Opinions

The European Union introduces a general sustainability reporting requirement for companies

August 18, 2025

By journalist Ain Alvela, an editor at TööstusEST.

The European Union plans a major overhaul of the current corporate sustainability reporting system (ESG – Environmental, Social, Governance), expanding the range of organisations required to comply, while the prospect of additional obligations has already left many businesses on edge. Although each member state can introduce slightly different rules through its own laws, the ESG sustainability reporting system will apply across the European Union – initially only to large companies and publicly listed firms, but in the long run to the entire business sector.

At the United Nations summit in 2015 member countries agreed to adopt the 17 Sustainable Development Goals and a roadmap for their implementation by 2030. This February, the European Commission introduced new rules for corporate sustainability reporting – the Corporate Sustainability Reporting Directive (CSRD). However, because the directive would significantly increase reporting obligations for many companies, its enforcement has been postponed. EU member states will still be required to incorporate its provisions into their national laws by 2025. The directive obliges all large companies and publicly listed businesses, including small and medium-sized enterprises (SMEs), to regularly disclose information on their social and environmental impact. In practice, SMEs will also feel its effects, as they are often part of larger supply chains, meaning that banks, investors, suppliers, customers, and end consumers will increasingly demand such reports. At the same time, the Estonian Ministry of Economic Affairs and Communications (MKM) has assessed that current reporting is inadequate, outsourcing it as a service is costly, and businesses’ awareness of its content and necessity remains poor.

For now, there is still no certainty about when, to what extent, and with what specific changes the CSRD will ultimately be adopted. However, the new reporting obligation, which in essence is similar to the current requirement to submit an annual report, is expected to be introduced for a larger number of companies. While the current obligation covers financial statements, the upcoming one will focus on sustainability reporting.

IT Companies Offer Their Support in Preparing the Reports

To help companies meet their ESG reporting obligations, a programme has been launched to develop a web platform and digital tool. The so called ESG Tool project brings together public and private sector organisations from Estonia, Latvia, Lithuania, and Finland, with the work in Estonia being led by the Estonian Ministry of Economic Affairs and Communications (MKM). Among others, the Estonian Association of Information Technology and Telecommunications (ITL) is involved in creating the sustainability reporting tool. Funded under the EU Interreg Baltic Sea Region programme, the project will develop a sustainability reporting methodology based on EFRAG (European Financial Reporting Advisory Group) standards and guidelines. Following this methodology, a digital reporting environment will be created to guide companies to complete their ESG reports.

In short, the ESG Tool aims to support companies on their sustainability journey. It will be freely available in the national languages of all four participating countries and will provide guidance for mapping sustainability reports, assessing a company’s sustainability performance, and raising awareness. In addition, it will offer recommendations and best practices on how to improve a company’s sustainability outcomes and the benefits this brings for the company, such as enhanced competitiveness, for example. The tool is specifically designed to meet the needs of businesses operating in the Baltic states and Finland.

Data Collection Could Take Place Automatically

*Allan Tamme confirms that IT companies are stepping in to assist other sectors, helping businesses with the preparation of ESG reports. Photo: ITL*

Allan Tamme, head of innovation and sustainability at ITL, points out that IT companies help businesses in other sectors become more sustainable, because in today’s tech-driven world, achieving sustainability and saving resources is impossible without digitalising processes. At the same time, he acknowledges that companies are not happy about the increased administrative burden, which inevitably causes anxiety in business circles. For now, there is still little clarity on what exactly will be required, what data will need to be collected, and which organisations the new obligations will apply to.

“Often, when a sustainability report is being prepared, most of the effort goes into simply gathering the necessary data,” describes Allan Tamme, reflecting on current practice.” The IT sector can step in here and build the required systems, even for companies operating in very specialised fields. This way, firms can more easily access the data they need about their processes and use it to make the right choices and decisions.” According to him, many details of the reporting obligation are still unresolved, but from the perspective of achieving and maintaining competitiveness, it is crucial for companies to have data reflecting sustainable operations readily available.

Companies have the option to handle all of this themselves or hire a consultant to advise on gathering the necessary data and compiling the report. The ESG Tool, however, is designed to be a support system that allows a company to complete the entire process independently, without hiring consultants or incurring additional costs. If a company is already implementing new digital solutions, the IT firms involved can integrate a sustainability management system into the digitalisation and automation processes simultaneously.

ESG Reporting Raises Awareness and Provides Advantages

According to Tamme, ESG reporting should not be seen from the outset as a burdensome additional obligation. Instead, companies should consider the potential benefits, particularly the likely resource savings that can result from analysing sustainability data.

“A sustainable company is successful in the long term, attracts good employees, has satisfied customers, and possesses all the conditions for continued sustainable growth,” Allan Tamme.

“Regardless of the obligation to collect data, a company can gain significant benefits from it, even in the form of competitive advantages,” explains Tamme. “This is reflected in the fact that a sustainable company is successful in the long term, attracts good employees, has satisfied customers, and possesses all the conditions for continued sustainable growth.”

The ESG Tool will be launched this September. While it is initially aimed primarily at smaller service companies, it will be available for anyone interested to try. The online ESG tool allows users to conduct an initial self-assessment, understand which areas have the greatest impact on the company and its sustainability, and identify where the company’s own operations have the most significant effects. Based on the company’s data, the tool also provides recommendations on which areas may require deeper attention, where there is room for improvement, and what actions could be taken to better align operations with sustainability principles.

“The ESG Tool also follows the EU regulations and the requirements of the CSR directive, and thanks to that, knows which questions need to be addressed during the analysis,” says Tamme. “The text of the regulation is long and complex. The tool aims to explain it in simple terms, map a company’s impact, and help users understand what to keep in mind in their future activities.”

The ESG Tool is currently in a testing phase, being piloted in various companies while feedback is collected and used to make improvements. In any case, Allan Tamme believes that the more a company already uses digital solutions and automated data collection, the easier it will be for it to handle sustainability reporting.

WHAT IS WHAT: ESG reporting

According to the UN definition, sustainable development is development that meets the needs and aspirations of the present generation without compromising the ability of future generations to meet their own needs.
In business, sustainability is described through three dimensions: environmental, social, and governance factors.
Under the Sustainability Reporting Directive, companies are required to disclose information about the impact of their activities on the environment, the economy, and society.
Such a report serves as a tool for managing sustainable development, allowing a company to demonstrate its commitment to these issues, document its progress, and set sustainable development goals.
Based on this data, stakeholders, such as customers, partners, financial institutions, investors, and employees, can assess how sustainable a company’s operations are across the entire value chain.
The report allows stakeholders to understand a company’s performance, goals, and risks, and to shape their own decisions and attitudes based on that information.
The ESG reporting requirement will apply to:
From 2024: large companies, large groups (500 or more employees), and publicly listed companies (except micro-enterprises).
From 2025: large companies, and companies meeting at least two of the following three criteria: average annual number of employees over 250, annual turnover over €50 million, total assets over €25 million.
From 2026: in addition to the above, publicly listed SMEs and companies meeting at least two of the following three criteria: average annual number of employees over 10, annual turnover over €900000, total assets over €450000.

Sources: kestlikkusaruandlus.ee, Karme Petrutis, MVO Põllumajandusuuringute Keskus

Companies Have a Duty of Care

The Estonian Chamber of Commerce and Industry notes that the European Commission plans, through the CSRD, to also regulate companies’ obligations on human rights and environmental due diligence in global supply chains. This means that in the future, companies will need to monitor that no human rights are violated, and no unlawful environmental damage is caused anywhere along the supply chains of the goods they sell, from raw material sourcing to the end product reaching the consumer. Greater responsibility will fall on companies whose activities have more extensive harmful environmental and social impacts. The system assumes that the risks associated with a company’s supply chain have been assessed and that the necessary measures to mitigate and reduce them have been developed.

Several Estonian companies have already voluntarily undertaken or are undertaking ESG-related activities. In addition, there are numerous ESG training and consulting service providers in the market who help integrate the principles of sustainable development and responsible management into business models, strategies, and daily operations of companies.

So far, in the Estonian business environment, a company’s sustainability has primarily been assessed based on its long-term financial success. However, in the context of the UN Sustainable Development Goals, sustainable development has three clear, interconnected dimensions. When the environmental and social dimensions are integrated in a sustainable way, it can be inferred that the company is also financially more resilient and better able to adapt to changing conditions. Otherwise, it will sooner or later lose its market position and competitiveness, meaning it is not sustainable in the long term.

Preparations Are Underway to Amend the Cybersecurity Act

In addition to the introduction of the ESG reporting obligation, which is inseparably linked to the digital society, the new European Union Cybersecurity Directive (NIS2, EU 2022/2555) will also apply in the Baltic states, aiming to harmonize cybersecurity requirements across the entire EU. The target groups of the NIS2 Directive include, for example, railway, airport, and port service providers, telecommunications companies, hospitals and general practitioners, banks, as well as public sector institutions such as ministries and local governments with their subordinate agencies.

The head of national cybersecurity in Estonia Taavi Viilukas has stated that the new directive aims to ensure a uniformly high level of cybersecurity across the European Union. In addition, it clarifies the organization of cybersecurity information exchange and the use of resources in emergency situations. “For example, in the event of a major incident during a crisis or emergency, Estonia can request advice and assistance from other EU member states,” Viilukas explains. “In addition, the directive defines how compliance with obligations will be supervised within the member states.”

By the time the law comes into force, countries plan to establish various tools to help companies assess whether they are subject to the cybersecurity requirements under the law. Once the law takes effect, companies will have three years to comply with the cybersecurity requirements.

Several Estonian cybersecurity specialists have expressed criticism regarding the new EU-driven requirements, as some provisions in the new regulation are considered overly complex and demanding, raising concerns that companies might struggle to understand and comply with them.

“Security measures cannot be so strict that they start to stifle business,” says Jürgen Erm, head of the international cybersecurity company Neverhack Estonia. “Every company has its own level of risk tolerance, and each should be able to decide how to build its cybersecurity. The current directive, however, places such a uniform level of responsibility on everyone that it is feared that many companies will simply not be able to bear it. At present, we are trying to bring all parties to the table to discuss different scenarios and find a balanced solution. The goal is to adapt the new regulation for Estonia so that it is as effective as possible for us.”