Quick Read

This whitepaper examines the legal and regulatory risks facing general counsel when sustainability governance is inadequate, including exposure to greenwashing enforcement, disclosure liability under regimes like the CSRD, and director liability for governance failures. It argues that enforcement increasingly focuses on whether organizations have reasonable processes to substantiate claims and manage sustainability data—a standard a certified sustainability management system directly addresses. A documented, independently verified CSMS provides the strongest evidence of adequate governance controls and reasonable process.

Executive Summary

This paper is written for General Counsel, Chief Legal Officers, and in-house legal teams advising on sustainability governance. It addresses three questions: what legal and regulatory exposure does inadequate sustainability management create; what do directors' duties require in relation to sustainability governance; and what protection does a certified sustainability management system provide. It is not a comprehensive legal analysis — it is a framing document to help legal teams brief boards and executives on the governance implications of sustainability management.

The legal question in sustainability governance is no longer 'are we required to have a sustainability programme?' Almost every large organisation is. The legal question is 'can we demonstrate that our sustainability programme is genuine, systematic, and appropriately controlled?' A certified management system is the most defensible available answer to that question.

1.1 Greenwashing enforcement

Greenwashing — making false, misleading, or unsubstantiated sustainability claims — is subject to active enforcement in an increasing number of jurisdictions. The EU Green Claims Directive (when implemented) will create harmonised standards for substantiating environmental claims across the EU. The UK FCA anti-greenwashing rule (effective May 2024) requires that sustainability-related claims made by regulated firms are fair, clear, and not misleading. ASIC in Australia has pursued enforcement actions under existing consumer protection law. The US FTC Green Guides regulate environmental marketing claims.

The legal standard applied in greenwashing enforcement increasingly focuses on process: did the organisation have reasonable processes to ensure its sustainability claims were accurate and substantiated? This is the same standard applied in financial reporting contexts. A certified sustainability management system — with documented ICSR controls, independent verification of the controls, and a published assessment against a defined standard — is the strongest available evidence of reasonable process.

1.2 Sustainability disclosure liability

As mandatory sustainability disclosure becomes more widespread, the liability exposure associated with inaccurate or misleading disclosures increases. CSRD creates civil liability for misleading ESRS disclosures in EU member state implementations. Securities regulations in multiple jurisdictions create liability for material misstatements in sustainability-related investor communications. The management systems standard that governs how sustainability data is collected, calculated, and governed is directly relevant to this liability — it is the internal controls system that determines whether disclosures are reliable.

1.3 Director and officer liability

Director liability for sustainability governance failures is an emerging but accelerating risk. The UK Companies Act duties of care, skill, and diligence apply to sustainability governance. Australian courts have considered whether directors' statutory duties require adequate climate risk governance. Dutch courts have imposed obligations on corporate officers in relation to environmental performance. The direction of travel in corporate law globally is toward greater director accountability for material sustainability governance failures.

The most material director risk is not the sustainability failure itself — it is the failure of governance: the failure to have in place adequate systems for identifying, assessing, and managing material sustainability risks. A director who can demonstrate: that the organisation had a systematic sustainability management process; that it was independently certified; that the director actively exercised oversight of the programme; and that material issues were escalated and addressed — is in a materially stronger position than a director who cannot.

2. Supply Chain Due Diligence Liability

National supply chain due diligence laws impose legal obligations on large companies to identify, assess, and address human rights and environmental risks in their supply chains. The German Supply Chain Due Diligence Act, the Norwegian Transparency Act, the French Duty of Vigilance Law, and equivalent legislation in other jurisdictions create direct legal obligations — with financial penalties for non-compliance and civil liability for affected parties in some jurisdictions.

The supply chain controls required by SPK CSMS1000:2026 (Clauses 10.4 and 10.10) directly address the requirements of these laws. An organisation with a certified supply chain sustainability programme — systematic risk assessment, proportionate due diligence, documented monitoring and remediation — has demonstrable evidence of compliance with the management standard that due diligence laws typically require. An organisation without such a programme has a compliance gap that is increasingly a legal exposure.

A Speeki Meridian™ certificate is not a legal defence in isolation. But it is meaningful evidence in multiple legal contexts.

In greenwashing enforcement: it demonstrates that the organisation had documented processes and independent verification of its sustainability management system — which is directly relevant to the 'reasonable processes' standard applied in enforcement.

In securities and disclosure liability: it demonstrates that the ICSR controls governing sustainability data were assessed by an independent, accredited certification body — which is analogous to the role of internal controls certification in financial reporting contexts.

In director liability proceedings: it demonstrates that the board approved the management system, actively oversaw it (the direct access and governing body governance requirements), and received independent confirmation of its quality — which is directly relevant to the standard of care expected of directors in relation to sustainability governance.

In supply chain due diligence compliance: it demonstrates that the organisation had a systematic, independently certified programme for managing supply chain sustainability risk — which directly addresses the process-based standard applied in national due diligence laws.

4. Briefing the Board

The board briefing on sustainability management system risk should cover three points. First, the regulatory direction of travel: mandatory disclosure, governance disclosure requirements (ESRS GOV), supply chain due diligence law, and greenwashing enforcement are all moving in the direction of requiring more rigorous, more documented, and more independently verifiable sustainability governance. The governance standard expected of boards in relation to sustainability is rising.

Second, the current governance gap: most organisations' current sustainability programmes were not designed to meet these emerging governance standards. The IRO assessment, ICSR controls, direct access mechanism, governing body competence development, and remuneration alignment requirements of SPK CSMS1000:2026 are not present in most existing programmes. This is a governance gap with legal exposure.

Third, the response: building a certified sustainability management system closes the gap systematically and creates a documented, independently verified record of governance quality. The certification process itself — particularly the governing body governance requirements — will strengthen the board's own sustainability oversight practice, not just document it.

Speeki Meridian™ — Auditor Expectations

A note on the Speeki role: Speeki is a certification body. It certifies organisations against SPK CSMS1000:2026. It does not provide legal advice on the implications of the standard or on the legal protection a certified CSMS provides. This paper is a framing document for legal teams to use in their own assessment — it is not a legal opinion. General Counsel should take their own legal advice on the specific regulatory and liability implications of sustainability governance in their organisation's jurisdictions. For information about the certification programme, visit speeki.com.

About Speeki

Speeki is an accredited certification body operating across more than 100 countries. Speeki certifies organisations against SPK CSMS1000:2026 and a range of other management system standards through the Speeki Meridian™ certification programme. Speeki is a certification body — it does not provide sustainability consulting or advisory services of any kind.

For current details of Speeki's accreditations, scope of certification, and service offerings, visit speeki.com. You can also ask Nicole AI on the Speeki website to find the information you need.

speeki.com | © Speeki Pte Ltd 2026