10 min read

Welcome to the latest edition of Corporate Update.

Corporate Update is our fortnightly bulletin offering a quick read of the latest developments relevant to corporate counsel. Please get in touch with your usual contact or any of the contacts listed below if you want to explore any of the topics covered in more detail. If you would like to subscribe to this bulletin as a regular email, please click here.

Publications

Timeline of key ESG developments in 2026 and early 2027 

We have updated our timeline of key ESG developments in the UK and EU in 2026 and early 2027. Developments expected soon include:  

  • 2 November 2026: Developers of Nationally Significant Infrastructure Projects that apply for a development consent order on or after this date will need to deliver at least 10% Biodiversity Net Gain.
  • Autumn 2026: The FCA is expected to publish a response to its consultation on aligning listed companies’ sustainability disclosures with the UK Sustainability Reporting Standards (SRS). If the FCA proceeds with its proposals, the 2027 financial year will be the first UK SRS reporting year for in-scope issuers.
  • Mid-December 2026: ISSA (UK) 5000: General Requirements for Sustainability Assurance Engagements becomes effective, on a voluntary basis, for assurance engagements on sustainability information reported for periods beginning on or after 15 December 2026.
  • January 2027: Launch of the UK Carbon Border Adjustment Mechanism (CBAM), which will tax embodied emissions in specific carbon intensive goods imported into the UK. The first accounting period for CBAM will be 12 months, from 1 January 2027 to 31 December 2027. Returns and payments will be due five months after the end of the first accounting period (31 May 2028).
  • January 2027: The EU Corporate Sustainability Reporting Directive (CSRD), as amended by the Omnibus I simplification package, begins to apply to “second wave” companies - i.e. large EU undertakings and non-EU issuers that meet the revised turnover and employee thresholds. Such companies will need to produce reports in 2028 in respect of the 2027 financial year (see also the Legislation section below).

Back to top

News

FRC publishes “mythbuster” guidance on cyber risk reporting under Provision 29 UK Corporate Governance Code

On 23 September 2026, the Financial Reporting Council (FRC) published Provision 29 Mythbuster: Focus on Cyber. The mythbuster is designed to help companies report on cyber security, including in the board declaration required under Provision 29 of the UK Corporate Governance Code 2024. The revised Provision 29 applies to financial years beginning on or after 1 January 2026, so the mythbuster will be of particular interest to boards preparing for their first declaration as part of their 2027 reporting cycle.

Under Provision 29, boards are required to monitor the company's risk management and internal control framework and, at least annually, review its effectiveness, covering all "material" financial, operational, reporting and compliance controls. The company's annual report should include:

  • a description of how the board has monitored and reviewed the effectiveness of the framework;
  • a declaration of effectiveness of the material controls as at the balance sheet date; and
  • a description of any material controls that have not operated effectively as at the balance sheet date, and the action taken or proposed to improve them, including in respect of previously reported issues.

Among other things, the mythbuster confirms that:

  • The FRC does not expect companies to disclose commercially sensitive information or details that may undermine their security.
  • Provision 29 does not require boards to guarantee total cyber security, nor is it realistic for there to be an expectation that cyber risk can always be eliminated.
  • Provision 29 does not create a separate requirement to report every cyber incident or breach; but if a cyber breach indicates that a material control did not operate effectively as at the balance sheet date, the annual report should describe at a high level the control failure, action taken or proposed to improve it, and any action taken to address previously reported issues.

For further details and comment see our blog post.

Glass Lewis publishes season review

Glass Lewis has published its 2026 proxy season review for the UK. The review examines trends in publicly traded companies in the UK during the year and, where relevant, proxy advice, focussing in particular on executive remuneration, board gender balance, shareholder activism and virtual general meetings. Glass Lewis has also published its 2026 proxy review for Continental Europe.

Glass Lewis consults on new proxy research framework

Glass Lewis has announced a consultation on proposed changes to its proxy research model. Recognising that investors weigh governance standards, financial performance and sustainability considerations differently, Glass Lewis is proposing to replace its single benchmark policy with four distinct proxy voting Perspectives. The Perspectives differ primarily on issues where investor views diverge most, including the role of sustainability considerations in voting decisions, the approach to board diversity and the weight given to demonstrated financial performance.

Beginning in September 2027, Glass Lewis clients will be able to choose to receive research that provides analysis and policy outcomes across one or more of the following Perspectives:

  • Business Fundamentals: Broadly takes a flexible view of governance standards when boards and management teams have demonstrated a strong record of generating shareholder returns. Strong relative shareholder returns can earn added latitude on governance expectations. Proposals relating to environmental and social topics will be considered material only if there is demonstrated financial harm.
  • Foundational Governance: Broadly regards high governance standards as essential to safeguarding long-term shareholder value; less concerned with short-term financial performance. Same threshold for environmental and social topics as Business Fundamentals.
  • Global Stewardship: Broadly regards both high governance standards and rigorous oversight of financially material sustainability risks as essential to protect long-term shareholder value. Environmental and social topics will be viewed through an industry-based materiality lens: oversight and disclosure will be expected where exposure is material.
  • Sustainability Focused: Broadly focusses on both high governance standards and rigorous oversight of sustainability risks that are or could become financially material over extended time horizons and across portfolios. Environmental and social topics will be viewed through an industry lens and will take into account both impact on the company’s financial position and prospects and impact on the environment etc (double materiality).

The consultation closes on 16 October 2026.

Directors fined for failing to comply with identity verification requirements

Three directors have been fined for failing to comply with the new requirements, introduced by the Economic Crime and Corporate Transparency Act 2023, to get their identities verified. This is the first time a director has been convicted for such a failure. The press release issued by the Insolvency Service and Companies House notes that the directors were given multiple opportunities to comply with the requirements before enforcement action was taken.

Mandatory identity verification for directors took effect on 18 November 2025, applying immediately to new directors acting from this date. Existing directors are required to verify their identity when filing their company’s next confirmation statement during the 12-month transition period. Company directors who have not yet verified their identity are reminded to do so as soon as possible. Identity verification can be completed via an Authorised Corporate Service Provider or free of charge via the Companies House online service.

Back to top

Legislation

European Commission publishes finalised European Sustainability Reporting Standards and voluntary reporting standards

On 21 September 2026 two pieces of EU legislation relating to sustainability reporting were published in the Official Journal of the EU:

  • Commission Delegated Regulation (EU) 2026/1563 amending Delegated Regulation (EU) 2023/2772 as regards the simplification of certain sustainability reporting standards (ESRS Simplification Regulation). The ESRS Simplification Regulation revises and simplifies European Sustainability Reporting Standards (ESRS) for entities in scope of the EU Corporate Sustainability Reporting Directive (CSRD). Among other things, the ESRS Simplification Regulation:

    • reduces the number of datapoints for reporting;
    • clarifies the distinction between mandatory and voluntary reporting requirements;
    • simplifies the concept of materiality, and clarifies how to conduct the double materiality assessment;
    • introduces various reliefs and flexibilities for preparing the sustainability statement, including in relation to the sources of value chain information and the presentation of information; and
    • phases in certain more onerous requirements.

The ESRS Simplification Regulation comes into force on 10 November 2026. Companies that fall within scope of the CSRD must adopt the revised ESRS for their sustainability reporting on financial years beginning on or after 1 January 2027, and may do so sooner if they wish. Entities subject to reporting requirements starting in 2026 can use the revised ESRS or the previous version (with the option to make use of reliefs set out in the revised ESRS). The version of the ESRS that has been applied must be clearly identified in the sustainability statement.

In-scope companies broadly comprise: (i) EU undertakings and issuers (which can include non-EU issuers with a listing of securities on an EU regulated market) which, on their balance sheet dates, exceed a net turnover of EUR 450 million and an average of 1,000 employees during the financial year; and (ii) non-EU companies that (a) had a net EU turnover of more than EUR 450 million for each of the last two consecutive years (at a group or individual level) and (b) an EU subsidiary or EU branch that generated a net turnover of more than EUR 200 million in the previous financial year.

  • Commission Delegated Regulation (EU) 2026/1560 supplementing Directive 2013/34/EU of the European Parliament and of the Council by establishing sustainability reporting standards for voluntary use by companies with no more than 1,000 employees on average during the financial year (whatever their net turnover) (Voluntary Standards Regulation). Such companies are defined as “protected undertakings” if they are in the value chain of a reporting company. The Voluntary Standards Regulation:

    • facilitates standardised voluntary sustainability reporting by protected undertakings and other companies outside the scope of the CSRD. From 24 September 2026, such companies are encouraged to report in accordance with the Voluntary Standards Regulation; and
    • limits the information that in-scope entities can ask protected undertakings to provide. For financial years beginning on or after 1 January 2027, in-scope companies will not be able to require protected undertakings in their value chain to provide information beyond a limited list of core ESG datapoints, set out in Annex II of the Voluntary Standards Regulation.

The publication of the Regulations follows the Commission’s adoption of the revised ESRS and voluntary reporting standard in July, as covered in Corporate Update Bulletin - 9 July 2026, and forms part of the broader simplification of EU sustainability reporting requirements initiated in early 2025 through the Omnibus I package. The Omnibus I package reduced the number of companies within scope of the CSRD by approximately 90% by removing those with less than €450 million revenue and 1,000 employees, and introduced a voluntary reporting standard for companies under this threshold. For further detail see our blogpost.

Note that non-EU parent companies that fall within scope of CSRD can choose to report under a separate standard, which is generally seen as less onerous than ESRS reporting – known as the ESRS for Certain Non-EU Undertakings (ESRS-40a). Some entities will opt to produce full ESRS reporting in order to take advantage of exemptions for in-scope subsidiaries. As covered in Corporate Update Bulletin - 6 August 2026, and our blogpost, the European Financial Reporting Advisory Group (EFRAG) is consulting on a draft of ESRS-40a. The consultation will close on 31 October 2026. The responses will inform EFRAG’s technical advice to the European Commission, which is expected in January 2027. The Commission will then launch its own consultation before adopting the final version of ESRS-40a.

Back to top