Category: Regional

  • Scope 3 Data: The Reason You Can Lose an EU Customer Before You Understand Why

    Scope 3 Data: The Reason You Can Lose an EU Customer Before You Understand Why

    The company submitted Scope 3 data to its EU partner. The partner included it in its sustainability report. During the assurance engagement, one question was asked. “What is this figure based on?” Silence filled the room. Not because the data did not exist. But because there was no system that could prove how it was generated.

    Scope 3 is not a number. It is a chain of accountability. Most Balkan exporters view Scope 3 as a calculation. You add up supplier emissions, add transportation, apply the appropriate emission factors, and get a number that goes into the report.

    But Scope 3 is not just a number. A number without a defensible methodology is not evidence. It is only a claim. The Corporate Sustainability Reporting Directive does not only require data disclosure. As sustainability reporting and assurance requirements mature, companies are expected to be able to demonstrate how the data was generated, what sources it is based on, who reviewed it, and what controls were applied before it was disclosed. That is the fundamental difference between information and defensible information.

    Where Balkan Exporters Actually Stand

    Today, two types of exporters are most commonly encountered in practice. The first provides data collected from different spreadsheets, estimates and industry averages.

    The second does not even have that. It sends certificates that are several years old, a director’s statement or partial documentation and hopes it will be sufficient. Both approaches have the same problem. An EU partner preparing a sustainability report must be able to explain how it arrived at every material data point and why it can be trusted. If the supplier cannot demonstrate this, the problem is no longer only on the supplier’s side. The problem moves to the buyer that includes that data in its own report. A supplier that cannot prove its data becomes a liability in the value chain. And companies seek to reduce liabilities - not increase them.

    The Weakness That Becomes Visible Only When Assurance Begins

    Scope 3, particularly emissions associated with purchased goods and services, is among the most complex areas of sustainability reporting. The reason is not a lack of data. The reason is its defensibility. During an assurance engagement, attention is not focused only on the number. Questions such as these are asked:

    • Where does the data originate?
    • What methodology was used to calculate it?
    • Who reviewed it?
    • What controls were applied?
    • Can its path from source to final disclosure be demonstrated?

    It is precisely on these questions that many systems begin to show their weaknesses. Not because the data does not exist. But because it was never structured to be verifiable.

    When Data Cannot Withstand Scrutiny

    The consequences are not always regulatory. Very often they are commercial - and they come faster. An EU partner may conclude that the submitted data is not sufficiently reliable to include in the report. It may classify it as an estimate with additional explanations. It may request extensive supplementary documentation. Or it may conclude that it is simpler to find a supplier with better-quality information.

    In concrete scenarios, it looks like this:

    The partner excludes your data from the report. Your contribution becomes “unavailable data” - a scope limitation in assurance terminology. The partner receives a qualified report. It begins looking for another supplier. The partner includes your data with a note that it is estimate-based. The auditor flags a methodological weakness. The partner must publicly explain the issue in its supply chain. It begins looking for another supplier. The partner includes your data without a note. The assurance process determines that it cannot be verified. The question moves toward the person who approved its inclusion in the verified report.

    In all three scenarios - a supplier that cannot prove its data loses its position in the chain.

    This Is No Longer a Regulatory Question

    Many Balkan companies still believe that CSRD does not affect them because they are not formal CSRD obligations. Formally, that may be true. From a market perspective, it means less and less. Your EU partners are subject to the requirements. Their obligations shape their supplier selection criteria. When they are required to provide reliable sustainability reporting, they will expect the same reliability standards from their value chain. Not because the law directly imposes this on you. But because without reliable data, they cannot fulfil their own obligations. That is why Scope 3 becomes a business issue long before it becomes a regulatory one.

    The Question Every Board Should Ask Today If your EU partner had to explain the origin of the Scope 3 data you provided tomorrow, would you be able to demonstrate:

    • how the data was generated
    • which methodology you used
    • who reviewed it
    • which controls were carried out before it was submitted
    • and why an independent party should trust it?

    If the answer is unclear, the problem is not the number. The problem is the system that produced that number.

    Scope 3 Will Become a Test of Trust

    Scope 3 data is not an accounting exercise. It is becoming a test of a company’s reliability within the European value chain. Companies that can demonstrate the origin, control and credibility of their data will become more desirable partners. Those that cannot will increasingly discover that the reason they lost a contract was not price. It was trust.

    PROOFA™ Evidence Architecture™ was developed precisely for this new phase of ESG - as the first legal-operational instrument that connects the forensic logic of evidence, sustainability reporting requirements and the principles of Legal Design Thinking into a unified defensibility architecture. Not as software. Not as a reporting tool. But as a system that enables information to become evidence before someone else starts examining it.

    Other blogs

    See other blogs

  • Greenwashing is no longer a marketing problem - when does it become personal liability for management?

    Greenwashing is no longer a marketing problem - when does it become personal liability for management?

    The company stated that its supply chain was “fully aligned with sustainability standards.”

    The prosecutor asked a single question.

    There was no answer.

    This is no longer a story about poor communication.

    It is a story about how one sentence in marketing material can become evidence in a legal proceeding.

    Greenwashing has changed its address

    Until now, greenwashing was mainly a reputational issue.

    A journalist asks a question.
    An NGO publishes a report.
    The company apologizes and changes its PR agency.

    The Corporate Sustainability Due Diligence Directive ends that story.

    The directive does not ask companies to be honest in marketing.

    It asks something harder.

    To be able to prove - at any moment - how a claim was formed, who approved it, and on what verifiable facts it is based.

    Not only within the company.

    Across the entire value chain.

    When a company publicly claims it complies with sustainability standards but cannot show evidence of due diligence behind that claim, we are no longer talking about a marketing error.

    We are talking about a systemic failure.

    And systemic failures have legal consequences.

    From reputational to legal risk

    This is the point that most Balkan exporters to the EU market have not yet understood.

    The Corporate Sustainability Due Diligence Directive introduces civil liability for damage caused by failures in value chain due diligence.

    But the practical consequences go much further.

    When it is established that a public sustainability statement was false, and the company did not have a system capable of preventing or detecting it, the door opens to:

    • civil lawsuits from affected parties in the value chain
    • administrative penalties that can reach a significant percentage of global annual turnover
    • potential criminal liability in jurisdictions where false public statements, misleading business practices, or failure of oversight can trigger existing criminal law mechanisms

    For an exporter from the Balkans, this is not an abstract threat from Brussels.

    This is a risk that travels through contracts.

    With every EU partner who is required to apply due diligence across their entire supply chain - including you.

    Why “good faith” is legally irrelevant

    Directors often believe they are protected by good intentions.

    “We believed the supplier was compliant.”
    “We did not know about the violation.”
    “We acted in good faith.”

    Legally speaking, good faith without a documented process is not a defense.

    It is an admission that no system existed.

    The Corporate Sustainability Due Diligence Directive does not ask whether you believed everything was fine.

    It asks:

    “Did you have a process that could confirm it?”

    With documented steps.
    Identified risks.
    Mitigation measures.
    And evidence that can be shown to an independent body.

    If that process does not exist, the claim of “belief” stops being protection.

    It becomes evidence of negligence.

    Personal exposure of directors - when greenwashing stops being a PR issue

    This is where greenwashing changes category.

    When a public sustainability claim becomes the subject of an investigation, the focus does not stop at the company.

    It shifts toward the individual who:

    • approved the claim
    • signed the report
    • presented the company as compliant

    This is the moment when the question changes from:

    “Did the company make a mistake?”

    to:

    “Who personally approved a statement that turned out to be false?”

    Directors who are used to responsibility staying at the level of the legal entity are facing a new reality:

    Responsibility moves upward to them personally once it is established that no adequate due diligence process existed.

    What this means for Balkan exporters - today

    If your company exports to the EU, directly or through an intermediary, your partner is likely already required to obtain evidence of your due diligence process.

    Not a statement. Evidence.

    The question every board should ask today:

    If your public sustainability claim were challenged tomorrow - do you have a documented process that identified, assessed, and addressed the risk before it became harm?

    If the answer is unclear, the problem is not marketing.

    The problem is the system architecture behind every public claim.

    Greenwashing is no longer a communication style issue

    The 2027 market will not punish companies that poorly communicate sustainability.

    It will punish companies that cannot prove that behind every claim there was a process capable of verifying it - before someone else does.

    Greenwashing is no longer a reputational issue.

    It has become a test of whether management can prove it knew - or should have known - what stands behind the claim it approved.

    And in law, that difference often decides between mistake and liability.

    Other blogs

    See other blogs

  • Who Signs the ESG Report in 2027 – and Do They Understand What They Are Signing?

    Who Signs the ESG Report in 2027 – and Do They Understand What They Are Signing?

    Most companies still view ESG as a compliance project.

    That is a dangerous misconception.

    Because the moment a sustainability report becomes part of formal corporate reporting, the question is no longer:

    “Who prepared the data?”

    The question becomes:

    “Who signed that it is accurate?”

    And that is precisely where the new era of management accountability begins.

    ESG Is No Longer an ESG Team Issue

    The Corporate Sustainability Reporting Directive (CSRD) did not merely expand the scope of disclosures.

    It changed the location of responsibility.

    Sustainability is no longer treated as a separate function.

    It becomes part of corporate governance.

    In other words:

    ESG data enters the sphere of responsibility of management boards and supervisory boards.

    And entirely different rules apply there.

    Effort is not evaluated.

    Evidence is.

    What Does Board Attestation Actually Mean?

    Many directors still perceive an ESG report as a document prepared by the sustainability team.

    From a legal perspective, the situation looks different.

    When management approves a report, it implicitly confirms that it believes in the reliability of the data contained within it.

    That does not mean a director must personally collect every piece of data.

    But it does mean they must have reasonable assurance that the system producing it functions properly.

    This is exactly why regulatory focus is increasingly shifting from the content of the report to the system that generates it.

    The Most Dangerous Question an Auditor Can Ask

    There is one question capable of collapsing an entire ESG narrative:

    “How do you know this data is accurate?”

    Not:

    “Where is the number?”

    But:

    “How was it created?”

    If an organization cannot demonstrate:

    • the source of the data
    • the responsible person
    • the methodology
    • the control points
    • the audit trail

    then the problem is not the data.

    The problem is the system.

    And when the system fails, the credibility of the report fails with it.

    Personal Exposure of Directors

    Boards frequently discuss regulatory risk.

    They discuss personal exposure far less often.

    Yet this is where the greatest change is taking place.

    When an ESG claim becomes the subject of regulatory scrutiny, an audit, or a dispute, attention naturally shifts to the person who approved its publication.

    The question is no longer:

    “Who made the mistake?”

    But:

    “Who assumed responsibility?”

    At that moment, ESG ceases to be an operational issue.

    It becomes a matter of professional accountability.

    A Document Is Not Evidence

    Many organizations have hundreds of ESG documents.

    Policies. Procedures. Reports. Presentations.

    But a document is not evidence.

    Evidence exists only when it is possible to demonstrate:

    • the origin of the information
    • the integrity of the information
    • continuity of control
    • the ability to independently verify it

    Without that, a document remains only a claim.

    The Question Every Board Should Be Asking Today

    If tomorrow you had to defend a single ESG claim before an auditor, regulator, or investor:

    Could you prove how it was created?

    If the answer is uncertain, the problem is not the report.

    The problem is the system architecture.

    Because in 2027, the market will not reward the longest ESG reports.

    It will reward organizations that can demonstrate that every claim within them was created through a controlled, verifiable, and defensible process.

    The ESG of the future is not a question of narrative.

    It is a question of the signature beneath it.

    Other blogs

    See other blogs

  • Do You Export to the EU?

    Do You Export to the EU?

    Your ESG system is already under review – even if you are not subject to CSRD. Many companies in the Balkans still believe: “We are not subject to CSRD. It only applies to large EU companies.” Formally – correct. From a market perspective – completely irrelevant. If you export to the EU, your ESG system is already being assessed. Not by regulators. By your customers.

    You are losing revenue before you even understand why. EU buyers have changed the way they evaluate suppliers. Tender documentation and ESG due diligence questionnaires increasingly require:

    • ESG policies and procedures
    • Emissions data (especially Scope 3)
    • Supply chain data
    • Proof of implemented due diligence processes
    • Management sustainability statements

    This is no longer a reputational issue. It is a market filter. If you cannot demonstrate control over this information – you are not a reliable supplier. And no one will tell you ESG is the reason. You will simply lose the tender.

    Your customer is the obligated party. You are part of their responsibility.

    Under the Corporate Sustainability Due Diligence Directive, large EU companies are required to identify and manage risks across their entire value chain.

    If you cannot provide reliable and verifiable data:

    • the risk transfers to them
    • the responsibility remains with their management
    • reputational exposure increases

    And no serious management team will accept a risk it cannot control. That is why ESG is no longer your internal issue. It is part of their fiduciary duty.

    This is simultaneously a revenue risk and a personal risk.

    For the owner:

    If you cannot prove the reliability of ESG data, you lose access to the EU market. That is a direct impact on revenue, value multiplier, and the long-term sustainability of the company.

    For management:

    When you sign a sustainability statement or confirm ESG data to a customer, that signature is no longer a formality. It is the assumption of professional – and potentially legal – responsibility. And often without any guarantee that the system behind that signature actually exists. The question is not whether you have the data. The question is whether you can prove how it was created, who controlled it, and whether it was preserved without alteration. The distinction between a document and evidence becomes critical.

    The key question that must be asked now – not when the tender begins

    If an EU customer sends you an ESG questionnaire tomorrow, can you:

    • Provide the requested information on time?
    • Explain the methodology of data collection?
    • Show control points and responsible persons?
    • Take responsibility for its accuracy without operational panic?

    Most companies have fragmented data. Very few have system architecture. And architecture is not built under deadline pressure.

    The cascading effect has already begun

    The Corporate Sustainability Due Diligence Directive is moving down the value chain faster than expected. Companies in the textile, wood-processing, metal, and auto-component sectors across the Balkans are already feeling it.

    The wrong question is:

    “Are we subject to CSRD?”

    The real question is:

    “Is our system robust enough to protect revenue – and the signature?”

    System before reporting

    As sustainability reporting frameworks - including those introduced under the Corporate Sustainability Reporting Directive - move toward progressively stronger assurance expectations, systems will not be evaluated only on outputs.

    They will be evaluated on architecture.

    When ESG data flows across departments, suppliers, spreadsheets, external consultants and digital tools, integrity becomes fragmented.

    Audit logs remain.

    Control logic often does not.

    When Governance Meets Evidence

    PROOFA™ Evidence Architecture™ was developed precisely for this transition – as the first legal-operational instrument connecting forensic evidence logic, ESG requirements, and obligations under the Corporate Sustainability Due Diligence Directive into one structure of accountability and defensibility. Not as software. Not as a marketing ESG tool. As an operational instrument that allows management to sign – knowing that a defensible structure exists behind that signature.

    Because the market no longer asks:

    “Do you have an ESG document?”

    It asks:

    “Can you prove it can be trusted?”

    Other blogs

    See other blogs

  • U.S. Supreme Court vs. the Executive Branch: what Balkan exporters need to know

    U.S. Supreme Court vs. the Executive Branch: what Balkan exporters need to know

    Analysis of the decision Learning Resources, Inc. v. Trump and its operational consequences

    What happened?

    On February 20, 2026, the Supreme Court of the United States issued its decision in the case Learning Resources, Inc. v. Trump, invalidating the tariff regime that the presidential administration had introduced under the International Emergency Economic Powers Act (IEEPA). In a 6–3 ruling, the Court held that tariffs are not a regulatory instrument—they are a form of taxation. The power of taxation under the U.S. Constitution belongs to Congress, not the executive branch, and cannot be derived from a general statutory authorization to manage emergencies.

    This is not a narrow trade decision. It is a constitutional ruling on the limits of executive power in the economic sphere.

    The Court applied the Major Questions Doctrine: where executive action carries economic and political significance of vast scale—here, a tariff regime generating between $160 and $175 billion in revenue—clear and explicit congressional authorization is required. General language in emergency legislation does not meet that threshold.

    What followed?

    On March 4, 2026, the U.S. Court of International Trade (CIT) ordered U.S. Customs and Border Protection (CBP) to initiate the process of refunding unlawfully collected duties. CBP is developing an electronic refund system called CAPE within its Automated Commercial Environment (ACE), with an interim deadline of April 20, 2026.

    The administration did not withdraw. It immediately introduced new tariffs—this time under Section 122 of the Trade Expansion Act of 1962, which constitutes clear congressional authorization. The tariff pressure therefore remains, only under a different legal basis.

    The government has until May 4, 2026 to file an appeal against the CIT order. If the appeal succeeds, the right to refunds could be limited only to the parties that initiated legal proceedings.

    Who is entitled to a refund—and why the answer is not simple?

    This is the point where Balkan exporters most often make incorrect assumptions.

    The right to file a claim in the CAPE system belongs exclusively to the importer of record in the United States—the U.S. legal entity that physically imported the goods into the country and paid the duty to CBP. That is your American buyer, distributor, or partner, not your company.

    A Balkan exporter has no direct right to a refund, except in one scenario: if, by contract, it assumed the role of the party bearing the customs burden.

    Here, the contractual structure is decisive.

    Incoterms are standardized rules of the International Chamber of Commerce that determine who bears costs and risks in international sales. Two clauses are operationally relevant:

    • DDP (Delivered Duty Paid) – the seller, i.e. your company, bears all costs including duties in the destination country. If you delivered under DDP in the period April 2025 – February 2026, you effectively bore the customs burden, either through pricing or directly.
    • DAP (Delivered at Place) – the goods arrive at the agreed location, but the duty in the U.S. is paid by the buyer. The customs burden is on the American partner.

    If your American partner operated under DAP, they bore the duty and now potentially have the right to a refund. This does not mean you were harmed in a legal sense. But it does mean that in negotiating new contractual terms, you possess a relevant fact about your partner’s economic position.

    Three operational steps

    Step 1: Review of contractual structure

    Review all contracts concluded or active in the period April 2025 – February 2026. Determine which Incoterms were used and who was contractually responsible for customs costs. This is not an administrative step—it is the legal basis for everything that follows.

    Step 2: Review of deadlines

    For entries that have not yet been liquidated: it is possible to file a post-summary correction directly with CBP. For entries that have been liquidated and where liquidation is not final: it is possible to file a protest under 19 U.S.C. § 1514. These deadlines run regardless of whether your American partner is taking action. If you miss the deadline, the right expires.

    Step 3: Contractual mechanism for the future

    The Learning Resources decision does not guarantee stability of the tariff environment. The administration immediately applied an alternative legal basis for new tariffs. New contracts must include clauses that clearly allocate customs risk and provide a mechanism for adjustment in case of regulatory change—regardless of which party bears the burden in a specific transaction.

    The broader picture

    The Learning Resources decision has implications that go beyond trade law. The U.S. Supreme Court has set a standard: the executive branch cannot assume core legislative powers by invoking general emergency authorities, even in the field of foreign economic policy. That principle—that economic measures of vast scope require clear legislative authorization—also resonates in the European regulatory space, particularly in the context of delegated acts and the implementation of the AI Act.

    For lawyers advising clients with export exposure to the U.S., this is the moment to review not only contractual clauses, but also the overall allocation of regulatory risk in existing and future arrangements.

    Other blogs

    See other blogs

  • CSRD 2026 i Balkan

    CSRD 2026 and the Balkans: Postponement Is Not Relief

    Why proof has become the new currency - and how Balkan companies can win in a game whose rules have just changed.

    While Balkan directors and compliance officers were waking up with their morning coffee at the beginning of March, a decision was made in Brussels that made many breathe a sigh of relief - and the wiser ones think deeply. This change comes through the so-called Omnibus I package, through which the European Union simplifies rules related to sustainability reporting. The directive entered into force on March 19, 2026 and drastically raised the thresholds for CSRD reporting. If you think this is the “end of the headache” - you are mistaken.

    1. The big threshold cleaning: Who's out, who's in?

    The new thresholds are high: companies with more than 1,000 employees and turnover exceeding 450 million euros. For a region like the Balkans, this means that only the “heavyweights” will report directly - power utilities, telecoms and the largest industrial systems. However, this is where what I would call a legal boomerang appears.

    EU partner (Germany, AT, IT) ➡️ Distributor / intermediary ➡️ Your company

    The pressure of responsibility flows down the entire supply chain - even when you are not required to report.

    Even if you are not required to write a 200-page report for Brussels, your partners in Germany, Austria or Italy are. And they will transfer every gram of their responsibility onto you.

    “You did not ask whether I am allowed to request this data from you. I asked him: can you afford not to provide it?”

    2. The Balkan paradox: Less law, more forensics

    As a lawyer working at the intersection of law and system design, I rarely see the problem in the law - I almost always see it in the fact that the law has not been translated into a process.

    Past practice in the region has often come down to “creative writing” of ESG strategies. That is dead letter on paper. With the new amendments, the EU focus shifts from the quantity of reports to the integrity of data. I see this as a transition to evidence forensics. Your European partner no longer asks for your statement that you do not pollute the river.

    WHAT YOUR EU PARTNER IS ACTUALLY ASKING FOR

    • Audit Trail - A digital trace from the sensor in the factory to the director’s signature. Every step documented, time-stamped, immutable.
    • Verifiability - Is that data “resistant” to a court proceeding? If tomorrow you are accused of greenwashing, where is your proof?
    • Consistency - Data from Q1 must be methodologically aligned with data from Q4. Inconsistency is the first gap through which an auditor enters.

    3. Shield for SMEs: The Value-Chain Cap

    One of the few real victories for Balkan small and medium-sized enterprises in Omnibus I is the introduction of a limitation of requests within the supply chain. Large players from the EU are no longer allowed to “harass” small suppliers with requests that exceed voluntary standards for SMEs - which arrive in July 2026.

    This is the key point where Legal Design comes into play. Instead of sending hundreds of unorganized documents, you design a map of proof.

    LEGAL DESIGN IN PRACTICE

    • You show what you do not have to provide - you know your rights and the limits of requests
    • You deliver what you deliver with absolute precision - every data point supported by proof
    • Your legitimacy before investors - you do not say “we are responsible”, you prove it

    4. How to win against the “late burnout effect”?

    In the Balkans we usually wait until the last moment. We negotiate with the deadline, not with the substance. But the architecture of facts is not built overnight - and greenwashing lawsuits do not wait for organization.

    “Digitize the evidence immediately. Not tomorrow, not after the election cycle, not when inspections pass. Immediately.”

    Start digitizing evidence today. Every sensor, every supplier contract, every certificate - into a system that leaves a trace.

    Turn legal obligations into visual processes. Let your compliance system be user-friendly for employees, and impenetrable for auditors. The complexity of the law does not have to be the complexity of your system. Facts are the only constant.

    Facts are the only constant

    Regulation will continue to change. Thresholds will rise and fall. Governments will promise and postpone. But the need for irrefutable proof is here to stay - because it is not only regulatory, it is market-driven.

    For Balkan companies, this is not only a question of ecology. This is a question of legal security and survival in the market.

    In a world where everyone promises sustainability, the one who can prove it will win.

    You thought CSRD was postponed? Think again. For the Balkans, the real game is just beginning. I explain why proof - not promise - is the new currency.

    Check your exposure level with the CSRD / ESG CHECKLIST – BALKAN EDITION Download the CSRD 2026 BLUEPRINT: ESG Proof Architecture

    Other blogs

    See other blogs

  • Ko će potpisati? CSRD i kraj kolektivne odgovornosti u regionalnim kompanijama

    Who Will Sign? CSRD and the End of Collective Responsibility in Regional Companies

    March in the Balkans is traditionally the month of closing annual accounts. But in 2026, March brings a different kind of weight.

    The question will no longer be only: “Is the company profitable?” It will be: “Who will sign the ESG report under full regulatory and governance responsibility?”

    CSRD (Corporate Sustainability Reporting Directive) introduces a fundamental shift:

    responsibility is no longer organizational — it becomes personal.

    What Is Actually Changing?

    Until now, ESG reports in many regional companies have been a combination of:

    • narratives
    • estimates
    • partial data
    • ad-hoc tables

    They were often the result of good intentions, but not of systemic structure.

    CSRD introduces a different logic.

    The ESG report becomes subject to assurance based on proof principles similar to financial reporting.

    At that moment, the question stops being: “Do we have the data?” It becomes: “Who guarantees its accuracy — and can they prove it?”

    The End of Collective Ambiguity

    In regional companies, we often hear:

    • “We are all involved in ESG.”
    • “It’s a team effort.”
    • “We’re doing it together.”

    In the Balkans, responsibility is often implicit, and processes are informal and trust-based.

    CSRD does not recognize team-based ambiguity.

    It requires:

    • Named signatories who guarantee data integrity
    • Formal controls that are documented and verifiable
    • A provable audit trail showing who approved a number, when, and on what basis

    If these structures do not exist, the regulator will not ask why the system was weak.

    They will ask who was responsible for ensuring that the system existed.

    Delegation Is Not Protection

    There is a dangerous misconception that delegating ESG to lower levels protects the Executive Management.

    On the contrary.

    In the absence of a clearly defined Proof Architecture:

    • Middle management becomes operationally blocked because it cannot prove the origin of data
    • Executive Management and the Board become legally and reputationally exposed because they sign documents without full visibility into their traceability
    • Owners become regulator-visible in the event of a negative audit opinion or enforcement measures

    If no one in the company formally signs off on partial data (energy, emissions, waste, labor rights, supplier inputs), ultimate responsibility naturally escalates to the top.

    ESG delegated to operations does not mean leadership is protected.

    In fact, it means the opposite.

    The Regional Weakness That CSRD Exposes

    The biggest challenge in the Balkans is not a lack of knowledge.

    The challenge is that systems are:

    • built for speed, not for provability
    • flexible, but undocumented
    • trust-based rather than control-based
    • often driven by “Excel culture”

    Such systems can function for years.

    But when an auditor asks:

    “Where does this number come from, and who stands behind it with their signature?”

    Improvisation is no longer enough.

    In the absence of a clear accountability architecture, three levels of risk emerge:
    Operational risk – data is inconsistent and incomparable
    Reputational risk – a negative audit opinion signals weak governance
    Governance risk – report signatories assume regulatory and personal responsibility
    CSRD does not sanction bad intent.
    It sanctions lack of control.

    Accountability Architecture as the Only Shield

    The solution is not writing longer ESG narratives.

    The solution is designing a system that protects both the organization and the individual.

    A Proof Architecture must clearly define:

    Layer 1 – Responsibility at the Source
    Operational managers formally confirm primary inputs (ERP systems, invoices, HR systems, energy measurements).

    Layer 2 – Verification Responsibility
    Control mechanisms (the “four-eyes” principle) confirm accuracy and consistency.

    Layer 3 – Traceability
    A digital trail showing every data modification over time.

    Layer 4 – Governance Responsibility
    Clear definition of who has the authority to finalize data for reporting.

    Layer 5 – Disclosure Responsibility
    Formal report sign-off with full awareness of the system behind it.

    Without these layers, every signature on an ESG report is an operational risk.

    Why This Is an Opportunity for the Balkans

    Although it sounds restrictive, CSRD is a moment of professionalization.

    Companies that, by 2026, have a clear accountability map:

    • Reduce dependence on individuals
    • Eliminate “Excel improvisation”
    • Increase credibility with EU partners
    • Protect executive management from unforeseen regulatory consequences
    • Professionalize governance structures

    In a region where reputational shocks are disproportionately strong, a clear accountability architecture becomes a competitive advantage.

    The Final Question for the March Board Meeting

    When the auditor walks into your office and asks: “Where does this number come from, and who stands behind it with their signature?”
    Do you have an answer — or do you have an excuse?

    If you cannot prove ESG, you cannot protect either the company or yourself.

    Check your exposure level with the CSRD / ESG CHECKLIST – BALKAN EDITION Download the CSRD 2026 BLUEPRINT: ESG Proof Architecture

    Other blogs

    See other blogs

  • CSRD and the Reality of the Balkans: Why ESG Without a System Becomes Your Biggest Hidden Risk

    CSRD and the Reality of the Balkans: Why ESG Without a System Becomes Your Biggest Hidden Risk

    As 2026 approaches, CSRD (Corporate Sustainability Reporting Directive) is often perceived in the Balkans as just another administrative requirement that “comes from above.” However, when it collides with local reality, CSRD exposes a deep systemic problem: our systems were never built for provability.

    Many regional companies today have ESG policies and Excel spreadsheets, but they lack what the directive actually requires a provable system that functions every day, not only at the moment the report is written.

    Why Does CSRD Hit the Balkans the Hardest?

    CSRD does not punish the region for being late; it exposes the fact that systems were not built on principles of traceability and auditability. Typical weaknesses that turn into risk include:

    • Excel culture: Reliance on manual processes without a digital trail.
    • Fragmented IT: Systems that do not communicate with each other.
    • The lone ESG officer: Responsibility assigned to a single person instead of an entire governance system.
    • Informal supply chains: Relationships based on trust rather than data.

    ESG Without a System: How Hidden Risk Is Created

    The greatest risk is not the lack of data, but the inability to prove its origin. When an auditor asks the question, “Where does this data come from and who guarantees it?”, the system often remains silent.

    Without a clear proof architecture, your data is merely “he said–she said” information. If the source is unknown, the auditor cannot confirm basic accuracy, leading to the principle of “Garbage in, Garbage out.”

    The Solution: ESG Proof Architecture (5 Layers of Defense)

    For regional companies, the solution is not copying EU templates, but building a structure that enables traceability. Your “defense system” must consist of five key layers:

    • Data Origin (Source of truth): Direct data from ERP systems, smart meters, or invoices. Without this, everything above is guesswork.
    • Verification (Control point): Introducing the “four-eyes” principle — person A enters the data, person B confirms its validity.
    • Traceability (Digital pedigree): A data movement map that enables reconstruction of every number back to its source.
    • Governance (Accountability layer): Signed protocols and a legal framework that guarantee system integrity. If no one signs off on the data, management bears direct legal responsibility.
    • Disclosure (Final window): Output in machine-readable XBRL format visible to regulators and banks.

    Supply Chain: Where CSRD “Breaks”

    In the Balkans, CSRD most often breaks at the supplier level. A single key partner without formal processes is enough to compromise your entire report.

    In the new 2025–2026 reality, one rule applies:

    A weak supplier = Your regulatory problem.

    An Opportunity for Professionalization

    CSRD is not just a cost; it is an opportunity to professionalize your business. Companies that build a provable system reduce long-term risk and strengthen their position in the EU market.

    Remember. If you cannot prove ESG, you cannot defend it.

    CSRD / ESG CHECKLIST – BALKAN EDITION 2026 (Montenegrin) CSRD 2026 BLUEPRINT: ESG Proof Architecture (Montenegrin)

    QUICK SELF-TEST: If an EU client asks you today:

    “Can you deliver ESG data with evidence within 48 hours?”, is your answer YES — or are you at risk?

    Other blogs

    See other blogs

  • CSRD 2026 BLUEPRINT — From ESG Reporting to Proof Architecture

    CSRD 2026 BLUEPRINT — From ESG Reporting to Proof Architecture

    Why a checklist is no longer enough.

    Most companies are entering 2026 with a task list. The problem is that a checklist only shows where you are vulnerable, but it does not tell you what you need to build in order to close those gaps.

    CSRD (Corporate Sustainability Reporting Directive) does not ask you for a better essay or a prettier annual report. CSRD requires a provable system. The difference between “we have data” and “we have a provable system” is the difference between passing and failing an audit.

    That is why today we are not talking about a document. We are talking about a Blueprint.

    I. What CSRD actually requires (and why many misunderstand it)

    CSRD is often, and incorrectly, perceived as just another set of ESG templates. In reality, the regulator is not asking for a narrative, but for systemic attributes:

    • Auditability: Can an external auditor trace every single number?
    • Traceability: Where was the data before it entered the table?
    • Comparability: Are your data points consistent with industry standards?
    • Proven accountability: Who, by name and surname, guarantees the integrity of the information?

    These are not textual requirements. These are architectural requirements.

    II. Why ESG reports fail in audit

    When audit firms (including “Big Four” firms) refuse to issue a positive opinion on an ESG report, the reason rarely lies in the numbers themselves. The problem is in the “background”:

    • Data without pedigree: The data “arrived by email” without a clear source.
    • ESG “stories” without an audit trail: The sustainability narrative has no digital signature to support it.
    • Supply chain “black holes”: Supplier data is collected ad-hoc, without quality control. The problem is not the content. The problem is the architecture that generates that content.

    III. CSRD Blueprint: ESG as a system, not a file

    For ESG to be defensible, it must be structured across five layers of provability:

    • Data Origin Layer: The exact point of data creation (sensor, invoice, HRM system) and a clearly defined responsible person.
    • Verification Layer: The protocol by which that data is verified before it enters the system.
    • Traceability Layer: A digital trail that enables tracking changes to the data over time.
    • Governance Layer: A clear structure of who signs, who approves, and who bears legal responsibility for accuracy.
    • Disclosure Layer: The final output adapted for investors and regulators (XBRL formatting).

    Without these layers, your ESG report is only a collection of claims that nobody can confirm.

    IV. Why the supply chain is the critical breaking point

    CSRD does not end at your company’s doors. It breaks at your suppliers.

    A single key supplier without clear inputs and an audit trail is enough to compromise your entire system.

    The Blueprint therefore must not be closed inside your IT environment — it must define communication standards with external partners.

    V. The Blueprint is not implementation — but without it, implementation makes no sense

    It is important to understand: the Blueprint does not replace your lawyers, auditors, or IT providers. It is the master plan that gives them direction.

    Without a Blueprint:

    • Implementation becomes chaotic: Every department works in its own way.
    • Costs increase: You purchase software that cannot communicate with each other.
    • Risk remains invisible: You will discover the system does not work only when the auditor asks the first question.

    CSRD compliance is not a question of reporting at the end of the year. It is a question of designing a provability system that operates 365 days a year.

    If you cannot prove ESG — you cannot defend it.

    Download ESG Proof Architecture 2026 Balkan Edition

    CSRD / ESG CHECKLIST – BALKAN EDITION 2026 (Montenegrin) CSRD 2026 BLUEPRINT: ESG Proof Architecture (Montenegrin)

    Other blogs

    See other blogs

  • CSRD 2026: Why the Balkans Are Losing Contracts Before Realizing It’s Mandatory

    CSRD 2026: Why the Balkans Are Losing Contracts Before Realizing It’s Mandatory. ESG Is No Longer a Report – It’s a Trust Filter in the EU Supply Chain

    Companies in the Balkans often view EU regulatory requirements as something distant, complicated, and “reserved for big players in the EU.”

    That perception is wrong.

    With the entry into force of the CSRD directive (Corporate Sustainability Reporting Directive), ESG (Environmental, Social, Governance) ceases to be a voluntary practice and becomes a legal fact – even for companies that are not formally registered in the European Union.

    This is not a new report.

    This is a new system of business validation.

    I. Who Is at Risk: Geography No Longer Protects You

    CSRD formally applies to companies in the EU, but its real reach extends through the supply chain. This is exactly where the Balkans enter the regulatory picture.

    Direct obligation (EU companies – from 2026)

    Companies that meet two out of three criteria:

    • more than 250 employees;
    • more than EUR 40 million in revenue;
    • more than EUR 20 million in total assets;

    Must report in accordance with the CSRD standard.

    Indirect obligation for the Balkans

    If you are:

    • a supplier to an EU company
    • an IT or outsourcing partner
    • part of the production, logistics or consulting chain, your EU partner will have to request from you ESG data that is verifiable and auditable.

    Failure to provide this data means:

    Neuspjeh u dostavljanju tih podataka znači:

    • loss of contracts;
    • exclusion from the supply chain;
    • reputational damage that is difficult to repair.

    Greenwashing as a new legal risk

    Improvised ESG data is no longer a “marketing problem”.

    It becomes:

    • a legal risk;
    • a reputational threat;
    • a potential basis for lawsuits and sanctions

    II. The real problem: lack of visual auditability

    Most companies misdiagnose the issue.

    The problem is not:

    • too much regulation;
    • too many requirements;
    • too many metrics.

    The problem is poor system design for collecting and proving data.

    CSRD requires:

    • comparability;
    • traceability;
    • proof of origin for every data point.

    Traditional ESG reports, based on dozens or hundreds of pages of text, create two key vulnerabilities:

    Operational vulnerability

    • data comes from different sectors;
    • there are no standardized inputs;
    • the process is slow, expensive, and error-prone.

    Legal vulnerability
    Regulators, banks, and investors do not want a narrative.
    They want evidence that can be verified quickly.
    Text can hide a problem.
    Visual, structured evidence cannot.

    III. The LDT solution: ESG as a protocol, not a document

    Legal Design Thinking (LDT) fundamentally changes the ESG approach.

    It does not add another report—it redesigns the system.

    Visual ESG dashboard

    A centralized view of:

    • all mandatory CSRD metrics;
    • the source of each data point;
    • a clear audit trail.

    Result: less confusion, more control.

    Layered reporting (Layered Transparency)
    Instead of one massive document:

    • a short, visual ESG summary for the public and investors;
    • complete technical documentation available to auditors and regulators.

    Transparency without overload.

    ESG supply chain protocol
    Standardized, visual ESG checklists for suppliers:

    • consistent data;
    • lower risk of errors;
    • CSRD compliance across the entire chain.

    This is not administration.
    This is legal infrastructure.

    Companies in the Balkans that face CSRD:

    • with improvised ESG reports;
    • without changing how data is collected;
    • without visual auditability

    Will be the first to drop out of the EU value chain.

    LDT does not simplify the law—it makes it provable.
    Transparency becomes a competitive advantage, not a cost.
    The question is not whether you have an ESG story.
    The question is whether it is auditable.

    Download CSRD / ESG CHECKLIST – BALKAN EDITION 2026 [In Montenegrin]

    Other blogs

    See other blogs
ENG
ENG MNE