The ESG time trap: How companies fall behind before they ever begin

Sustainability regulations are moving faster than many businesses realize.

Each quarter brings new rules on climate disclosure, supply chain transparency and product responsibility, and these often arrive before companies have the systems in place to respond. The result is a recurring pattern that has played out across industries and continents: Companies wait until mandates are official then scramble to comply, only to discover they needed far more time than they had.

California’s S.B. 253 was one example. Canada’s S-211 and Australia’s AASB S1 and S2 followed the same storyline. Each of these exposed a truth that has been slow to sink in: Building an environmental, social and governance (ESG) reporting program takes time—typically from 12 to 18 months to create systems that can track, verify and consolidate the data regulators now expect. By the time new rules take effect, the window for compliance may already be closing.

The companies that miss the first wave of deadlines are not careless; they’re overwhelmed. ESG regulations reach deeper into operations than most realize, touching procurement, finance and supplier relationships all at once. As the volume of data grows, so does the time required to organize it.

A slow build toward faster expectations

For decades, sustainability reporting was voluntary. Companies could choose what, when and how much to disclose. That flexibility is vanishing as governments introduce stricter standards for both content and cadence.

A recent study helps explain why this shift is happening. Researchers found that almost 40 percent of companies that set 2020 emissions targets either missed them or stopped reporting before the deadline, and most faced no market or stakeholder consequences. The finding exposed an accountability gap in which companies could earn positive attention for announcing targets without any repercussions for falling short.

That era is ending. As governments roll out new disclosure laws, ESG compliance is no longer voluntary or symbolic. It’s becoming a regulated responsibility that demands verifiable data and sustained transparency.

Extended producer responsibility (EPR) is a good example. Once confined to environmental policy debates, EPR now is a mainstream business issue in the United States. States including Oregon, Maine, Colorado and California now require companies to account for the waste generated by their products. A beverage brand, for instance, may need to report how many tons of plastic it sells in each state, how much of that material is recycled and how much comes from virgin sources.

The purpose of these laws is accountability, as companies are asked to consider the full life cycle of what they sell, from raw materials to disposal. But the pace of change has caught many by surprise. New programs seem to appear overnight. One state’s framework inspires another, and within a year a patchwork of new expectations begins to take shape.

Each law brings its own timelines and definitions. Some focus on packaging, others on labor practices or emissions. For companies that operate across multiple markets, this creates a complex puzzle. Compliance teams must interpret overlapping requirements, identify which suppliers are affected and coordinate responses across divisions that may have never worked together.

The illusion of time

When new rules are proposed, the instinct often is to wait. Companies monitor progress, track amendments and only act once the regulations are finalized. It feels like a prudent choice. Why invest in systems that might change?

Yet this waiting game has become one of the biggest sources of ESG risk. Once a regulation is approved, the countdown begins. Most programs allow six months to a year before the first reports are due. That may sound generous, but as mentioned, designing and implementing a functioning reporting system usually requires 12 to 18 months.

The process rarely is straightforward and is demanding. Companies must identify all suppliers connected to their products, collect emissions and materials data, verify their accuracy and compile results in a format suitable for disclosure. Suppliers may be slow to respond or unsure what information to provide, requiring procurement teams to step in and clarify definitions and expectations. Internal data systems must evolve to handle new types of information.

Each step takes time, and none can be skipped. When deadlines arrive, there are no extensions for companies that start late.

Lessons from the early reporters

Organizations that already have faced ESG reporting mandates offer a clear lesson: Start early. Those that began preparing in advance did not necessarily know every detail of the law, but they knew where their gaps were. They identified which units were likely to be affected, assigned responsibility for collecting supplier data and began reaching out to suppliers long before the final rules were signed.

That early preparation paid off. When regulations took effect, they could adjust their existing data templates rather than start from scratch. Their suppliers were familiar with the process. Internal workflows for verification and review were already in motion.

By contrast, companies that waited often found themselves in crisis mode. Procurement asked questions that compliance could not yet answer. Suppliers were overwhelmed by last-minute requests. Deadlines were missed, and public penalties followed. Even after the fines were paid, many were left with fragmented systems that could not be reused for the next cycle.

The pattern is predictable. Each new regulation brings the first wave of compliance failures followed by a surge of accelerated investment once companies realize how much infrastructure they lack. The issue is not a failure of intent; it’s a failure of timing.

Building readiness one step at a time

There is no single formula for ESG preparedness, but successful companies share consistent habits. They treat ESG as an ongoing function rather than a project. They assign clear ownership—often within risk or sustainability teams—to track upcoming regulations and maintain communication across departments. They view compliance as a process of continuous improvement instead of a one-time exercise.

Readiness can start small. Companies can begin by mapping which business units and suppliers are most likely to be affected by future legislation. Once that landscape is clear, they can assess what data already exists and where gaps remain. Many find that valuable information is already available through procurement records or supplier audits. It’s just scattered across systems.

The next step is coordination. Procurement, legal, finance and sustainability teams must align on definitions and data standards. When these conversations happen early, they are manageable. Under pressure from a deadline, they can derail an entire reporting effort.

Finally, preparedness means planning for iteration. ESG reporting will not end with a single regulation or cycle. It will expand as governments refine their frameworks and as companies seek to go beyond compliance toward measurable improvement. Viewing ESG as a permanent business function—not a short-term obligation—helps prevent future disruption and ensures long-term readiness.

Shifting the mindset

Behind every ESG delay is a mindset that treats compliance as an interruption to business. The fastest-moving companies do the opposite by embedding it into daily operations. When sustainability data is collected throughout the year instead of in a frantic rush before a deadline, reporting becomes routine rather than burdensome.

This shift doesn’t require large budgets or immediate perfection. It requires leadership willing to view regulation as part of the market landscape instead of an external burden. Sustainability teams can treat ESG compliance as a standing responsibility in the same way that finance teams plan for audits and HR teams track labor laws.

Over time, this mindset creates an advantage. Companies that are organized, transparent and prepared for scrutiny will earn trust from investors, regulators and customers alike. They can also respond more quickly when new requirements emerge because the systems are already in motion.

Preparing for what comes next

For many companies, the question isn’t if they’ll be regulated, it’s when. Those that start preparing today will meet new expectations without panic. Those that wait risk repeating the mistakes of others.

Compliance is more than a box to check. It’s an indicator of organizational readiness. It shows whether a company understands its impact, can trace its operations and can adapt to the changing expectations of the world.

The time to prepare is not when the law takes effect, it’s when the conversation begins. The organizations that act on the truth will lead rather than follow as the next generation of ESG regulations takes hold.

Katie Martin is the director of sustainability and innovation at Avetta LLC, a supply chain risk management company located in Lehi, Utah. To learn more, visit the Avetta website.