No UK company is required by statute to operate an "ESG risk management framework". What exists are threshold-based disclosure duties: SECR for large companies and all quoted companies, climate-related financial disclosures above 500 employees, and a generic principal-risks requirement in the strategic report. The UK Sustainability Reporting Standards are final — and voluntary.
What is actually mandatory
SECR
Streamlined energy and carbon reporting applies for financial years beginning on or after 1 April 2019 to all quoted companies, large unquoted companies and large LLPs.
"Large" here is framed as an exemption: a company is exempt if it satisfies two or more of turnover not more than £36 million, balance sheet total not more than £18 million, and not more than 250 employees.
Those figures are hard-coded in the regulations rather than cross-referenced to the Companies Act size definitions — which means the April 2025 uplift to the Companies Act thresholds did not change SECR's scope. A company that became "medium-sized" for accounts purposes in 2025 may still be in SECR. This is a genuinely common error.
There is also a 40,000 kWh low-energy-user exemption: no disclosure is required where the company consumed 40,000 kWh or less in the period and the report says so.
What has to be disclosed: annual energy consumption in kWh; Scope 1 and 2 greenhouse gas emissions in tonnes of CO2 equivalent; at least one intensity ratio expressing emissions against a quantifiable factor associated with the company's activities; the principal energy efficiency measures taken in the year; the methodologies used; and prior-year comparatives. It goes in the directors' report, or an energy and carbon report for LLPs.
One scope difference worth noting: quoted companies report global energy use and Scope 1 and 2 emissions, while large unquoted companies and LLPs report UK energy use and the associated emissions including transport.
Climate-related financial disclosures
The 2022 regulations inserted sections 414CA and 414CB into the Companies Act, applying for financial years beginning on or after 6 April 2022.
Scope covers traded companies, banking companies, authorised insurance companies, companies carrying on insurance market activity, and AIM-quoted companies — plus "high turnover companies". The requirement is disapplied where a non-parent had no more than 500 employees, or a parent's group aggregate was no more than 500. For large private companies the high-turnover threshold is turnover above £500 million.
Net effect: more than 500 employees for the traded, banking, insurance and AIM categories; more than 500 employees and more than £500m turnover for large private companies.
Eight disclosures are required — governance arrangements; processes for identifying, assessing and managing climate risks and opportunities; how those are integrated into overall risk management; the principal risks and opportunities and the time periods assessed; actual and potential impacts on business model and strategy; resilience analysis under different climate scenarios; targets and performance against them; and the KPIs used and how calculated.
Four of the eight — impacts, scenario resilience, targets and KPIs — may be omitted where the directors reasonably believe disclosure is not necessary for an understanding of the business, with a clear and reasoned explanation. That flexibility is real and under-used.
The strategic report
For most large private companies this is the only "risk" requirement that bites. Section 414C(2)(b) requires a description of the principal risks and uncertainties facing the company — generic, not ESG-specific.
The environmental, employee, and social, community and human rights content in section 414C(7) applies to quoted companies only. Section 414CZA requires a section 172(1) statement, with medium-sized companies exempt and small companies outside the regime altogether.
What is final but voluntary
UK SRS S1 and S2 were published on 25 February 2026. They are final standards — and they are available for voluntary use by any entity that chooses, in whole or in part. The government endorsed the two ISSB standards and issued the UK versions for voluntary use; the FRC confirms that reporting against UK SRS is not currently mandatory.
For private companies, the government will "consider whether to require" reporting under UK SRS as part of its corporate reporting modernisation, with a consultation expected. No mandate has been proposed, let alone enacted.
IFRS S1 and S2 were issued by the ISSB in June 2023, effective for annual periods beginning on or after 1 January 2024. The UK technical assessment was carried out by the UK Sustainability Disclosure Technical Advisory Committee, completed in December 2024, concluding endorsement would be conducive to the long-term public good.
Assurance is not mandatory. The government's January 2026 response set out a voluntary, profession-agnostic oversight regime and register operated by the FRC, which practitioners can opt into, with an interim non-legislative regime from mid-2026. Whether to require assurance is still to be considered.
What is only a proposal
For listed issuers, current FCA rules require an annual statement on whether disclosures are consistent with the TCFD recommendations, on a comply-or-explain basis, now sitting in the UK Listing Rules. Asset managers, life insurers and FCA-regulated pension providers have entity-level and product-level requirements in the ESG sourcebook.
The FCA consulted in CP26/5, published January 2026, on replacing the TCFD-aligned rules with reporting against UK SRS. The consultation closed in March 2026 with a policy statement targeted for autumn 2026 and a proposed effective date of 1 January 2027. As things stand, no rule is in force. Anyone told otherwise is reading a consultation as though it were a rulebook.
So what should a framework actually do?
Since the law prescribes disclosure rather than a framework, the sensible design works backwards from what you have to say and forwards from what the business actually needs.
- Establish scope precisely. Test SECR against £36m/£18m/250 — not the current Companies Act thresholds — and CFD against the 500-employee and £500m tests. Many companies are in one and not the other;
- Build the data before the narrative. Energy consumption in kWh, Scope 1 and 2 in tCO2e, and a defensible intensity ratio are measurement problems. The disclosure is downstream of them;
- Use the omission provision deliberately. Where scenario analysis or targets genuinely are not necessary for an understanding of the business, say so with reasons rather than producing thin content;
- Integrate with the principal risks disclosure rather than running a parallel ESG register. The Companies Act already asks for principal risks; a climate risk that is principal belongs there;
- Treat UK SRS as optional preparation. Adopting voluntarily has a real benefit for companies in listed supply chains or raising capital, and no legal consequence either way.
Be sceptical of any adviser presenting a comprehensive mandatory ESG framework to a mid-sized private company. Check which requirement they say applies, and to whom.
Our guides to ESG reporting and narrative reporting cover the disclosure detail, and biodiversity net gain the one environmental obligation that is genuinely compulsory for developers.
Acumon advises on sustainability reporting and the controls behind it through ESG assurance, risk management and corporate governance work. If you have been told you must report under UK SRS, that is the claim to test first — it is voluntary.