Must an EU Voluntary Sustainability Report Be Public?

Voluntary reporting projects often begin with a simple assumption: once a sustainability report exists, it should be uploaded to the website. That may be commercially sensible, but it is not the only model contemplated by the EU voluntary standard. The standard is designed first to help an undertaking communicate with business counterparties - including customers, lenders and other market users - and then permits the undertaking to choose public availability.

The choice affects much more than website design. A public report has a broad and partly unknown audience. A lender pack may be used in credit analysis. A customer pack may be reviewed by procurement or due-diligence teams. Supporting evidence may contain personal data, trade secrets, contract terms or system extracts that should never be released without a defined reason and access decision. Treating all of these as the same document creates avoidable confidentiality, consistency and governance risk.

Figure 1. One controlled information core can support several delivery channels, each with its own audience and access rules. London Reporting Academy learning visual.

The reporting-location rules should be read as a sequence. First, where large undertakings or banks need an annual update, the sustainability report is prepared annually. Where the undertaking prepares financial statements, the sustainability reporting period is aligned with the period used for those statements. Second, the report’s primary function is to inform actual or potential business counterparties. Third, the undertaking decides whether to make the report public.

If the undertaking chooses public availability, the standard permits two presentation routes. It may place the sustainability report in a separate section of the management report, if it has one, or present the sustainability report as a separate document. This is a presentation choice. It does not by itself change the disclosures included in the selected module, the reporting basis, the period or the need to explain permitted omissions.

1. Public standalone report

A standalone report is usually the clearest route when the undertaking wants a reusable public document for customers, employees, investors, communities and prospective lenders. It can be designed around the selected Basic or Basic-plus-Comprehensive option and can include a basis-of-preparation section, explanatory notes, links and a visible version date.

The public route also creates the widest exposure. The undertaking should assume that statements may be compared with financial statements, product claims, tender responses, policies and later reporting periods. Confidentiality review must therefore happen before publication, not after a sensitive datapoint has been circulated.

2. Separate section of the management report

Including the sustainability report in the management report can strengthen governance and period alignment because the sustainability information is presented beside financial and strategic information. It can also reduce duplication where the undertaking already publishes a management report. The sustainability section should remain identifiable, and any cross-references should lead to material that is available at the same time and from the same document set.

A management-report section is not automatically the best solution for every undertaking. Some smaller entities do not prepare or publish such a report. Others may want a concise counterparty-facing sustainability document rather than a longer corporate report. The standard recognises this by permitting a separate document.

3. Counterparty pack

A counterparty pack is a practical, purpose-specific output for a customer, distributor, tender authority or supply-chain partner. It may contain approved disclosures, a datapoint table, methodology notes and links to the complete report. This format can reduce friction because the recipient receives the information relevant to its request rather than a large publication with no navigation.

However, the pack must be labelled accurately. If it contains only selected information, call it an extract, response pack or sustainability information pack. Do not repeat the full Option A or Option B compliance statement in a way that implies the extract itself contains the entire selected module. Where the complete report exists, identify its location and version.

4. Lender or financing pack

Banks and other finance providers may need information to support credit, risk, covenant, sustainable-finance or portfolio processes. A lender pack can reuse the same approved metrics and narratives while adding clear explanations of reporting boundary, estimates, methodology, financial-statement linkages and data limitations.

Not every lender request is made for Accounting Directive sustainability reporting. The purpose should therefore be recorded separately. The value-chain cap has a defined reporting purpose and does not automatically govern every credit-risk or due-diligence request. A purpose label prevents the organisation from assuming either that every request is capped or that every request must be answered.

5. Restricted evidence access

Evidence is not simply a longer version of the report. It includes source-system extracts, calculations, contracts, invoices, employee records, incident files, approvals, estimation models and reviewer comments. Much of this material may be confidential, personal or commercially sensitive. The undertaking should maintain a controlled evidence register that identifies the owner, location, access level, retention period, report claim supported and review status.

A lender or customer may be given selected evidence under a secure process, but the decision should be purpose-specific. Where a summary, redacted extract, independent confirmation or methodology note meets the information need, unrestricted transfer of source records is usually unnecessary.

The adopted standard allows specified information to be omitted. The categories include information whose disclosure would, in exceptional cases, be seriously prejudicial to the undertaking’s commercial position; qualifying trade secrets; classified information; and other information protected from unauthorised access or disclosure by Union or national law or for the privacy or security of natural or legal persons.

This is not a general “confidential” tick-box. The undertaking should identify the exact datapoint, the applicable category, the reason the condition is met, the person approving the conclusion and the alternative wording that can still be disclosed. For each omitted datapoint, the undertaking discloses that it used the exemption, and it reassesses at every reporting date whether omission remains justified.

The standard permits cross-references to avoid publishing the same information twice, but the referenced disclosure must be accessible at the same time and from the same document set as the sustainability report. A link to a document that is behind an unrelated login, updated on a different timetable or likely to disappear creates a practical completeness problem.

Create a publication manifest before release. It should list the report, referenced policies, financial statements, appendices and methodology notes; record the version and access route for each item; and confirm that all public links work on the intended publication date. If a referenced document is later replaced, the manifest should show whether the report remains understandable and whether an archive version is needed.

The strongest operating model is not one identical file for every user. It is one controlled information core from which several approved outputs are generated. The core contains the selected module, reporting basis, reporting period, datapoint definitions, current values, narrative answers, omissions, evidence references, owners and approval status.

1. Define the audience and purpose. Decide whether the output is a complete report, public management-report section, customer extract, lender pack or evidence response.

2. Lock the reporting identity. Confirm the undertaking, individual or consolidated basis, selected module, reporting period and cut-off date.

3. Build from the approved information core. Do not create a parallel spreadsheet simply because a recipient has a different template.

4. Apply confidentiality and data-protection review. Assess each sensitive datapoint and identify whether redaction, aggregation, omission or restricted evidence is appropriate.

5. Test completeness and labelling. Make clear whether the output is the complete selected module or a purpose-specific extract.

6. Approve and distribute. Record recipient, channel, access conditions, issue date, approver and evidence snapshot.

7. Monitor and correct. Retain the issued file, log later corrections and ensure public references remain accessible.

Context. Northbridge Components has 240 employees and prepares Option B information for the year ended 31 December. Its largest customer asks for environmental and workforce data, its bank asks for a credit-review pack, and management is considering publishing a sustainability report.

Decision. Northbridge approves one Option B reporting core. It publishes a standalone report containing the complete selected module, with a short confidentiality note for two permitted omissions. It sends the customer a mapped extract that identifies the full report and version. It sends the bank the same approved metrics plus methodology notes and a redacted energy-invoice sample through a restricted data room.

Control outcome. Every output shows the same reporting period, boundary and metric values. The customer and bank files are labelled as extracts rather than separate compliant reports. The evidence register records who accessed the invoice sample and why. When an emissions factor is corrected, Northbridge updates the core, issues a correction to both recipients and updates the public report change note.

Next step: How to Answer Customer and Bank ESG Questionnaires Using the EU Voluntary Standard.

Commercial response: How to Respond to an Above-Cap Sustainability Data Request Without Damaging the Customer Relationship.

Requester perspective: How Large Companies Should Redesign Supplier ESG Questionnaires Around the Value Chain Cap.

Evidence and status: Protected Undertaking Self-Declaration: What Suppliers and Requesters Should Document.