Compliance with laws and regulations

Disclosure 2-27 requires an organization to report the total number of significant instances of non-compliance with laws and regulations during the reporting period. This total must be broken down into instances for which fines were incurred and instances for which non-monetary sanctions were incurred.

The organization must also report the total number and monetary value of fines paid during the reporting period. These fines must be broken down between fines relating to instances of non-compliance that occurred in the current reporting period and fines relating to instances that occurred in previous reporting periods.

The term “significant instances of non-compliance” should be used consistently. Internal terms such as serious, major or material breaches can be mapped to the GRI terminology, but they should not replace it in the published disclosure or methodology.

The unit counted under GRI 2-27-a is a distinct instance of non-compliance. The unit counted under GRI 2-27-b is a distinct fine paid, not a legal case, regulatory letter, payment instalment or accounting entry. One significant instance can result in more than one fine and can result in both a fine and a non-monetary sanction. The sanction-category counts should therefore be reconciled to the total and should not be assumed to be mutually exclusive.

Fines incurred should be distinguished from fines paid. A fine can be incurred or imposed during one period, appealed, and paid during a later period. Provisions or reserves can support identification of incurred or appealed fines but do not constitute fines paid unless an actual payment has occurred.

The scope of laws and regulations can include international declarations, conventions and treaties, national and subnational laws and regulations, and specified binding or voluntary agreements that have regulatory applicability to the organization.

The reporting scope is based on the entities included in sustainability reporting under Disclosure 2-2. The organization should not create an arbitrary site- or activity-level boundary for Disclosure 2-27. Non-compliance by a supplier, contractor, agent or joint venture should not be included automatically unless the reporting organization or an included entity itself failed to comply with an applicable law or regulation or incurred the relevant sanction.

When determining significance, the organization should consider the severity of the impact resulting from the instance and relevant external sector benchmarks. Severity can be assessed through the scale, scope and irremediable character of the impact. Financial size, legal exposure, operational disruption, licence implications or reputational risk can be used as additional internal considerations but should not replace impact severity and external benchmarks.

Significant instances resulting in administrative or judicial sanctions and fines that are being appealed during the reporting period should be included. The organization should report the appeal status without implying that a final legal determination has been made where proceedings are ongoing.

Non-monetary sanctions can include restrictions or withdrawal of licences and directives to cease or remediate unlawful activity. Warning letters, information requests and investigation notices should not automatically be treated as sanctions unless they have the relevant formal legal or regulatory effect.

For fines paid, the classification between current and previous reporting periods should be based on when the underlying instance of non-compliance occurred, rather than the fine-payment date, regulator-decision date or investigation-opening date. The organization should document a consistent approach for continuing or recurring instances.

For each significant instance, the organization should provide sufficient information to understand its type and context. This can include the geographic location, legal or regulatory matter, authority involved, period of occurrence, sanction, appeal status and whether the issue was repeated, recurring or continuing. Sensitive or legally privileged information can be protected through appropriate aggregation, but the description should not be reduced to generic boilerplate.

Settlements, damages, compensation, remediation expenditure, legal fees, tax assessments and provisions should not be included automatically in fines paid unless they are legally classified as fines.

If no significant instances occurred, the organization should state this directly. If no fines were paid, it should also state this separately. The absence of fines paid does not necessarily mean that no significant instances or non-monetary sanctions occurred.

Reasons for omission are permitted for Disclosure 2-27 where required information cannot be reported. In that case, the affected requirement, applicable reason and required explanation must be provided in the GRI content index.

This LRA educational guidance supports disclosure preparation. For the exact requirements, always refer to the official GRI source.

A quick mental checklist before you prepare this disclosure — tick each as you settle it.

Key information to prepare

Request the disclosure evidence

Translate the disclosure into an internal business question — then adapt it to your organisation's own language.

Use the organisation's own role and document names, but preserve the defined GRI terms and the scope described above.

Notes that turn data into a disclosure

LRA training templates — adapt them to your organisation, and check the official source before sign-off.

For each claim, check the evidence

Relevant GRI requirements and related disclosures

Available framework references and nearby disclosures relevant to preparing this requirement.