Sustainability Reporting in Times of Conflict – When Transparency Becomes a Risk

In recent years, the European Union has created far-reaching regulations with the Corporate Sustainability Reporting Directive (CSRD) and accompanying standards such as the ESRS (European Sustainability Reporting Standards) to oblige companies to be more transparent about their environmental, social and corporate ethical impact. This development is based on a fundamentally welcome objective: sustainability should become measurable, comparable and controllable – in the sense of a resilient, responsible economy.

But there is a downside that has so far been little talked about – at least not openly: What happens to this sensitive company data in a geopolitically unstable Europe that is increasingly preparing for potential military conflicts? So what happens when the same data that fosters trust is used to destabilize?

Transparency versus resilience: a contradiction?

The new reporting standards not only require companies to provide information on their own CO₂ emissions, resource consumption and human rights issues, but also detailed data on

• their supply chains and critical dependencies,
• Locations and capacities of production facilities,
• Sources of raw materials and logistical dependencies,
• working conditions along the entire value chain,
• and critical stakeholder relationships in third countries.

Until now, this information has often only been available internally or from selected partners. With the CSRD, however, much of this data – at least in summarized form – will be included in publicly accessible sustainability reports or databases.

The problem: transparency creates areas of attack

What creates trust, investment and competitive advantages in times of peace can turn into the opposite in times of geopolitical crisis: Transparency can become a target.

A company that discloses that 70% of its rare earths come from a single Chinese province – or that half of its supply chain relies on a fragile port logistics system in the Eastern Mediterranean – makes itself transparent not only to analysts, but also to opposing actors.

Geopolitical tensions: An underestimated context

Europe’s geopolitical framework has changed drastically since the Russian war of aggression against Ukraine in 2022. Security policy experts and leading politicians are now openly warning of a further escalation, possibly even of a military nature – for example with regard to a possible conflict with Russia or tensions in the Arctic, the Indo-Pacific or in cyberspace.

In such a scenario, economic infrastructure is increasingly seen as a strategic target – and information becomes a weapon:

• Hacking groups with a state background could specifically search sustainability databases for weak points in supply chains.
• Acts of sabotage against critical supplier locations could be prepared on the basis of publicly accessible sustainability reports.
• Social engineering attacks on employees or local stakeholders could be based on the finest details from reporting.
• Sanctions or embargoes could use disclosed data to target companies whose international ties would otherwise have remained under the radar.

The balancing act for companies: Compliance vs. security

Companies therefore find themselves in a dilemma: on the one hand, there is a legal obligation to report on sustainability. On the other hand, fulfilling this obligation can pose a security risk in certain contexts – especially if the reports are published without reflection or without protective mechanisms.

So far, the legal requirements hardly allow any exceptions or redactions on the grounds of “trade secrets” or “security interests”. Although the CSRD provides in exceptional cases that certain information does not have to be published due to business secrets, the threshold for this is high and pressure from investors, the public and NGOs often makes such redactions politically or reputationally risky.

At the same time, there are no clear guidelines on how companies can protect themselves without violating the requirements of the CSRD and the ESRS.

How can companies protect themselves?

Companies should not panic now – but they should take precautions. The following steps are recommended:

1. Systematically assess the criticality of the data

Not all sustainability information is equally sensitive. Companies should carry out risk assessments for their reporting:

• What information could be used operationally or strategically against us in the wrong hands?
• Where are critical dependencies that should not be published unnecessarily?
• Which suppliers or locations are subject to particular geopolitical risks?

2. Use Aggregated, Non-specific Reporting Where Possible

Sustainability reports do not always have to go into maximum detail. It is legitimate, for example:

• aggregated data instead of individual suppliers,
• regions instead of naming exact locations,
• or to use estimates and ranges, provided this is done in accordance with the reporting standards.

It should always be clearly documented why certain data is not disclosed – for example, with reference to security interests or competitive reasons.

3. Integrate governance structures

The assessment of which data may or may not be published should not be carried out by the sustainability department alone. It requires close coordination with:

• Compliance and legal departments,
• IT security managers,
• and, if available, security or crisis teams within the company.

Depending on the sector, cooperation with government agencies or chambers may also be useful.

4. Advocate exemption rules at EU level: Push for Policy Change

Many companies are not alone with this problem. Industry associations, chambers and business networks should put the issue on the political agenda. It needs clear:

• Exceptions for sensitive information,
• Confidentiality classes in reporting,
• as well as the possibility of non-disclosure in the event of threat situations, e.g. based on a classification by the BSI or other authorities.

The sustainability agenda must not lead to companies finding themselves unprotected in a new geopolitical context.

Conclusion: Sustainability yes – but not naively

Sustainability reporting is an important building block for responsible business. However, responsibility also means realistically assessing risks – and not blindly submitting to the dogma of “transparency at any price”.

In a world in which economic structures are increasingly part of strategic conflicts, companies must carefully consider what they publish – and how. The duty of sustainability must not become a weak point. It is time for an honest debate about the protection of sensitive information in the age of sustainability. Sustainability reporting must not be pursued naively.

Related Links:

• The Supply Chain Act in Germany
• SFDR – 2021 to 2023 obligations
• Internet of Things: Security and Convenience
• IT Careers That Will Boom in the Next Decade
• Cybersecurity Challenges in Digital Marketing