ESG Due Diligence in M&A: Process, Checklist What Belongs in Your Data Room

Global ESG assets are projected to exceed $40 trillion by 2030, according to Bloomberg Intelligence. ESG is also firmly part of dealmaking: KPMG reports that 82% of dealmakers globally have ESG considerations on their M&A agenda.

That makes ESG due diligence a core process in mergers and acquisitions. 

This guide explains what ESG due diligence covers, how the process works, which documents belong in the data room, and how 2026 regulations affect U.S. buyers.

What is ESG due diligence?

ESG (Environmental, Social, Governance) due diligence reviews a company’s environmental, social, and governance risks before a transaction, investment, listing, or portfolio decision.

Unlike financial due diligence, which tests the numbers behind a deal, ESG due diligence looks at non-financial risks that could affect price, deal terms, integration costs, or long-term value.

The review is usually led by ESG specialists, sustainability consultants, legal counsel, technical advisors, or internal deal teams, depending on the risk profile of the target company.

ESG due diligence also applies beyond M&A, including:

• Private equity investments
• Infrastructure deals
• IPO preparation
• Portfolio monitoring

Three pillars of ESG due diligence

The weight of each ESG workstream depends on the target company’s sector, geography, and business model. In cross-border deals, sanctions exposure should also be checked, especially where the target has high-risk customers, suppliers, distributors, or operating markets. 

Pillar	Assessment areas to cover	Factors to consider
Environmental	How the target manages environmental concerns, resource use, climate exposure, and regulatory compliance	🔹 Company’s sustainability practices 🔹 GHG emissions 🔹 Energy use 🔹 Water use 🔹 Wastewater 🔹 Waste management 🔹 Hazardous materials 🔹 Pollution 🔹 Land contamination 🔹 Environmental permits 🔹 Biodiversity 🔹 Decarbonization plans 🔹 Climate-related risk
Social	How the target treats employees, key stakeholders, customers, suppliers, and communities	🔹 Worker safety and health 🔹 Labor standards 🔹 Ethical practices 🔹 Wages and benefits 🔹 Diversity and inclusion 🔹 Employee engagement 🔹 Human rights 🔹 Forced labor risk 🔹 Supply chain practices 🔹 Community impact 🔹 Customer privacy 🔹 Product quality and safety
Governance	How ESG governance factors are monitored, reported, and escalated	🔹 Board oversight and governance practices 🔹 Executive accountability 🔹 ESG efforts and ownership 🔹 Anti-bribery and anti-corruption policies and procedures 🔹 Business ethics 🔹 Whistleblower systems 🔹 Litigation 🔹 Regulatory non-compliance 🔹 Sanctions screening 🔹 Export-control exposure 🔹 Internal audit practices 🔹 ESG risk assessments 🔹 ESG reporting 🔹 ESG performance 🔹 ESG compliance 🔹 Data quality 🔹 Cybersecurity 🔹 Governance issues

Why ESG due diligence matters in M&A transactions

ESG issues can drain cash, distract management, and create reputational risks for years after a merger or acquisition. 

Bayer’s $63 billion acquisition of Monsanto (2018) is a clear example. Roundup-related risk was already known before Bayer acquired Monsanto, but the scale and persistence of the liability proved far more damaging.

As of May 2026, Bayer-Monsanto had settled nearly 100,000 Roundup lawsuits for about $11 billion, while roughly 61,000 lawsuits remained active. A further $7.25 billion settlement had been proposed to cover most remaining plaintiffs.

Regulatory complexity for U.S. buyers acquiring targets with EU exposure

A U.S. buyer can inherit EU sustainability obligations when acquiring a European target or any target with meaningful EU exposure. In those cases, the Corporate Sustainability Reporting Directive (CSRD) and Corporate Sustainability Due Diligence Directive (CSDDD) may apply. For U.S. M&A teams, this makes regulatory scoping part of an ESG checklist.

The 2026 ESG Omnibus narrowed both ESG regulations. The amendments enter into force after publication in the EU Official Journal, and EU member states must implement them into national law by March 2027.

Revised CSRD as per 2026 ESG Omnibus

Under the revised CSRD compliance rules, reporting may apply in these cases:

• EU companies, if they exceed €450 million in net turnover and have more than 1,000 employees on average
• Non-EU groups, if they generate at least €450 million in EU turnover for two consecutive years and have at least one EU subsidiary or EU branch with net turnover above €200 million in the preceding financial year
• In-scope EU companies report from financial years starting on or after January 1, 2027
• In-scope non-EU parent companies report from financial years starting on or after January 1, 2028 (with the first publication in 2029 on 2028 data)

Revised CSDDD as per 2026 ESG Omnibus

Under the revised CSDDD requirements, due diligence obligations apply from July 26, 2029, in these cases:

• EU companies with more than €1.5 billion in worldwide net turnover and more than 5,000 employees
• EU companies with franchise or licensing agreements in the EU generating royalties above €75 million and worldwide net turnover above €275 million
• Non-EU companies with more than €1.5 billion in EU turnover
• Non-EU companies with franchise or licensing agreements in the EU generating royalties above €75 million in the EU and EU net turnover above €275 million

Private equity firms face ESG pressure beyond acquisition

For private equity firms, ESG due diligence is expected by limited partners (LPs) and co-investors. The Institutional Limited Partners Association (ILPA) notes that limited partners can include ESG questions in pre-investment due diligence, request ESG policies and reporting materials from general partners (GPs), and add ESG to operational due diligence and investment decisions.

For general partners, this creates several practical expectations:

• A documented ESG management policy ready before fundraising
• ESG answers ready for LP due diligence questionnaires
• Investment committee materials that show how material ESG findings affect risk management
• Portfolio monitoring that tracks ESG actions after acquisition
• Reporting materials that show ESG progress during ownership
• Exit evidence that shows ESG risks were managed, not only identified

The step-by-step ESG due diligence process

The ESG due diligence work should move from scoping to evidence, then from evidence to deal decisions.

1. Define the ESG scope. Narrow the due diligence request list to the target’s sector, geography, business model, and regulatory exposure.
2. Set up the ESG workstream. Create a dedicated ESG workstream in the data room and organize requests by environmental, social, and governance topics. 
3. Review evidence and test data quality. ESG advisors should check whether documents are complete, current, and supported by reliable data. Policies should be tested against logs, audits, metrics, and board materials.
4. Run management follow-ups. Clarify gaps, inconsistent data, unresolved incidents, or missing evidence with management and the sell-side team.
5. Convert findings into deal actions. The ESG due diligence report should feed the investment memo, valuation view, deal protections, and post-close action plan.

Additional reading: See the due diligence report example and structure in our dedicated blog.

ESG due diligence checklist: Documents for the data room

Here are the documents to prepare in an ESG data room.

ESG pillar	Documents to prepare
Environmental	🔹 Environmental permits 🔹 Environmental audits 🔹 Phase I or Phase II environmental site assessments 🔹 Remediation reports 🔹 Notices of violation 🔹 Regulatory correspondence 🔹 Spill or incident recordsWaste records 🔹 Hazardous materials inventories 🔹 Wastewater discharge records 🔹 Air emissions records 🔹 Greenhouse gas emissions data 🔹 Energy and water consumption data 🔹 Environmental compliance reports 🔹 Climate risk assessments 🔹 Decarbonization plans 🔹 Environmental insurance policies 🔹 Environmental capex plans
Social	🔹 Labor compliance records 🔹 Employee handbook 🔹 Health and safety policies 🔹 Health and safety logs 🔹 OSHA or equivalent records, where applicable 🔹 Incident and injury reports 🔹 Safety training records 🔹 Union or works council materials 🔹 Collective bargaining agreements 🔹 Wage and hour claims 🔹 Employee grievance records 🔹 DEI metrics 🔹 Turnover and retention data 🔹 Human rights policies 🔹 Modern slavery statements 🔹 Supplier code of conduct 🔹 Supplier audit reports 🔹 Product safety records 🔹 Product recall history 🔹 Community complaints or impact assessments
Governance	🔹 Governance policies 🔹 ESG policies 🔹 ESG audits 🔹 Sustainability reports 🔹 Methodology on key performance indicators 🔹 ESG data collection procedures 🔹 Board ESG oversight materials 🔹 Board committee materials 🔹 Risk committee materials 🔹 Ethics policies 🔹 Anti-bribery and anti-corruption policies 🔹 Anti-bribery training records 🔹 Whistleblower logs 🔹 Investigation records 🔹 Litigation summaries 🔹 Regulatory non-compliance records 🔹 Sanctions screening procedures 🔹 Export-control policies 🔹 Internal audit reports 🔹 Compliance training records 🔹 Cybersecurity policies 🔹 Cybersecurity incident logs 🔹 ESG ratings or questionnaire responses

Additional reading: See how other due diligence processes fit into a full data room checklist. 

What buyers should check in environmental documents

Environmental diligence should connect site-level findings to cost, timing, and operating continuity. The main issue is whether those reports reveal unresolved liabilities or future financial considerations.

Buyers should focus on:

• Historic liabilities. Read remediation reports and Phase I or Phase II site assessments together with capex plans, environmental provisions, and insurance coverage
• Responsibility for remediation. Confirm who pays for unresolved contamination or site restoration work, when it must be completed, and whether it affects operations
• Data quality. Check whether emissions, energy, water, and waste figures are consistent across reporting periods and supported by source data
• Climate exposure. Compare assessments of environmental factors with business continuity plans, especially where flooding, drought, severe weather, water stress, or regulatory change could affect facilities, suppliers, or production schedules. Buyers and advisors should cross-check them against the company’s operations under an operational due diligence checklist.

What buyers should check in social documents

Social diligence should test whether workforce, supplier, product, and community risks could affect operating stability after close. Social ESG red flags typically appear first as patterns in logs, claims, complaints, or unresolved corrective actions.

Buyers should focus on:

• Health and safety patterns. Look for repeated injuries, near misses, overdue corrective actions, weak training records, or recurring incidents by site
• Workforce stability. Review turnover, wage and hour claims, grievances, contractor classification, union matters, and collective bargaining exposure. Incorporating ESG factors into workforce review helps buyers connect labor issues to retention risk, post-close operating stability, and integration planning
• Supplier controls. Check whether supplier audits, remediation records, escalation procedures, and monitoring evidence support the supplier code of conduct
• Product and community risk. Connect product safety records, recalls, complaints, and community concerns to claims history and corrective actions

What buyers should check in governance documents

Governance diligence should show whether ESG risk is actually managed.

Buyers should focus on:

• Board oversight. Check who owns ESG risk, how often it is reviewed, and whether material issues reach the board, risk committee, or audit committee
• Reporting controls. Test ESG KPI methodology against the sustainability report, including data sources, approval steps, and methodology changes
• Compliance effectiveness. Review ethics, whistleblower, anti-bribery, sanctions, and export-control records together with investigation logs and training completion
• Cybersecurity exposure Review cyber policies and incident logs against remediation status, customer obligations, and regulatory exposure. Incorporating ESG considerations helps connect cyber issues to governance and disclosure risk. Use the IT due diligence checklist for a deeper technical review.

ESG due diligence and the regulatory landscape in 2026

For U.S. buyers, ESG obligations may still apply federally, in California, and through a target’s EU exposure.

Federal climate disclosure: Uncertain, but still relevant

U.S. federal climate disclosure is no longer the main near-term driver of ESG diligence. The Securities and Exchange Commission’s 2024 climate disclosure rule was paused during litigation, and in May 2026, the SEC began the formal process to rescind it.

Still, buyers should not ignore climate disclosure controls. Federal disclosure analysis continues to rely on traditional financial materiality. Lenders, investors, customers, state rules, and EU exposure may still require reliable emissions data, climate-risk governance, and supportable methodologies.

California climate disclosure: A practical diligence trigger

California is now the more immediate U.S. climate disclosure issue for many large targets. The California Air Resources Board approved initial regulations for SB 253 and SB 261 on February 26, 2026, setting key definitions, fees, and the first SB 253 reporting deadline.

For deal teams, the main conditions are:

• SB 253: Applies to U.S. entities doing business in California with more than $1 billion in total annual revenue
• SB 253 deadline: First Scope 1 and Scope 2 greenhouse gas emissions reports are due by August 10, 2026
• SB 261: Applies to U.S. entities doing business in California with more than $500 million in total annual revenue, excluding insurance companies
• SB 261 status: Enforcement is temporarily halted by litigation
• Fees: In-scope companies must pay annual fees to the California Air Resources Board for program administration. The fee is assessed per covered entity, and payment is due within 60 days after the fee notice 

A summary of key ESG due diligence frameworks and regulations for U.S. buyers

ESG due diligence requires separating binding rules from reporting standards, disclosure standards, and external ratings.

Here’s the summary of the main ESG entities.

Entity	Type	2026 relevance for U.S. buyers
CSRD	Binding rule	The Corporate Sustainability Reporting Directive (CSRD) is an EU reporting law. After the 2026 ESG Omnibus, its scope is narrower. U.S. buyers still need to check whether a target or group has enough EU turnover, subsidiaries, or branch activity to be covered.
CSDDD	Binding rule	The Corporate Sustainability Due Diligence Directive (CSDDD) is an EU due diligence law. After the Omnibus changes, it applies to much larger companies, including non-EU companies with significant EU turnover.
ESG Omnibus	Binding rule package	The 2026 EU package narrowed and delayed parts of CSRD and CSDDD. Targets previously expected to be in scope may now be out of scope, especially near the revised thresholds.
TCFD	Disclosure framework	The Task Force on Climate-related Financial Disclosures (TCFD) completed its work and disbanded in October 2023. TCFD disclosure recommendations still matter because they are reflected in IFRS S1 and IFRS S2, and many companies still use them as a starting point for climate disclosure.
GRI	Reporting ESG framework	The Global Reporting Initiative (GRI) is useful for impact-oriented reporting and double materiality. It’s especially relevant where employees, communities, human rights, or environmental impacts are central to the deal. It’s not a legal scoping test.
SASB	Disclosure standards	The Sustainability Accounting Standards Board (SASB) standards remain useful for industry-specific, investor-focused diligence. The International Sustainability Standards Board (ISSB) now maintains and enhances SASB Standards, which are still used to identify industry-based sustainability risks and metrics.
MSCI ESG Ratings	External rating	MSCI ESG Ratings can help buyers understand how the market may view a target’s financially relevant ESG risks relative to peers.They should not replace diligence because the ESG score may miss deal-specific liabilities, data gaps, or post-close obligations.

How virtual data rooms support the ESG due diligence workstream

A virtual data room (VDR) gives ESG diligence the control it needs: structured files, permissioned access, organized Q&A, and a clear activity record:

• Auto-indexing keeps ESG folders and files numbered and easy to retrieve and reference
• OCR and AI-powered search help reviewers find terms across large document sets
• Granular permissions limit ESG advisors to the files they need
• Q&A workflows route ESG questions to the right subject-matter owners
• Audit trails record document access, downloads, permissions, and user activity for record keeping and post-close indemnification disputes
• Redaction tools help remove sensitive personal data from employee or grievance files
• Watermarks, screen capture blocking, and IP/domain restrictions reduce leakage risk
• Translation tools support review of cross-border ESG documents

Review Ideals, Datasite, and other virtual data room providers at dataroom-providers.org to see which platform best fits your due diligence workflow.

Key takeaways

• ESG due diligence covers three pillars: environmental, social, and governance, with scope shaped by the target’s sector, geography, business model, and regulatory exposure.
• The process has five steps: scope the review, set up the ESG workstream, test evidence, run follow-ups, and convert findings into deal actions.
• ESG frameworks and rules serve different purposes. CSRD, CSDDD, California climate laws, and the ESG Omnibus affect regulatory scoping, while GRI, SASB, TCFD-based climate disclosure, and MSCI ESG Ratings help structure review and external context. 
• An ESG virtual data room helps deal teams organize ESG files, manage access and Q&A, record activity, and review workflows.