Since July 2026, ESG rating providers selling into the EU answer to ESMA on how they build their methodologies, govern their ratings and manage conflicts of interest. Providers have spent the summer doing their homework. Clarity AI, for example, sets out how it applies the regulation on its ESG Ratings Disclosures page. The question for institutional investors is what homework is left for them.
That question was at the heart of Clarity AI’s September webinar, Inside the ESG Ratings Regulation: what changes for investors from 2026, featuring Iulia Cospanaru, Compliance Lead and Patricia Pina, Chief Research Officer, and moderated by Chief Sustainability Officer Lorenzo Saa.
Why the regulation exists, and who it covers
The regulation, formally Regulation (EU) 2024/3005, answers long-standing market concerns: opaque methodologies, doubts about independence, rated companies unable to review their data, and very different ratings for the same company. It follows IOSCO recommendations and voluntary codes of conduct, and is one of three hard-law regimes now supervising ESG rating providers.
Its reach extends beyond the EU. It covers EU-based providers and non-EU providers selling to EU clients. It applies to ESG ratings, meaning assessments based on a methodology and a ranking system, but not to ESG data. Its four pillars are governance, transparency, independence and authorisation by ESMA.
Critically, it does not standardise methodologies. It regulates process, not outcomes, and explicitly aims to preserve diversity and competition.
Where authorisation stands
By the August 2nd notification deadline, 109 providers had told ESMA they intended to keep operating in the EU: 90 based in the EU and 19 outside it. Notification acts as a provisional registration while ESMA assesses full applications.
Of those, 34 small providers opted for a temporary regime. It exempts them from most rules, apart from high-level principles on independence and transparency, for up to three years. The aim is to ease market access for smaller providers and protect competition.
Medium and large providers face the full process. They submit applications proving compliance in a window running from September to November.
How providers have done their homework
Providers have spent months building the machinery the regulation demands. Iulia Cospanaru, Compliance Lead at Clarity AI, outlined during the webinar what that looks like in practice:
- Governance: formal sign-off of methodologies and ratings, plus independent compliance oversight. Every rated company must be notified, at least two full working days before a first rating is published. Reasoned concerns must be answered within 30 working days, and the industry has converged on around four weeks for complaints.
- Independence: controls over conflicts arising from corporate structure, business lines and shareholders, plus strict personal rules. Senior managers may not invest in companies their firm rates, and analysts may not rate companies they hold.
- Transparency: dedicated disclosure pages for the public, rated companies and clients. Some providers go further and publish everything openly rather than tiering disclosures.
What investors are getting out of it
We asked the audience which impact of the regulation investors will notice most. Votes split almost evenly: 27% chose easier comparison between providers, while greater transparency into methodologies and greater confidence in rating quality drew 23% each. Better visibility into governance and conflicts of interest drew just 3%. The final option, little visible change for investors, drew as many votes as transparency and confidence.
Patricia Pina was surprised that 23% of the audience expected so little, since investors helped drive the regulation.
- Transparency. Providers have now published their methodologies, so investors can read and compare them without being clients of each one. The required level of detail also forces answers to questions that were often left vague, such as whether a rating measures financial risk, impact or both.
- Comparability. Investors can see where ratings agree and diverge, and how each compares with their own in-house view.
- Scrutiny from rated companies. Companies now have the right to know they are rated, to access their rating, data and methodology, and to challenge potential factual errors. Providers must review and resolve those challenges, and companies can escalate to a formal complaint.
This whole process raises the level of scrutiny that goes into the rating and the data, and that results in a higher quality level for the final ratings”
Conflicts of interest have historically ranked below black boxes and data errors, and their impact has been hard to measure. Iulia expects that to change as data on ratings revised after reviews and complaints builds up. One early signal: ERM’s Rate the Raters found corporate trust in ESG rating providers rose 6% between 2023 and 2025.
What 30,000 companies told us
Clarity AI has invested heavily in engaging rated companies. It has notified more than 30,000 companies by email. Each can log in to see its ratings and underlying data and flag a potential factual error on any data point. Every challenge goes through a formal review.
| Engagement metric | Share |
|---|---|
| Companies notified that accessed the platform | 10% |
| Companies that contacted Clarity AI | 1% |
| Messages asking questions or for more information | 40% |
| Messages flagging a potential factual error | 60% |
| Error challenges resulting in an actual data correction | 5% |
The most common challenge is simple: your number doesn’t match my sustainability report. In more than half of cases, the difference comes down to methodology, meaning how a metric is defined or calculated. About 40% concern data freshness, where a company has just published a new report. Clarity AI prioritises both. Only 5% end in a corrected value.
At the time of the webinar on 15 September, just over two months after the rules started to apply, it was still early days. But Patricia expects a reinforcing loop: as companies see that disclosing more data changes their rating, they have both a channel and a reason to share more. Better ratings for investors to follow.
The investor’s homework: what to ask your providers
Asked whether investors need to change how they engage with rating providers, most of the audience answered “to some extent”. The speakers agreed.
Due diligence obligations existed before the regulation, Iulia noted. In practice, though, providers often invoked confidentiality to give vague answers or none at all. Clear disclosure rules now let investors move beyond “do I like this rating?” to “do I trust it to be accurate, and to reflect the actual risks?”
It won’t entirely change the due diligence process, but it will give investors a significantly different lens to assess the ESG rating providers they work with”
The speakers suggested starting with these questions:
- Is my provider authorised, or in the process?
- Which products I use are in scope, and if not, why not? The definition is broad. Assessing the credibility of a climate transition plan, or alignment with UN Global Compact or OECD guidelines, counts as an ESG rating.
- How are methodology changes approved and tracked?
- How are rated companies notified, and on what timelines?
- When a company flags a factual error, how is it reviewed, and how fast does corrected data reach me?
- How are conflicts of interest managed?
- How does the provider balance compliance with innovation?
Two risks to watch
Not every effect of the regulation will be positive. When an attendee asked about unintended consequences, Patricia pointed to two that investors should keep an eye on.
The first one: pressure to standardise methodologies. The regulation governs process, not methodology. Patricia argued that any future push to align methodologies would be a mistake. An ESG rating is an opinion, and given the industry’s maturity and the uncertainty around sustainability trends, she would be surprised if ratings converged.
An ESG rating is an opinion. That’s why transparency on assumptions and limitations is critical. I truly believe there is value in that divergence”
The second one: slower innovation. Building formal policies, review layers and approvals takes time and adds rigidity. The challenge is to comply without losing the agility to bring new products to market, and to use compliance to improve how teams work. Get that balance wrong and innovation suffers. Investors and regulators should watch whether new products and new providers keep reaching the market.
The bottom line
The EU ESG Ratings Regulation has already delivered visible change: published methodologies, formal governance and a direct channel between rated companies and providers. The full picture will take longer to emerge, as ESMA authorisations land in 2027 and data on corrections and conflicts builds up. For investors, the benefits are there to be claimed, but only by asking sharper questions of their providers.
Watch the full webinar on demand at Inside the ESG Ratings Regulation: what changes for investors from 2026, and see how Clarity AI applies the regulation on its ESG Ratings Disclosures page.
Author Information
