Quick Read
ISO 17298:2025 is a management system standard for biodiversity—not merely a reporting framework—that fundamentally differs from prior environmental standards because biodiversity evidence is seasonal and cannot be reconstructed retrospectively, making the operational system during evidence collection the determinant of disclosure credibility. Unlike carbon inventories, which can be audited months after the fact, biodiversity data expires if surveys are not conducted in the correct season, placing the burden of assurance on whether management systems were functioning when evidence existed. Under ISSA 5000, practitioners must obtain sufficient appropriate evidence, a requirement that biodiversity's temporal constraints make achievable only through real-time system operation, not post-hoc verification.
IN BRIEF
ISO 17298:2025, Biodiversity — Considering biodiversity in the strategy and operations of organizations — Requirements and guidelines, is the first International Standard dedicated to biodiversity. It was developed by ISO/TC 331, chaired by AFNOR, and draws on the French standard NF X32-001.
ISO 17298 is not a reporting standard. It contains general management system requirements — leadership involvement, roles and responsibilities, resource allocation, consideration of stakeholder expectations, audits and continual improvement — and is designed to complement ISO 14001 and ISO 26000.
GRI 101: Biodiversity 2024 is required for all reporting on biodiversity published on or after 1 January 2026. It requires location-specific disclosure of impacts, including impacts arising from products and services in the supply chain beyond the first tier.
Biodiversity evidence is ecological, seasonal and location-specific. Unlike greenhouse gas data, it cannot be reconstructed after the reporting period from documents retained at head office.
A biodiversity-specific verification standard beneath ISO/IEC 17029 — the equivalent of ISO 14064-3 for greenhouse gases — does not yet exist, and accreditation schemes for certification against ISO 17298 remain in development.
Executive summary
Sustainability reporting usually follows one sequence: a disclosure requirement arrives, companies comply, and the infrastructure to make the disclosure believable is built afterwards, in public, in response to failures. Carbon followed it. So did climate risk, and modern slavery reporting, and human rights due diligence.
Nature has, unexpectedly, done something else. The reporting standards arrived on schedule — GRI 101: Biodiversity 2024 took effect for all biodiversity reporting published on or after 1 January 2026, joining ESRS E4 and the TNFD recommendations. And then, within months, the system standard arrived too: ISO 17298:2025, the first International Standard dedicated to biodiversity, developed by ISO's technical committee on the subject.
The market received it as another nature framework, to be filed alongside TNFD and SBTN and read later. That is a category error with consequences.
WHAT ISO 17298 ACTUALLY IS
It is not a disclosure tool. It is a requirements standard containing general management system requirements — leadership, roles and responsibilities, resources, stakeholder expectations, audits, continual improvement — designed to embed biodiversity into strategy, operations and decision-making. It is to biodiversity what ISO 14001 is to environmental management: the internal system, not the external report.
This paper argues that the arrival of a management system standard matters more for nature than it did for any environmental topic that preceded it, and for a reason specific to the subject matter. Greenhouse gas evidence persists: an invoice, a meter reading and an emission factor are as available in November as they were in March. Biodiversity evidence expires. A species survey not conducted in the correct season cannot be conducted retrospectively, and no assurance engagement, however rigorous, can create evidence of it.
Nature is therefore the topic where the disclosure is most completely determined by whether a system was operating while the evidence still existed.
1. Why nature evidence expires
Figure 1 — Carbon evidence persists. Nature evidence expires. The system is the only thing that can be built in time.
Four properties of greenhouse gas data make it tractable to verify. All four are absent from biodiversity data, and the fourth is the one this paper turns on.
Property | Carbon | Nature |
|---|---|---|
A single unit | Tonnes of CO₂e. Every source converts into it. | No single unit. Species richness, area of ecosystem converted, ecosystem condition, ecosystem services — no conversion factor between them. |
Fungibility | A tonne emitted in Chile is a tonne emitted in Chad. | A hectare of intact peatland is not a hectare of degraded scrub. Impacts are not exchangeable. |
Additivity | Site figures sum to a group figure. | Impacts do not sum. Two sites each removing a tenth of a local population may between them extinguish it, or not, depending entirely on where. |
Persistence of evidence | Documentary. Invoices, meters and factors remain available after the period ends. | Ecological, seasonal, location-specific. The breeding season closes. The survey window shuts. The evidence ceases to be obtainable. |
You can reconstruct a carbon inventory from documents in November. You cannot survey a wetland in February, in November. The season has gone, and with it the only evidence that would have supported the disclosure.
This has a consequence that reporting teams generally discover a year too late. Under ISSA 5000, effective for periods beginning on or after 15 December 2026, the practitioner must obtain sufficient appropriate evidence. Where the subject matter is a location-specific ecological assertion, that evidence had to be generated at the site, at the right time, by a competent person. If nobody did so, the practitioner cannot obtain the evidence and the entity cannot supply it. The only remaining options are omission or qualification.
Everything downstream of that fact points in the same direction: for nature, credibility is manufactured entirely upstream, by a system operating during the period. Which is precisely what ISO 17298 specifies.
2. What ISO 17298 requires
Term | Definition |
|---|---|
ISO 17298:2025 | Biodiversity — Considering biodiversity in the strategy and operations of organizations — Requirements and guidelines. Developed by ISO/TC 331, the ISO technical committee on biodiversity, chaired by AFNOR. Draws on the French standard NF X32-001. The first International Standard dedicated to biodiversity. |
Scope | Applies to any organisation regardless of size, sector or geography — companies, public institutions, local authorities and NGOs. Covers activities, sites, land holdings, value chains, life cycle and sphere of influence, and is scalable from a single site to a group. |
Character | A requirements standard, not a reporting standard. It specifies what an organisation must have in place to integrate biodiversity into strategy and operations, rather than what it must disclose. |
Management system content | Includes general ISO management system requirements: leadership involvement, definition of roles and responsibilities, resource allocation, consideration of stakeholder expectations, audits, and continual improvement. |
Alignment | Designed to complement ISO 14001 and ISO 26000. Builds on the TNFD's work, including the LEAP approach, and supports Target 15 of the Kunming-Montreal Global Biodiversity Framework. Recognised publicly by the TNFD. |
Read the fourth row again. Leadership, roles, resources, stakeholder expectations, audits, continual improvement. That is the anatomy of a management system, and it is the anatomy that makes an assertion evidenced rather than asserted.
What it means to have the system rather than the framework
The TNFD's LEAP approach tells an organisation how to locate its interface with nature, evaluate its dependencies and impacts, assess its risks and opportunities, and prepare to respond. It is an assessment methodology, and an excellent one. It does not require that anybody be accountable for performing it, that resources be allocated to it, that its outputs be audited, or that it be performed again next year.
A management system requires all of those things. That is the entire difference between an assessment somebody did once, and a control.
THE DISTINCTION THAT THE MARKET HAS MISSED
GRI 101 tells you what to say. TNFD tells you how to work out what is true. ISO 17298 requires that an organisation exists which is capable of finding out, has been resourced to do so, is audited on whether it did, and improves when it did not.
3. Why this closes the loop with certification
Speeki's paper on the CSMS as assurance infrastructure argued that when the assurance conclusion is capped — as the Omnibus I directive has permanently capped CSRD assurance at the limited level — the only remaining lever an organisation can pull is the independently certified quality of the system that produced the information.
That argument applies with unusual force to nature, for three reasons.
The assurance conclusion is weakest exactly where the subject matter is hardest. In a limited assurance engagement the practitioner obtains an understanding of internal control but is not required to test its operating effectiveness. Applied to a biodiversity disclosure, this means the practitioner need not test whether the ecological survey process operated. For carbon, the underlying numbers can still be traced. For nature, if the process did not operate, there is nothing to trace.
Certification examines the system during the period. A certification body examining conformity with ISO 17298 asks whether roles were defined, whether resources were allocated, whether audits were conducted, whether the biodiversity assessment was performed and acted upon. It asks these questions while the survey seasons are still open.
Nothing else can be built in time. An organisation that discovers in November that its biodiversity disclosure is unsupported can improve its controls for next year. It cannot improve its disclosure for this year. The system is the only intervention with a lead time short enough to matter, and it has to start before the year begins.
The sequence, for nature specifically
First, the system: ISO 17298, operating through the reporting period, with defined accountability and an internal audit programme.
Second, the claim: verification under ISO/IEC 17029 of the specific nature assertions on which external parties rely.
Third, the report: assurance under ISSA 5000, resting on a system whose operation during the period a third party has examined.
Attempt this in the reverse order and the first finding will be that the evidence for the reporting period no longer exists.
4. What is still missing
The arrival of ISO 17298 narrows the gap. It does not close it, and this paper would be less useful if it pretended otherwise.
Layer | What exists | What does not |
|---|---|---|
Reporting | GRI 101: Biodiversity 2024, in effect 1 January 2026. ESRS E4. TNFD recommendations. SBTN methods. | — |
Management system | ISO 17298:2025 — requirements and guidelines, containing general management system requirements. | Accreditation schemes for certification against ISO 17298 remain in development, as would be expected for a standard published in 2025. |
Claim verification | Validation and verification under ISO/IEC 17029, applied to a defined nature claim. | No biodiversity-specific verification standard sitting beneath ISO/IEC 17029, as ISO 14064-3 does for greenhouse gases. Methodology is a matter for the scheme. |
Assurance | ISSA 5000, from 15 December 2026, over the disclosure including biodiversity content. | No assurance standard specific to nature. The practitioner relies on the work of experts, whose own work is not, in the general case, subject to an accredited scheme. |
The third and fourth rows describe the residual problem. An ISSA 5000 practitioner assuring a biodiversity disclosure relies on ecological expertise. That expertise is supplied by consultants operating under no accreditation regime, using proprietary or academic methods, frequently engaged by the party whose disclosure they are supporting.
The chain of credibility for a nature disclosure now has a system standard at the bottom and an assurance standard at the top, and an unaccredited link in the middle, closest to the ecological fact.
That link is where an organisation should expect scrutiny to concentrate, and it is the reason that verification of specific nature claims — rather than reliance on the sustainability statement's assurance conclusion — remains necessary.
5. What GRI 101 asks, and where the system answers
GRI 101 contains eight disclosures. It is worth reading them as a specification for the system that would be required to produce them honestly, which is how ISO 17298 reads them.
Disclosure | What it requires | What the system must have been doing |
|---|---|---|
101-1 | Policies to halt and reverse biodiversity loss, informed by the Global Biodiversity Framework | Leadership commitment, documented, with defined ownership |
101-2 | Management of impacts, reported against the mitigation hierarchy: avoid, minimise, restore, offset | A decision process that actually sequenced the hierarchy, with evidence of what was avoided before anything was offset |
101-3 | Access and benefit-sharing where genetic resources are used | A determination, made and recorded, of whether the Nagoya Protocol applies |
101-4 | How the organisation determined which sites and which supply chain products have the most significant impacts, beyond the first tier | A documented determination method, resourced, applied, and reviewed. This is the completeness assertion. |
101-5 | Locations with impacts: country, jurisdiction, site place and size | A maintained site inventory, reconciled to the asset register |
101-6 | Direct drivers of biodiversity loss attributable to the organisation | Attribution evidence, gathered at the site, in the relevant period |
101-7 | Changes to the state of biodiversity | A baseline, established before the change, and a comparable subsequent measurement |
101-8 | Ecosystem services and the people who depend on them | Stakeholder engagement, conducted and recorded |
THE DISCLOSURE THAT CANNOT BE RESCUED
101-7 requires a before and an after. An organisation that begins measuring in 2026 has an after. A baseline not established now cannot be created retrospectively, and every future claim of restoration or improvement depends on it. This is the clearest illustration in sustainability reporting of why the system must precede the disclosure.
6. What to do in the first year
Read ISO 17298 as a system standard, not a framework. Compare its requirements against what exists: who is accountable for biodiversity, what resources are allocated, whether the biodiversity assessment is audited, and whether anything changes when it finds something.
Establish and document the baseline before the narrative. Dated, with a stated method. This is the single intervention with the shortest window and the longest consequence.
Document the determination method for GRI 101-4 and have it independently examined. It governs completeness, it must extend beyond the first tier, and it is the assertion most likely to be tested.
Reconcile the biodiversity site list to the GHG site list and the asset register. Where a site is material for nature and absent from the emissions inventory, or vice versa, either the boundaries differ for a stated reason or one disclosure is incomplete.
Qualify what cannot be evidenced. The tiers not reached, the seasons not surveyed, the offsets whose additionality cannot be demonstrated. GRI permits reasons for omission. A stated omission is a defence; an unqualified assertion is not.
Verify the claims that carry external reliance. Not the whole disclosure. No net loss at a named site, restoration of a named ecosystem, deforestation-free sourcing of a named commodity — the claims a lender, a customer or a regulator will act upon.
The safest biodiversity disclosure in 2026 is the one that states clearly what the organisation does not know. Almost nobody is writing it, because it does not read like leadership. It reads like evidence.
7. Where Speeki BioLens™ fits
Speeki BioLens™ is nature and biodiversity verification, performed under ISO/IEC 17029 by Speeki as an accredited body, against claims prepared with reference to GRI 101: Biodiversity 2024, ESRS E4, the TNFD recommendations and SBTN methods.
It occupies the third layer of the four in Figure 1: the independent examination of specific nature claims, sitting above the management system and below the assurance of the report. It does not certify the management system — that is a certification engagement against ISO 17298, and the accreditation schemes supporting it are still maturing. It does not assure the sustainability report, because Speeki Guardian® does that under ISSA 5000.
Speeki is an accredited certification and assurance body and does not provide consulting services; details of its accreditations and their scope are published at speeki.com. The relevance to nature is acute, and it is the unaccredited link identified in section 4. Much of the ecological assessment market consists of firms that conduct the survey, write the disclosure, and offer to review it. That arrangement produces a document. It does not produce evidence.
Questions this paper answers
What is ISO 17298?
ISO 17298:2025, Biodiversity — Considering biodiversity in the strategy and operations of organizations — Requirements and guidelines, is the first International Standard dedicated to biodiversity. It was developed by ISO/TC 331, the ISO technical committee on biodiversity chaired by AFNOR, and draws on the French standard NF X32-001. It applies to organisations of any size, sector or geography, covering activities, sites, land holdings, value chains, life cycle and sphere of influence.
Is ISO 17298 a reporting standard?
No. It is a requirements standard specifying what an organisation must have in place to integrate biodiversity into strategy, operations and decision-making, rather than what it must disclose. It contains general management system requirements — leadership involvement, roles and responsibilities, resource allocation, consideration of stakeholder expectations, audits, and continual improvement — and is designed to complement ISO 14001 and ISO 26000. Reporting is governed separately by GRI 101, ESRS E4 and the TNFD recommendations.
How does ISO 17298 differ from the TNFD's LEAP approach?
LEAP is an assessment methodology: it tells an organisation how to locate its interface with nature, evaluate dependencies and impacts, assess risks and opportunities, and prepare to respond. ISO 17298 builds on that work but requires something different — that an organisation exists which is accountable for performing the assessment, resourced to do so, audited on whether it did, and obliged to improve when it did not. The difference between an assessment somebody performed once and a control is the difference between a framework and a management system.
Why does a management system matter more for biodiversity than for carbon?
Because nature evidence expires and carbon evidence does not. An invoice, a meter reading and an emission factor remain available after the reporting period, so a greenhouse gas inventory can be reconstructed retrospectively. A species survey not conducted in the correct season cannot be conducted retrospectively — the window has closed. For nature, the credibility of the disclosure is determined entirely by whether a system was operating while the evidence still existed.
Can an organisation be certified against ISO 17298?
ISO 17298 is titled Requirements and guidelines, and contains general management system requirements, so conformity with it can be assessed. Certification bodies have begun offering services against it. Because the standard was published in 2025, the accreditation schemes supporting certification against it remain in development, as is normal for a new standard. Organisations should confirm the accreditation status of any certification offered to them.
What is still missing from the nature assurance architecture?
Two things. There is no biodiversity-specific verification standard sitting beneath ISO/IEC 17029, as ISO 14064-3 does for greenhouse gases, so verification methodology is a matter for the individual scheme. And there is no assurance standard specific to nature: an ISSA 5000 practitioner assuring a biodiversity disclosure relies on the work of ecological experts, who in the general case are subject to no accreditation regime. That is an unaccredited link in the chain of credibility, located closest to the ecological fact.
What is the first thing a company reporting under GRI 101 should do?
Establish and document a baseline. Disclosure 101-7 requires reporting of changes to the state of biodiversity, which requires a before and an after. An organisation that begins measuring in 2026 has only an after. A baseline not established now cannot be created retrospectively, and every future claim of restoration or improvement depends on it. It is the clearest illustration in sustainability reporting of why the system must precede the disclosure.
In what order should nature engagements be sequenced?
The management system first, operating through the reporting period with defined accountability and an internal audit programme, conforming to ISO 17298. Verification of the specific nature claims on which external parties rely second, under ISO/IEC 17029. Assurance of the report last, under ISSA 5000, resting on a system whose operation during the period a third party has examined. Attempted in reverse, the first finding will be that the evidence for the reporting period no longer exists.
References and sources
ISO 17298:2025, Biodiversity — Considering biodiversity in the strategy and operations of organizations — Requirements and guidelines. Developed by ISO/TC 331 (Biodiversity), chaired by AFNOR; technical foundation drawn from the French standard NF X32-001. The first International Standard dedicated to biodiversity.
Taskforce on Nature-related Financial Disclosures, statement on ISO 17298 — recognising that the standard supports the identification and management of nature-related dependencies, impacts, risks and opportunities, and builds on the TNFD's LEAP approach.
GRI 101: Biodiversity 2024, issued by the Global Sustainability Standards Board, published January 2024; effective for reports or other materials published on or after 1 January 2026. Replaces GRI 304: Biodiversity 2016.
GRI, GRI 101: Biodiversity 2024 Frequently Asked Questions, updated October 2024 — confirming the effective date and alignment with ESRS E4 and the TNFD disclosure recommendations.
Kunming-Montreal Global Biodiversity Framework, adopted at COP 15, December 2022, including Target 15 on business assessment and disclosure of biodiversity-related risks and impacts.
European Sustainability Reporting Standard E4, Biodiversity and ecosystems, developed by EFRAG.
Taskforce on Nature-related Financial Disclosures, Recommendations of the TNFD, September 2023.
Nagoya Protocol on Access to Genetic Resources and the Fair and Equitable Sharing of Benefits Arising from their Utilization, 2010.
ISO 14001:2015, Environmental management systems; ISO 26000:2010, Guidance on social responsibility.
ISO/IEC 17029:2019, Conformity assessment — General principles and requirements for validation and verification bodies.
IAASB, ISSA 5000, General Requirements for Sustainability Assurance Engagements; effective for periods beginning on or after 15 December 2026.
Speeki, The System Beneath the Opinion (Whitepaper Series 3, Paper 12), July 2026.
About Speeki
Speeki is an accredited ESG assurance and certification body operating in more than 100 countries. Speeki provides management system certification, verification and validation, and sustainability assurance. Speeki does not provide consulting services. Its independence is structural.
For current details of Speeki's accreditations and their scope, please refer to speeki.com.
© 2026 Speeki. This paper is provided for general information and does not constitute legal, accounting or assurance advice.