Copy-Paste Governance: How ESG Regulation Is Triggering the Market - By Design or By Mistake?

A rule meant to improve ESG data quality is now drawing fire for introducing bias and operational paralysis. Under the European Union’s new ESG Ratings Regulation (EU) 2024/3005, rating providers must notify companies ‘during its working hours and at least two full working days before the first issuance of the ESG rating’ to allow for factual error correction.

At first glance, this might sound like a reasonable safeguard. In practice, it assumes every rating begins with a conversation. Many ESG providers don’t even know who to call - and that’s by design.

This single clause - issuer pre-notification - has fractured a growing industry. Some view it as necessary discipline. Others see it as a direct threat to the integrity, independence, and viability of the ESG rating process itself.

Wrong Model, Wrong Market

The issuer pre-notification rule borrows its logic from credit rating governance: issuer relationships, solicited data, and pre-publication fact checks. The EU explicitly justifies the rule by referencing credit rating regulations, where similar provisions exist. That logic works in credit markets. Companies typically solicit credit ratings, provide internal data, and review draft ratings before publication. There is a long-established feedback loop.

ESG ratings are structurally different. They are often unsolicited. Many are automated or algorithmic. Some focus exclusively on public controversies and intentionally avoid any engagement with the issuer. The governance logic is inverted.

RepRisk, for example, takes an ‘outside-in’ approach, analysing public sources and excluding company disclosures by design. Their product is designed to bypass reputational spin. Pre-notification would invite exactly the kind of issuer influence they are structured to avoid.

ClarityAI presents a different challenge. These technology-focused providers process vast quantities of already-public company data. Asking issuers to verify what they themselves have disclosed adds little value and imposes unnecessary compliance overhead.

The European Association of Sustainability Rating Agencies (EASRA) warns the rule would create a ‘disproportionate volume of cost’, forcing providers to send thousands - potentially hundreds of thousands - of individual notifications for ratings that are often updated continuously. This makes real-time coverage impossible.

The logic behind the rule assumes several things: that issuers are the best source of facts, that errors are objective and easily corrected, and that a pre-existing relationship with the issuer exists. In large parts of the ESG market, none of those assumptions hold. This is not governance tailored to fit. It is governance by analogy.

Protecting Whom?

EASRA’s critique goes beyond workload. The rule risks pushing small and mid-sized providers out of the market. The likely result is further concentration of ESG ratings among a few large, well-capitalised - often non-European - players.

Transparency requirements add another layer of pressure. The regulation mandates ‘deep disclosures of underlying data and scoring models’, a move EASRA argues will expose intellectual property and allow competitors to reverse-engineer proprietary algorithms.

Morningstar, whose ESG methodology already includes issuer engagement, has welcomed the regulation. This is not surprising. Regulatory designs that mimic the operational norms of incumbents often entrench those incumbents. What’s presented as levelling the playing field may, in fact, be reinforcing the hierarchy.

Meanwhile, issuer responsibilities remain vague. There are no reciprocal obligations regarding response times, factual substantiation, or dispute resolution. Rating providers bear all the procedural weight. The result is a one-sided system that could burden both raters and the very companies it claims to protect - while delivering slower, less responsive ratings to the investors who rely on them.

Iterative Regulation or Structural Misfire?

The EU positions its regulatory framework as adaptive. Built-in review clauses, transitional provisions, and ESMA’s role in developing technical standards all suggest a living regime. ESMA has already opened consultations on interpretive guidance, and the regulation explicitly states that it does not seek to harmonise methodologies - an encouraging signal.

There is precedent for iteration. The Sustainable Finance Disclosure Regulation (SFDR) underwent major revisions in response to market feedback. MiFID II’s technical rules were developed and refined after adoption. This regulation could evolve too.

If the EU designed this rule to test boundaries and reveal friction points, it is succeeding. The tension is visible. The question is whether the system can hear the signal - and respond meaningfully.

Global Divergence and Risk of Isolation

The EU’s position is unique. The UK is preparing to regulate ESG ratings but has taken a principles-based approach to issuer engagement, in line with IOSCO’s recommendations. The US SEC has focused on disclosures and greenwashing risks but has not imposed procedural requirements on ESG raters. IOSCO itself recommends that providers consider issuer engagement but stops short of prescribing it. The EU is going further… and doing so alone.

This divergence raises the risk of regulatory fragmentation. Global ESG providers may prioritise jurisdictions with lower compliance costs and less rigid frameworks. European regulation could end up narrowing the field, not elevating it. If the cost of entry rises too far, the EU risks pushing some of the most innovative actors out of its market entirely.

The Real Cost: Innovation and Diversity

This is not just a question of compliance. It is a question of survival.

The pre-notification rule threatens the methodological diversity that makes the ESG landscape vibrant - and competitive. Agile, data-led firms are penalised. Real-time risk coverage becomes harder to deliver. Providers who intentionally avoid issuer bias are required to introduce it.

Larger players with established compliance departments can absorb the hit. Smaller ones cannot. The result is likely to be market concentration, reduced innovation, and a flattening of ESG insight. The EU says it wants variety. This rule narrows it.

Even the regulation’s ‘lighter’ regime for small providers - a temporary three-year alternative - offers only short-term relief. It delays the collision between regulation and business model. It doesn’t prevent it.

Governance That Hears or Commands?

The EU regulation sets out worthy aims: improving data quality, protecting investors, and curbing greenwashing. These are legitimate policy goals. The question is whether the tools match the terrain.

RepRisk’s model excludes company self-disclosures precisely because self-reported data is not always reliable - especially where reputational risk is concerned. Mandating issuer engagement undermines this logic. It doesn’t increase trust. It dilutes it.

Governing unfamiliar systems with familiar tools may feel safe, but it is not neutral. It produces casualties. Often the most innovative ones. ESG ratings are increasingly central to how markets perceive risk. Their role may be converging with credit ratings. Their logic is not.

The EU’s ‘copy-paste’ instinct may have triggered the very kind of market response adaptive governance needs. If that was the goal, then it worked. The fractures are now visible. A rule that assumes conversation risks silencing parts of the market built on avoiding conversation. That only works if the EU chooses to listen - and adapts while there's still time.

What Might Fix It? Paths to a Smarter Rule

If this rule stays as written, ESG ratings in the EU will become slower, more expensive, and less diverse. There are better options - each with trade-offs, but each more proportionate to the problem at hand.

1. Risk-Based Exemptions

Introduce thresholds: only high-impact ratings (e.g. those used in regulated financial products) trigger pre-notification. Low-impact or passive ratings would be exempt.

Implication: Reduces burden on bulk-data and AI-driven firms. May leave a regulatory blind spot around mid-tier ESG scores, but improves proportionality.

2. Post-Facto Notification with Redress

Allow immediate publication, but mandate that issuers be notified and offered a formal window (e.g. 30 days) to contest factual errors.

Implication: Preserves rating independence and real-time updates, while giving issuers a remedy. Risks being seen as too weak by transparency advocates. It would also inject data into the market that may be impactful before it can be revised, thus threatening the utility of the ESG Rating sector.

3. Voluntary Issuer Registry

Create an EU-hosted registry where issuers can opt in to receive pre-publication notifications. Notification becomes an entitlement, not a requirement.

Implication: Encourages voluntary engagement without overburdening raters. Might reduce consistency across the ratings ecosystem. It also adds burden to issuers who may not be built to respond adequately.

4. Methodology-Based Carveouts

Allow exemptions for firms whose methodologies rely exclusively on public data or controversy monitoring, where issuer contact would undermine objectivity.

Implication: Protects the independence of providers like RepRisk. Requires ESMA to develop robust oversight mechanisms to prevent abuse of the carveout. This increases the pressure on the Regulator in this nascent area.

5. Centralised Notification Clearinghouse

Build a shared platform where ESG raters can submit notices en masse, rather than direct emails to every rated entity.

Implication: Could reduce operational friction significantly. Would require substantial upfront investment and strong data privacy safeguards.

What Happens If Nothing Changes?

If the rule survives unmodified, here’s what to expect:

Consolidation: Smaller providers exit, merge, or shift focus away from the EU

Distortion: Methodologies evolve to accommodate compliance, not insight

Delay: Investors lose access to timely signals on emerging ESG risks

Global divergence: The EU becomes an ESG island, while others move ahead (or in vastly different directions).

Ultimately, the regulation’s long-term success will not hinge on its ambition - but on its responsiveness.

This is the moment to fix the rule. Not later. Not retroactively. Now.