ending.

    As assurance expectations mature and the International Standard on Sustainability Assurance (ISSA 5000) becomes the reference point for assurance engagements, the focus is shifting away from what organisations disclose and toward how that information is generated, controlled, validated and preserved.

    The distinction may appear subtle.

    In practice, it changes everything.

    The Traditional ESG Mindset

    Most ESG programmes evolved around reporting obligations.

    Data was collected from multiple departments, consolidated in spreadsheets or reporting platforms, reviewed by sustainability teams and ultimately transformed into disclosures.

    The primary objective was completeness.

    Can we gather the information?

    Can we prepare the report?

    Can we meet the deadline?

    In this environment, systems were designed to facilitate reporting workflows.

    They were not necessarily designed to create defensible evidence.

    As long as disclosures appeared reasonable and assurance expectations remained limited, that distinction often went unnoticed.

    ISSA 5000 changes the equation.

    The Question Is No Longer About the Report

    Historically, organisations have been accustomed to questions such as: 


    Does the disclosure comply with the framework?


    Is the reported information consistent?


    Can management explain the methodology?


    These questions focus on outputs.

    ISSA 5000 introduces a different perspective.

    The assurance practitioner must obtain sufficient appropriate evidence regarding sustainability information.

    That requirement inevitably shifts attention toward the underlying system.

    The real question becomes:

    Can the organisation demonstrate effective control over the generation, verification and preservation of sustainability information?

    This is not a reporting question.

    It is a systems question.

    Assurance Begins Long Before the Report

    Many organisations still view assurance as a review conducted near the end of the reporting cycle.

    That assumption is increasingly problematic.

    Evidence quality is determined at the moment information is generated, not when it is reported.

    If source data lacks ownership, validation logic, preservation controls or documented procedures, no amount of late-stage review can fully compensate for those weaknesses.

    Assurance therefore begins upstream.

    It begins with:

    • Data origin
    • Control design
    • Validation procedures
    • Governance responsibilities
    • Evidence preservation

    The report merely reflects the effectiveness of those elements.

    Why Architecture Matters

    Most ESG systems were built to consolidate disclosures.

    Very few were built to preserve evidence.

    This distinction becomes critical under assurance.

    A reporting platform may successfully aggregate information from dozens of sources.

    However, assurance requires more than aggregation.

    It requires organisations to demonstrate:

    • How information entered the system
    • Who verified it
    • Which controls were applied
    • Whether changes were tracked
    • Whether evidence was preserved

    Whether management can demonstrate the state of information at the time of attestation

    Without structured evidence architecture, organisations may possess data but lack defensible proof.

    That gap often remains invisible until scrutiny occurs.

    From Workflow to Control Environment

    The operational implication of ISSA 5000 is straightforward.

    ESG systems can no longer be viewed as reporting tools alone.

    They must function as control environments.

    A mature sustainability information system should be capable of demonstrating:

    • Generation Controls: Information is produced through defined processes with clear ownership and documented methodologies.
    • Verification Controls: Data is subject to review procedures designed to identify errors, inconsistencies and unsupported assumptions.
    • Preservation Controls: Evidence is protected from unauthorised alteration and maintained in a demonstrable state.
    • Governance Controls: Responsibilities, approvals and accountability mechanisms are formally established and documented.

    These controls collectively form the foundation of assurance readiness.

    Audit Readiness Is Not Defensibility

    Many organisations believe they are prepared because they possess audit trails and documented workflows.

    Those capabilities are important.

    They are not sufficient.

    An audit trail records activity.

    Defensibility requires evidence preservation.

    Audit readiness assumes cooperation.

    Defensibility anticipates scrutiny.

    As sustainability disclosures become increasingly relevant to investors, regulators and litigation risk, organisations must consider not only whether information can be reviewed, but whether it can be defended.

    The difference is significant.

    One supports reporting.

    The other supports accountability.

    The Governance Dimension

    Perhaps the most overlooked implication of ISSA 5000 is governance.

    Boards approve sustainability reports.

    Management signs assertions.

    These actions transform sustainability information from an operational matter into a governance matter.

    The question facing leadership is therefore not:

    “Can we produce the report?”

    But:

    “Can we demonstrate that the information was generated, verified and preserved under effective controls?”

    That responsibility cannot be delegated to software.

    It cannot be delegated to consultants.

    Ultimately, it belongs to the organisation’s governance structure.

    The Future of Assurance

    The organisations that will navigate the next phase successfully are not necessarily those that disclose the most information.

    They will be the organisations that understand how evidence is created, controlled and preserved.

    ISSA 5000 is not simply raising expectations for sustainability reports.

    It is raising expectations for sustainability systems.

    And as assurance environments continue to mature, the decisive question will not be whether a report appears credible.

    It will be whether the system behind it can demonstrate why it is.

    Other blogs

    See other blogs

  • Who Signs the ESG Report in 2027 – and Do They Understand What They Are Signing?

    Who Signs the ESG Report in 2027 – and Do They Understand What They Are Signing?

    Most companies still view ESG as a compliance project.

    That is a dangerous misconception.

    Because the moment a sustainability report becomes part of formal corporate reporting, the question is no longer:

    “Who prepared the data?”

    The question becomes:

    “Who signed that it is accurate?”

    And that is precisely where the new era of management accountability begins.

    ESG Is No Longer an ESG Team Issue

    The Corporate Sustainability Reporting Directive (CSRD) did not merely expand the scope of disclosures.

    It changed the location of responsibility.

    Sustainability is no longer treated as a separate function.

    It becomes part of corporate governance.

    In other words:

    ESG data enters the sphere of responsibility of management boards and supervisory boards.

    And entirely different rules apply there.

    Effort is not evaluated.

    Evidence is.

    What Does Board Attestation Actually Mean?

    Many directors still perceive an ESG report as a document prepared by the sustainability team.

    From a legal perspective, the situation looks different.

    When management approves a report, it implicitly confirms that it believes in the reliability of the data contained within it.

    That does not mean a director must personally collect every piece of data.

    But it does mean they must have reasonable assurance that the system producing it functions properly.

    This is exactly why regulatory focus is increasingly shifting from the content of the report to the system that generates it.

    The Most Dangerous Question an Auditor Can Ask

    There is one question capable of collapsing an entire ESG narrative:

    “How do you know this data is accurate?”

    Not:

    “Where is the number?”

    But:

    “How was it created?”

    If an organization cannot demonstrate:

    • the source of the data
    • the responsible person
    • the methodology
    • the control points
    • the audit trail

    then the problem is not the data.

    The problem is the system.

    And when the system fails, the credibility of the report fails with it.

    Personal Exposure of Directors

    Boards frequently discuss regulatory risk.

    They discuss personal exposure far less often.

    Yet this is where the greatest change is taking place.

    When an ESG claim becomes the subject of regulatory scrutiny, an audit, or a dispute, attention naturally shifts to the person who approved its publication.

    The question is no longer:

    “Who made the mistake?”

    But:

    “Who assumed responsibility?”

    At that moment, ESG ceases to be an operational issue.

    It becomes a matter of professional accountability.

    A Document Is Not Evidence

    Many organizations have hundreds of ESG documents.

    Policies. Procedures. Reports. Presentations.

    But a document is not evidence.

    Evidence exists only when it is possible to demonstrate:

    • the origin of the information
    • the integrity of the information
    • continuity of control
    • the ability to independently verify it

    Without that, a document remains only a claim.

    The Question Every Board Should Be Asking Today

    If tomorrow you had to defend a single ESG claim before an auditor, regulator, or investor:

    Could you prove how it was created?

    If the answer is uncertain, the problem is not the report.

    The problem is the system architecture.

    Because in 2027, the market will not reward the longest ESG reports.

    It will reward organizations that can demonstrate that every claim within them was created through a controlled, verifiable, and defensible process.

    The ESG of the future is not a question of narrative.

    It is a question of the signature beneath it.

    Other blogs

    See other blogs
ENG
ENG MNE