On 2 August 2026, the EU's ESG Ratings Regulation began requiring ESG rating providers to notify the regulator ESMA and seek authorisation, making ESG rating one of the world's first supervised activities of its kind. The move tightens oversight of the firms that score companies even as the EU loosens sustainability reporting obligations for companies themselves through its Omnibus package. For businesses it promises more transparency into how they are rated and stronger grounds to challenge scores, though it stops short of standardising methodologies or ending the divergence between providers.
Something quietly historic happened on 2 August 2026: for the first time anywhere, handing out ESG scores became a licensed, supervised activity. That was the day ESMA opened its notification window under Regulation (EU) 2024/3005. Any firm that wants to keep issuing ESG ratings in the EU must now register and file a full authorisation application by 2 November 2026 — or lose the right to operate. In plain terms, the companies that have spent a decade grading everyone else's sustainability performance now have a report card of their own.
ESG ratings quietly run a lot of the economy, shaping which companies enter sustainability indices, which bonds count as green, which suppliers pass procurement screens, and where capital flows — yet they have operated in a largely unregulated grey zone, each provider using its own methodology and its own definition of what “good” means. ESMA now supervises the raters directly, much as it polices credit rating agencies after their post-2008 overhaul. Notably, it is the sole supervisor, with no national regulators layered underneath.
The twist that makes this more than a compliance milestone: earlier this year the EU sharply scaled back what companies must disclose through the Omnibus package, raising the CSRD thresholds and pulling thousands of firms out of mandatory reporting — while tightening the rules on the firms that rate them. Fewer obligations for the rated; more for the raters. The signal is that Brussels has less appetite for forcing every company to report, but far more for making sure the scores investors rely on are credible.
The regime captures the household names of the ESG data world — Morningstar Sustainalytics, MSCI, S&P Global, ISS and Bloomberg among them — along with specialised research firms and non-EU providers serving European clients. The scale is significant: Morningstar Sustainalytics alone rates more than 16,000 companies, with MSCI and S&P Global each covering well over 10,000. Because most of these giants are headquartered outside the EU, much of the near-term friction will centre on the recognition and endorsement routes that let non-EU providers keep serving European investors.
The new rules require providers to publish their methodologies — and to state whether a rating measures ESG risk (the risk that ESG factors pose to the company) or ESG impact (the company's effect on the wider world), two very different questions that produce very different scores. They must also disclose fee arrangements to prevent conflicts of interest, and meet governance and independence standards. What the rules do not do is create a single European score or standardise methods, so the notorious problem of divergent ratings is here to stay — you will simply have a better shot at understanding why they diverge.
What it means for you: even if you never buy a rating, you gain more visibility into how you're scored and firmer ground to challenge a rating that looks wrong — on its data sources, assumptions, and how gaps in your disclosures were handled. The practical advice is unchanged: know which raters your investors and lenders actually use, compare within your industry rather than across sectors, and treat any single score as one input, never the verdict.
Read more → Regulation (EU) 2024/3005 on EUR-Lex (full text)