ESRS S4 Consumers and End-Users: Product Impacts, Safety, Privacy and Access

ESRS S4 product-impact lenses: information and privacy, personal safety, and inclusion and access.

Consumer reporting is fragmented between product safety, quality, privacy, accessibility, marketing and customer service. Each function sees a different signal: recall, breach, complaint, access barrier, misleading claim or harm to vulnerable users. Without a product- and user-level model, S4 can become duplicate regulatory reporting or a customer-satisfaction page.

ESRS S4 asks how products, services, information, design and business practices create material impacts, and how they are managed. The answer requires three lenses, vulnerable-user evidence, controlled complaints and incidents, and evidence that product, marketing, sales and data decisions change when harm is identified.

ESRS S4 product-impact lenses: information and privacy, personal safety, and inclusion and access.

Customer satisfaction is one signal, not an impact assessment. A service can score highly while exposing a small user group to severe harm or excluding people with disabilities. Complaint volume can also increase when a channel becomes more trusted.

S4-1 states whether policies cover specific groups or all consumers and end-users. Connect policies to material impacts across information/privacy, safety and inclusion, and show implementation in product, engineering, safety, privacy, marketing, sales, customer operations, suppliers and distributors.

Information and privacy: clear information, data minimisation, rights and content/algorithm governance.

Safety: product risk, adverse-event monitoring, child protection, recalls and corrective action.

Inclusion: accessibility, non-discrimination, responsible marketing and access where material.

Vulnerable groups: children, disabled, older, low-literacy, low-income or otherwise affected users.

Implementation: product-development gates, assessments, marketing approval and escalation.

S4-2 explains engagement with consumers/end-users, representatives or credible proxies and how perspectives informed decisions. Direct research should include affected and vulnerable users where relevant. Consumer, disability, patient or child-rights organisations can provide credible proxy evidence if their independence and connection are explained. The key evidence is the decision or control that changed.

Effectiveness is not demonstrated by fast closure alone. Assess format and language, awareness, safety, escalation, root-cause quality, remedy, user confirmation and recurrence. The process should also reach end-users who are not direct purchasers.

S4-3 asks how negative impacts are prevented, mitigated, ended, minimised or remediated and how tensions with marketing, sales and data-use pressures are handled. Growth targets, launch schedules, engagement metrics, cross-selling or data monetisation can conflict with privacy, safety or inclusion outcomes.

The revised S4 scope excludes misuse or unlawful use by consumers/end-users. This is not a universal safe harbour. Test whether the harm is truly independent of design, foreseeable use, instructions, safeguards, marketing, access model or data practices. A deliberate unforeseeable alteration may fall outside S4; a foreseeable behaviour made harmful by inadequate warnings or controls may not.

For material S4 sub-topics, report human-rights incidents subject to privacy. The application requirements focus on substantiated and verified instances and use severity as the primary information-materiality basis. Maintain a restricted register with product version, market, user group, source, investigation, substantiation, severity, affected population, action, remedy and public aggregation. Child, health, privacy and security information require strict access controls.

S4-4 uses GDR-T. Because S4 does not prescribe a broad metric catalogue, entity-specific metrics may be needed: comprehension-test results, accessibility coverage, substantiated severe safety/privacy incidents, affected units, remedy completion, user confirmation, rights-request barriers or responsible-marketing corrections. Define product/user population, method and limitation.

S4 evidence lineage: complaints are inputs; substantiated incidents, action, remedy and outcomes require validation.

Map products, services, markets, channels, user groups and vulnerable contexts.

Assess the three S4 lenses, severity/likelihood and connection.

Map policies and product/business controls.

Design direct, representative or proxy engagement.

Create a controlled taxonomy for contacts, complaints, grievances, adverse events and incidents.

Assess channel effectiveness and remedy.

Approve product, safety, privacy, marketing, sales or data-use actions.

Set outcome targets and entity-specific metrics.

Reconcile product evidence, incidents and public wording through legal/privacy and governance review.

The undertaking treats the concerns as potential information and inclusion impacts, tests the journey with affected users and a disability organisation, changes cost presentation and defaults, creates an assisted channel, reviews model and marketing incentives, and provides remedy for materially misleading cases. The disclosure separates routine complaints from substantiated incidents and protects case details.