The State of Sustainability Reporting, September 2026: What Still Binds

Michael Willis

September 20, 2026

min read

Two things are true at once in September 2026. The largest regulators in the world have spent the year cutting, deferring or rescinding sustainability reporting rules. And more companies are reporting, and having that reporting assured, than at any point in the history of the discipline. If you run sustainability for a mid-market company, or you underwrite one, the second fact is the one that decides your workload. This is the map as it stands today, with the dates that matter.

The simplification wave

The European Union led it. Omnibus I, Directive (EU) 2026/470, has been in force since 18 March 2026 and cut the CSRD population by roughly 80%: the threshold is now more than 1,000 employees and more than EUR 450 million in net turnover, with first mandatory reports covering FY2027. The Commission adopted the revised ESRS on 3 July 2026. Mandatory datapoints fall by about 60%, all voluntary datapoints are gone, and EFRAG's 28 August draft datapoint list runs to roughly 530 items with a draft XBRL taxonomy attached. The delegated act is still in its scrutiny period; absent an objection, it enters into force on 10 November 2026. CSDDD was pushed back at the same time, to 5,000 employees and EUR 1.5 billion, with transposition due 26 July 2028 and application from 26 July 2029.

The United States went further at the federal level. The SEC's May 2026 proposal to rescind its 2024 climate rule drew more than 19,000 comments before the 3 August close, and the Commission told the Eighth Circuit on 31 August that the rulemaking is still under way. The 2024 rules stay stayed; the 2010 interpretive guidance still governs. On 14 September EPA finalised the repeal of power-sector GHG standards and on 17 September proposed rescinding the Section 111 findings behind them (91 FR 59002), on top of the February rescission of the 2009 endangerment finding now sitting in the D.C. Circuit. On 16 September the SEC proposed rescinding Rule 14a-8, the shareholder-proposal rule. No US state other than California has an enacted corporate climate disclosure mandate: New York's S9072A passed the Senate and died in the Assembly in June.

Elsewhere the pattern was trimming, not abandonment. Brazil's CVM Resolution 244 turned the 2026 ISSB mandate into comply-or-explain from 1 January 2027, with a public justification required from any company that opts out. New Zealand cut its regime from about 164 entities to 76. Türkiye doubled its TSRS thresholds in January. Singapore deferred assurance to FY2029 but kept the Scope 1 and 2 floor.

What advanced anyway

Asia-Pacific is now the centre of gravity for binding, calendar-fixed mandates. Japan's SSBJ standards become mandatory in the annual securities report for TSE Prime companies above JPY 3 trillion in market capitalisation for fiscal years ending March 2027, with the JPY 1 to 3 trillion tier following in March 2028 and JPY 500 billion to 1 trillion in March 2029; assurance follows each tier by one year. Australia's Group 2 entities began their first AASB S2 reporting periods on 1 July 2026, after ASIC received 259 Group 1 reports by May, 225 of them from unlisted companies. Hong Kong's LargeCap issuers are fully mandatory, Scope 3 included, from FY2026. Korea's FSC finalised its roadmap on 8 July: KOSPI companies above KRW 10 trillion in assets report from 2028, the KRW 5 trillion tier from 2029, which takes the population from 291 to 3,171 companies including affiliates.

California is proceeding. CARB published first-cycle guidance and opened its intake platform on 1 September; the SB 253 Scope 1 and 2 deadline is 10 November 2026, fee notices went out on 10 September, and 2027 brings five Scope 3 categories plus limited assurance. SB 261 remains enjoined by the Ninth Circuit.

The United Kingdom is one policy statement away. The final UK SRS S1 and S2 were published on 25 February 2026, and the FCA's CP26/5 would make UK SRS S2 mandatory for around 515 listed companies for periods beginning on or after 1 January 2027, with Scope 3 on comply-or-explain. The policy statement was promised for autumn 2026 and had not appeared as of 20 September.

The ISSB baseline is permanent infrastructure

The "wait and see whether ISSB survives" argument closed on 18 August 2026, when the IFRS Foundation Trustees approved a five-year operating and financing plan for the ISSB and decided to open its seat in Geneva during 2027. ISSB-based requirements are in effect in 19 jurisdictions with roughly 40 in motion. The December 2025 amendments to IFRS S2, which let entities limit Category 15 to financed emissions, are effective 1 January 2027 and have already been mirrored by the AASB and the SSBJ. The IFRS Foundation and GRI committed on 26 May to align climate, nature, sector and human-capital disclosures, which settles the architecture for dual reporters: GRI for impact, ISSB for the financial-materiality subset. Nature arrives as an IFRS Practice Statement, exposure draft due in October 2026 around COP17.

The real shift: from rules to verification

Look past the headlines and the year's centre of gravity is assurance. ISSA 5000 is effective for periods beginning on or after 15 December 2026; IAASB's tracker shows it adopted or converged in about eight jurisdictions with roughly twenty more in process. CARB will accept AICPA standards and ISAE 3000/3410 through December 2026 and ISSA 5000 after that, with limited assurance on Scope 1 and 2 from 2027 and reasonable assurance from 2030. SBTi's Corporate Net-Zero Standard V2.0, final since 11 June, requires base-year inventory assurance for larger companies and becomes mandatory for submissions from 1 February 2028. Japan's first assured filings arrive in March 2028. IFAC's latest data puts three in four of the largest global companies under some form of sustainability assurance already. The question for the next 18 months is not whether to report. It is whether your Scope 1 and 2 inventory, your organisational boundary and your emission-factor choices will survive a practitioner who is pricing the engagement on how much investigative work you leave them.

What binds you now: five questions

Do you have more than 1,000 employees and EUR 450 million of EU turnover, or an EU parent that does? If yes, CSRD FY2027 and the revised ESRS are live. If you are a non-EU parent above EUR 450 million EU turnover, ESRS-40a's consultation closes 31 October and first reports cover FY2028.
Do you do business in California above USD 1 billion in revenue? File Scope 1 and 2 by 10 November, pay the fee within 60 days of the notice, and build the FY2026 inventory as if it will be assured, because it will be.
Are you listed in Tokyo, Sydney, Hong Kong, Seoul or London? Each has a fixed calendar now. Sydney and Hong Kong are already reporting; Tokyo starts with March 2027 year-ends; London is one FCA policy statement away; Seoul is 2028 and 2029.
Do you have a lender running PCAF, a customer running CSRD, or a target validated by SBTi? Then the rule that binds you is theirs, and the data request will not get smaller.
Do you make a public climate claim? From 27 September, EU consumer law bans generic and offset-based product claims; the same evidence file you would build for assurance is the one that defends the claim.

Regulation retreated in 2026. Verification did not. Where ESG Advising fits is in the middle of that gap: a materiality assessment that survives scrutiny, a disclosure-readiness review scoped to the regime that actually binds you, and a GHG inventory built to be assured rather than merely published.