Socious Report
Socious Work
Socious VerifyESRS G1 Business Conduct After the 2026 Revision: Six Disclosures That Live Outside Sustainability
The four social standards ask about people. The five environmental standards ask about the planet. ESRS G1 asks about the company — how it behaves when nobody outside it is looking.
That makes it the standard with the strangest reporting geography. The evidence for a climate disclosure is in an energy system. The evidence for a workforce disclosure is in HR. The evidence for G1 is scattered across legal, procurement, accounts payable, government affairs, and the corporate secretary’s minute book — five owners who have never met the sustainability team, and four of whom have no idea they are inside a reporting perimeter.
This is a guide to ESRS G1 — Business Conduct — as it stands after the 2026 revision, and to where each disclosure’s evidence actually sits.
Where the standard stands
On 3 July 2026 the European Commission adopted the delegated acts containing the revised ESRS and the voluntary standard (Linklaters; Cooley). Parliament and Council have a two-month scrutiny period, extendable by two further months, and may reject the acts in full but not amend them. The revised standards apply to financial years beginning on or after 1 January 2027, with first reports in 2028; earlier application is permitted for financial years starting 1 January 2026 (Linklaters).
The text below follows the amended G1 draft EFRAG published in November 2025, which is the basis of the adopted act. Confirm final paragraph numbering against the Official Journal text when it publishes.
Like every topical standard, G1 is conditional: you report against it where business conduct emerges from your double materiality assessment as material. In practice, few large undertakings conclude that anti-corruption and supplier payment behaviour are immaterial, and the reason has less to do with the CSRD than with who else is reading — more on that below.
What G1 covers
The standard names three sub-topics:
- Corporate culture — including anti-corruption and anti-bribery, the protection of whistleblowers, and animal welfare.
- Management of relationships with suppliers — including payment practices, and specifically late payment to small and medium-sized undertakings.
- Political influence — including lobbying activities.
Six disclosure requirements sit under those: G1-1 policies, G1-2 actions, G1-3 targets, G1-4 metrics on corruption or bribery, G1-5 metrics on political influence, and G1-6 metrics on payment practices.
G1-1: policies, plus three named questions
Policies are framed by ESRS 2 GDR-P, and G1-1 adds three specifics on top. You disclose whether or not you have anti-corruption and anti-bribery policies consistent with the United Nations Convention against Corruption; whether or not you have policies on the protection of whistleblowers; and the functions or roles within the undertaking most at risk of corruption or bribery.
That third one is the interesting one, because it is not a yes/no. Application Requirement AR 3 defines “most at risk” as functions or roles deemed most exposed as a result of their tasks and responsibilities — the standard’s own examples are roles operating in high-risk countries and roles interacting with public authorities and governments. You are being asked to publish your own risk map of your own organisation chart.
There is one piece of relief. AR 2 lets undertakings already subject to national law transposing the EU Whistleblower Directive ((EU) 2019/1937) comply with the whistleblower disclosure by saying so.
G1-2: actions, and the supplier questions procurement will have to answer
G1-2 is framed by ESRS 2 GDR-A and adds two clusters.
On suppliers: if you take environmental, social and governance performance factors into account when selecting suppliers, how you do it; what ESG training the procurement team receives, if any; and how you engage suppliers to improve their ESG performance. The “if any” in the training line is doing quiet work — it invites a company to disclose that the answer is none.
On corruption: the procedures used to prevent, detect, investigate and respond to allegations or incidents, including the anti-corruption and anti-bribery training given to the at-risk functions identified under G1-1 — explicitly including members of the administrative, management and supervisory bodies — and any actions taken to address breaches.
AR 4 permits cross-referencing the existence of a supplier code of conduct to ESRS S2 Workers in the Value Chain. Worth taking: it is the one place where the social and governance standards are allowed to share a source document rather than restate it.
G1-4: convictions and fines, defined tightly
G1-4 asks for the number of convictions and sanctions, including the total amount of fines, for violation of anti-corruption and anti-bribery laws during the reporting period.
The definitions are narrow enough to matter. A conviction is a final decision by a criminal court, entered in the criminal record of the convicting Member State — or, outside the EU, in the equivalent register of the jurisdiction concerned (AR 5). A sanction is a final decision by an administrative or regulatory authority. A fine is a mandatory monetary penalty imposed by a court or authority, paid to a public treasury, and recognised in the financial statements during the reporting period (AR 6).
That last clause quietly ties the number to the audited accounts. The figure a legal team keeps in a matters tracker and the figure recognised in the financial statements are frequently not the same figure, and G1-4 wants the second one.
G1-5: political influence, including a line about your board
G1-5 has three parts, and the third catches people out.
First, the total monetary value of financial and in-kind political contributions made directly and indirectly, aggregated by country or geographical area where relevant, with the type of recipient or beneficiary. The definitions are broad: a political contribution includes donations, loans, sponsorships, advance payments for services and the purchase of tickets for fundraising events, and in-kind support includes advertising, use of facilities, design and printing, donated equipment, and the provision of board membership, employment or consultancy work to elected politicians or candidates (AR 7). An indirect contribution is one routed through an intermediary — a lobbyist, a charity, a think tank, or a trade association linked to a party or cause (AR 8). Trade association membership fees are the item most companies have never counted.
Second, the main topics your lobbying covers and the main positions you have taken, including how those positions interact with your material impacts, risks and opportunities. This is the disclosure that can contradict the rest of the report. A transition plan in E1 and a lobbying position against the policy that would enforce it are now printed in the same document, and the standard asks you to explain the relationship.
Third, paragraph 15: you disclose the appointment of any members of the administrative, management or supervisory bodies during the current reporting period who held a comparable position in public administration, including regulators, in the two preceding years. AR 9 says “comparable” is judged on level of responsibility and scope of activities.
No company has a system that produces this. It is a question for the corporate secretary, answered by reading two years of appointment records against two years of the appointees’ prior employment — and it has to be re-answered every reporting period, because the two-year window moves.
G1-6: payment practices
Three items. A description of your standard payment terms in number of days by main supplier category, specifying the terms that apply to SMEs only where they differ from those generally applied. The percentage of payments aligned with those standard terms. And the number of legal proceedings currently outstanding for late payment.
The percentage is the hard one. It is not a policy statement; it is a calculation over the payment ledger, and it will land somewhere below what the policy says. AR 10 adds that where late payment to SMEs is itself material, ESRS 1 paragraph 11 applies and an entity-specific metric is required.
Why “immaterial” is a harder argument here than it looks
Four of the G1 datapoints are wired directly into other EU regimes. The draft’s own footnotes state that the anti-corruption policy disclosure, the whistleblower policy disclosure, the breaches disclosure and the convictions-and-fines metric each support the information needs of financial market participants subject to the SFDR (Regulation (EU) 2019/2088), because they derive from additional principal adverse impact indicators #15, #6, #16 and #17 in Table III of Annex I of Commission Delegated Regulation (EU) 2022/1288. The convictions-and-fines metric additionally feeds benchmark administrators under Regulation (EU) 2020/1816.
Practically: your institutional investors have their own reporting obligation, and these are the fields they need to fill. A materiality assessment that excludes G1 does not remove the question — it moves it into a bilateral request from an asset manager, arriving on their timetable rather than yours, and without the audit trail the sustainability statement would have given it.
Where the evidence actually lives
| Disclosure | Who holds the source | What it looks like before it is a datapoint |
|---|---|---|
| G1-1 policies, at-risk roles | Compliance, legal | Policy PDFs, a risk assessment nobody has published |
| G1-2 supplier ESG, training | Procurement, L&D | Supplier questionnaires, an LMS completion export |
| G1-2 corruption procedures | Legal, internal audit | Case-handling procedure, investigation log |
| G1-4 convictions, fines | Legal, finance | Matters tracker, reconciled to the financial statements |
| G1-5 contributions, lobbying | Government affairs, finance | AP records, trade association invoices, position papers |
| G1-5 board appointments | Corporate secretary | Appointment minutes, read against prior employment |
| G1-6 payment terms, alignment % | Accounts payable | ERP payment-run data |
Seven sources, none of them a sustainability system. That is the structural point about G1: the reporting work is not writing, it is collection — and the collection crosses functions that have no shared calendar, no shared definition of a reporting period, and no reason to answer a sustainability team’s email quickly.
The teams that get through their first G1 cycle without a scramble are the ones that name an owner per row of that table in the year before the reporting year, and agree what each owner will hand over and in what shape. That is a governance exercise, not a software purchase — but what you hand the software afterwards determines whether the numbers can be traced when an assurance provider asks where they came from.
Not sure which of these you can already produce? The free CSRD readiness check scores your position across seven dimensions in about three minutes, including the governance and data-provenance questions G1 turns on. If the gaps it surfaces are the collection problem described above, that is the problem Socious Report was built for: one dataset in, audit-ready CSRD, SSBJ and ISSB reports out, with every figure traceable to its source.