Regulation (EU) 2024/3005: A Practical Guide for ESG and Sustainability Teams

ESG ratings have shaped billions in capital allocation and thousands of procurement decisions for years, without a single EU rulebook governing how those ratings get built. That changes on 2 July 2026.

Regulation (EU) 2024/3005 brings ESG rating providers under a unified EU supervisory regime for the first time, with ESMA as the enforcer. If your team relies on an EcoVadis score, an MSCI ESG Rating, an S&P Global CSA result, or a Morningstar Sustainalytics score, either to report on your own performance or to screen suppliers and investments, this regulation will touch you within the next 12 months.

Here's what's actually changing, who it applies to, and what it means for the way you collect and manage ESG data going forward.

What the Regulation Is and Why It Exists

Regulation (EU) 2024/3005 on the transparency and integrity of ESG rating activities was introduced to solve a specific problem: ESG ratings were widely used in EU capital markets and procurement, but almost entirely unregulated. Two providers could rate the same company on the same criteria and land on very different scores, with no requirement to explain why.

The regulation's core goal is comparability and conflict-of-interest management. Providers will now have to show their work.

Timeline and Scope

• The regulation entered into force in early 2025.
• Its application date is 2 July 2026.
• From that date, ESG rating providers serving EU users fall within scope of ESMA's supervisory regime.
• EU-based providers like EcoVadis apply for direct authorisation, with applications due by November 2026.
• Non-EU providers, including US-headquartered MSCI, S&P Global and Morningstar Sustainalytics, are expected to pursue equivalence, recognition or endorsement routes instead of direct EU authorisation, but the effect is the same: they need ESMA's sign-off to keep operating in the EU.
• Scope is broad: it covers ratings used in financial markets and supply-chain ratings used in procurement.
• That second category is what pulls EcoVadis directly into the framework, alongside financial-market raters like MSCI, S&P Global and Morningstar Sustainalytics.

What Changes for Rating Providers

Under the new regime, providers including EcoVadis, S&P Global CSA, MSCI ESG Ratings and Morningstar Sustainalytics will need to:

‍Get sign-off from ESMA. EU-based providers like EcoVadis apply for direct authorisation. Non-EU providers like MSCI, S&P Global and Morningstar Sustainalytics are expected to rely on equivalence, recognition, or endorsement by an authorised EU entity instead. Either way, ESMA can request information, run inspections, and sanction serious breaches.

‍Publish their methodology. Models, key assumptions, data sources, estimation methods and limitations all need to be disclosed publicly, along with how E, S and G dimensions are weighted (separately or combined into one score).

‍Disclose their materiality lens. Providers must state whether they apply single materiality or double materiality, bringing ESG ratings into closer alignment with how SFDR and CSRD already define materiality.

‍Separate ratings from other commercial activity. Providers need organisational separation between rating production and any consulting or advisory services that could bias an outcome, plus documented governance to protect independence.

In short: the black-box era of ESG scoring is ending. Every major provider will need to show, in writing, how a score gets made.

What Changes for Companies and Procurement Teams

If you're on the receiving end of these ratings, three things shift:

‍You get more visibility. Methodology documents, data sources and materiality approach become accessible, which makes it easier to identify and formally contest scoring errors with evidence rather than argument.

‍The bar on data quality rises. Because providers must now demonstrate rigorous, traceable methodologies, they'll need more reliable and verifiable data inputs from the companies and suppliers they rate. Loosely structured spreadsheets and PDF questionnaires won't hold up as well as they used to.

‍The provider landscape may shift. Smaller or less rigorous rating providers may struggle to meet ESMA's authorisation bar and could exit the EU market over the next one to two years, changing which scores show up in your supplier base or investment portfolio.

For sustainability, procurement and investor relations teams already managing EcoVadis, CDP, MSCI or Sustainalytics relationships, this is the moment to check how audit-ready your underlying ESG data actually is, not just the score itself.

Why This Matters Now

Regulation (EU) 2024/3005 doesn't just change how rating providers operate. It raises the evidentiary bar for every company being rated. Structured, traceable, source-linked ESG data stops being a nice-to-have and becomes the thing that determines whether your score holds up to scrutiny, and whether you can contest it when it doesn't.
‍
With published methodologies, disclosed weighting and a clear materiality lens, gap analysis also gets easier. Instead of guessing how a score might land, companies can map their own data against a provider's published criteria beforehand and get a much clearer picture of what a score will look like before it's issued.
‍
That's the shift worth preparing for well before the 2 July 2026 application date.
‍

Worth a look before the deadline does it for you. If you want to map your data against a disclosed methodology, that's something we can help with.