Socious Report
Socious Work
Socious VerifyESRS S3 Affected Communities After the 2026 Revision: Fewer Disclosures, One New Question
Of the four ESRS social standards, S3 is the one companies most often assume does not apply to them. It covers people who neither work for the business nor buy from it: the town next to the plant, the farmers whose water table sits under the site, the community whose land the access road crosses.
The 2026 revision made that standard shorter. It also added a single disclosure that most reporting teams cannot produce from any system they own.
This is a guide to ESRS S3 — Affected Communities — as it stands after the 3 July 2026 adoption, and to where the evidence for it actually lives.
Where the standard stands
On 3 July 2026 the European Commission adopted the delegated acts containing the revised ESRS and the voluntary standard (Linklaters; Cooley). The European Parliament and the Council have a two-month scrutiny period, extendable by two further months, and may reject the acts in full but not amend them. The revised standards apply to financial years beginning on or after 1 January 2027, with first reports in 2028; earlier application is permitted for financial years starting 1 January 2026 (Linklaters).
Mandatory datapoints across the set are down 61% against the 2023 standards, and total datapoints down more than 70%. We covered why that reduction is a remapping project rather than a lighter year in the revised ESRS datapoint analysis.
The text below follows the amended S3 draft EFRAG published in November 2025, which is the basis of the adopted act. Confirm final paragraph numbering against the Official Journal text when it publishes.
Who counts as an affected community
S3 is about people affected by the undertaking’s operations or its value chain, in three sub-topic groups the standard names explicitly:
- Economic, social and cultural rights — including land-related impacts, security-related impacts, adequate housing and food, water and sanitation.
- Civil and political rights — including freedom of expression, freedom of assembly, and impacts on human rights defenders.
- Rights of indigenous peoples — including free, prior and informed consent (FPIC), self-determination and cultural rights.
The standard anchors itself to the International Bill of Human Rights, the UN Guiding Principles on Business and Human Rights, the OECD Guidelines for Multinational Enterprises, and the UN Declaration on the Rights of Indigenous Peoples. It also flags the interaction most companies miss: impacts on communities frequently arrive through the environmental standards. A climate or biodiversity transition plan can affect the lands, territories and natural resources of indigenous peoples, which means your E1 and E4 workstreams can generate S3 content without anyone routing it there.
Like the other social standards, S3 is conditional. You report against it where affected communities emerge from your double materiality assessment as material.
Five disclosure requirements became four
The 2023 standard ran S3-1 through S3-5. The amended standard runs to four, and the merge is visible in the draft’s own paragraph cross-references:
| Amended | Covers | Where it came from |
|---|---|---|
| S3-1 | Policies related to affected communities | Old S3-1 |
| S3-2 | Engagement, channels to raise concerns, and approach to remedy | Old S3-2 plus the remedy and grievance-channel paragraphs of old S3-3 |
| S3-3 | Actions and resources | Old S3-4, plus the new incidents paragraph |
| S3-4 | Targets | Old S3-5 |
Two specifics inside that consolidation are worth reading closely.
S3-1 asks whether your policy is general or specific. You must state whether policies cover particular communities — a community of indigenous peoples, or a community living around a site — or all affected communities, and you must disclose any policy provisions specifically for preventing and addressing impacts on indigenous peoples. A group-level human rights policy that never names a site or a people answers the first half of that question and fails the second.
S3-2 keeps FPIC in full. Where affected communities are indigenous peoples, you disclose how you respect their right to free, prior and informed consent with regard to their cultural, intellectual, religious and spiritual property; activities affecting their lands and territories; and legislative or administrative measures affecting them. You also disclose whether indigenous peoples were consulted on the mode and parameters of the engagement itself — the agenda, its nature, its timing. Consultation about how to consult is now part of the disclosure.
S3-2 also asks how you gain insight into the perspectives of communities that may be particularly vulnerable or marginalised — the draft names women, girls, migrants and persons with disabilities — and how you assess whether your grievance channels actually work. The effectiveness criteria in Principle 31 of the UN Guiding Principles are cited as the yardstick.
The one thing the revision added
Inside S3-3, the amended standard adds paragraph 16: for the sub-topics assessed as material, and subject to privacy law, the undertaking discloses human rights incidents connected to affected communities identified in the reporting period.
The application requirements define what counts. Incidents in scope are substantiated instances of:
- judicial and non-judicial proceedings that have been initiated — cases before domestic courts and tribunals, mediation, and complaints filed with the National Contact Points for the OECD Guidelines for Multinational Enterprises; and
- incidents registered by the undertaking, including those found through its own internal processes.
Three further application requirements shape the disclosure. When determining which incidents are connected to affected communities, you must consider any legal disputes over land rights and over FPIC. The information-materiality filter is applied primarily on the severity of the impact on the community, not on financial magnitude. And you are not expected to publish a list of every incident: aggregation by type of incident or by community affected is explicitly permitted.
The draft also notes that this datapoint feeds indicators financial market participants already ask for under the SFDR — violations of the UNGPs and OECD Guidelines, and the number of identified cases of severe human rights issues and incidents, in Table I and Table III of Annex I to Delegated Regulation (EU) 2022/1288.
That last point is why “we had no material incidents” is a weak answer. Somebody downstream is reconciling your number against a benchmark indicator.
Why this datapoint is harder than it looks
Every other S3 disclosure describes something the sustainability function does: writing a policy, running engagement, setting a target. Paragraph 16 describes something that happens to the company, recorded by people who do not report to the sustainability function.
Court cases and mediations sit with legal. Complaints to an OECD National Contact Point may have been handled by external counsel or a regional office. Site-level grievances sit in a plant log, a community relations file, or a contractor’s inbox — often in the local language, often never aggregated upward. In a Japanese multinational with operations across Asia, the raw material for this disclosure is scattered across subsidiaries that have never been asked for it in a reporting format.
Assembling that once, by hand, in the year the disclosure is first due, is how companies end up with a number they cannot defend in assurance. The auditor’s question will not be “what was the total?” It will be “how do you know that is the total, and what would have surfaced an incident you missed?”
The Omnibus cap on value-chain information requests — you may not require companies of 1,000 employees or fewer to provide more sustainability information than the voluntary standard asks (Linklaters) — bites less here than it does in S2, because most community-facing incidents arise around your own sites and your own projects. That is a mixed blessing. It removes the excuse.
What to do in the next two quarters
- Settle materiality properly, per site. S3 rarely turns on a group-level judgment. It turns on where you operate: extraction, land acquisition, water-intensive processing, infrastructure, or anything near indigenous territory.
- Name the populations. A policy that covers “affected communities” generically will not satisfy S3-1’s specificity test where a particular community is exposed.
- Wire the incident register before you need it. One route from legal, compliance, site management and community relations into a single record, with a definition of “substantiated” agreed in advance and a rule for what gets escalated.
- Keep FPIC evidence as a file, not a claim. Consent processes, good-faith negotiation records, and the record of who was consulted about the shape of the engagement.
- Test your grievance channels against Principle 31, and keep the assessment. S3-2 asks how you assess effectiveness, not whether a channel exists.
- Trace the environmental crossover. Where a transition plan touches land, route it into the S3 workstream deliberately.
The pattern under all of it
Two waves of simplification have now cut what European companies must disclose, while leaving the underlying obligation intact: know your impacts, evidence them, and be able to show where each figure came from. Fewer datapoints, same burden of proof.
That traceability problem is the one Socious Report is built around: one dataset, mapped to CSRD, SSBJ and ISSB, with every disclosed figure carrying its source and transformation history, and an independent Socious Verify credential on the output.
If you want a picture of where you stand before the reporting year decides for you, the free CSRD readiness check walks through it axis by axis — data, systems, ownership, review, traceability. It takes honest answers and returns a readiness picture, not a sales call.