Europe has just rewritten its rules on how companies report about nature. This article explains what the biodiversity part of those rules, ESRS E4, now asks, how to read it, and how a company can answer it with data it already has.
Context
Since 2024, large European companies have had to publish a sustainability report alongside their financial statements. This is the CSRD, the EU directive on corporate sustainability reporting. The rules on what goes into that report are the ESRS (European Sustainability Reporting Standards). They are organised by topic, and ESRS E4 covers biodiversity and ecosystems: what a company does to nature, and what it needs from nature.
The first companies required to report were the largest, the so-called "Wave 1": listed companies with more than 500 employees, which published their first report in 2025 on the 2024 financial year. For biodiversity, the EU allowed them to postpone the whole E4 section until 2027, and most of them did. The leaders published anyway: in its 2024 report, Carrefour disclosed a biodiversity footprint and its sites in sensitive areas, and Danone described its use of SBTN, the WWF Biodiversity Risk Filter and the TNFD LEAP approach.
The rules were then revised 2 times. In March 2026, the scope of the CSRD was narrowed to companies with more than 1,000 employees, which took more than 80% of companies out of the obligation. In July 2026, a simplified version of the ESRS was adopted for those that remain.
The revised standards apply to the 2027 financial year, with reports published in 2028; companies may also use them a year early. The postponement on biodiversity is therefore ending at the same time as the rules are being simplified. Companies now have a stable text and about a year to prepare.
We recently went through the revised E4 line by line with a European group that operates around 200 sites, to define what it had to publish and what it could leave out. This article is the result of that work.
What is now required by ESRS E4
E4 only applies if biodiversity is "material" for the company, meaning that the company has a significant effect on nature or depends on it significantly. This is the case for most industrial, agri-food, retail, energy and real-estate companies.
Once that is established, E4 asks for 5 things, called disclosure requirements. They are not equally binding. For 4 of them, the company reports only if it has something in place (a plan, a policy, actions, targets), and otherwise states that it has none. The 5th, the metrics, is required in all cases. E4 also draws on around 40 items from ESRS 2, the cross-cutting standard, on governance, the materiality process and the generic content of policies, actions and targets. Teams often discover this when they start drafting.
| Requirement | Applies | What to disclose |
|---|---|---|
| E4-1 Transition plan | Only if a public plan exists | Key features of the existing plan. No obligation to draw one up. Expected content: targets, key actions, financial planning, governance, evolution of the business model. |
| E4-2 Policies | If adopted, else say so | Per policy: contents, objectives, scope, standards referred to. Must address traceability of raw materials, own sites in or near sensitive areas, and whether land, oceans and deforestation practices are covered. |
| E4-3 Actions and resources | If any, else say so | Key actions taken and planned, with timeframe, scope and expected outcomes. Significant opex and capex in the period and an indicative future range. Offsets, if used: aim, financing, area, type, standards. |
| E4-4 Targets | If set, else say so | Per target: value, unit, absolute or relative, scope, baseline and base year, target year, milestones. Method, assumptions, scenarios, scientific basis. Without a target: how effectiveness is tracked. |
| E4-5 Metrics | Always required | 3 parts: (1) locations in own operations tied to material impacts, risks or opportunities; (2) sensitive areas by name and type, and the activities behind the impacts; (3) metrics on drivers of change, state of species, ecosystem condition and ecosystem services, each with unit, method, sources and baseline. No specific metric is imposed. |
2 things follow from this. 1) A company that has done nothing on biodiversity yet can say so in 4 sentences, but it still has to produce the metrics: where its sites are relative to sensitive natural areas, and what its activities do to nature. 2) The metrics on sites in sensitive areas, and whether the company has policies on land, oceans and deforestation, are the same information that funds and banks must report on their own portfolios under the European rules for the financial sector (the SFDR). This is why investors and banks ask these questions even of companies that are not covered by the CSRD.
Sources: Commission Delegated Regulation of 3 July 2026 amending Regulation (EU) 2023/2772. Metric examples from EFRAG's draft non-mandatory guidance, July 2025.
How this can be interpreted
The standard leaves 5 practical questions open, and the answers change the amount of work considerably. The first 3 concern the sites, the last 2 the metrics.
What counts as a sensitive area
The standard lists 2 families of areas: those protected by law, and those recognised by scientists as important without legal protection. Each family covers several databases, so a site has to be checked against several dozen maps, not just against the list of national parks.
What "near" means
The standard does not give a distance. A site is "near" a sensitive area if its zone of influence reaches it, and that zone depends on the activity: the influence of a quarry extends far beyond that of a warehouse. The company chooses the distances, based on regulation or scientific references, and applies them consistently.
How much detail to give on sites
A full list of every site is not expected. Sites can be grouped by area or by region, as long as nothing important is hidden. The practical approach is to check every site, then report only those that matter.
What to measure
The standard asks for metrics in 4 families but does not impose any specific one, so the company has to choose. A reasonable rule is 1 or 2 metrics per family, matched to the impacts found material, each with its unit, method, sources and starting point. In practice, the 4 families are:
- Drivers of change: the pressures the company puts on nature, such as hectares of land converted or occupied, cubic metres of water withdrawn, tonnes of pollutants and greenhouse gases, or the presence of invasive species.
- State of species: the threat status of the species affected, for instance the number of threatened species around the sites.
- Ecosystem extent and condition: how much natural habitat is affected and how degraded it is, such as a footprint expressed in Mean Species Abundance (MSA) or Potentially Disappeared Fraction of species (PDF), a habitat area or a connectivity index.
- Ecosystem services: what the company draws from nature, such as water, pollination, soil fertility or flood protection.
The first family can usually be built from the company's own data; the other 3 rely on models and public databases, which the standard accepts as long as they are named.
What to do when there is no measured data
The metrics do not have to be measured on the ground. ESRS 1 explicitly allows estimates where direct data is not available, and names sector averages and other proxies for value chain data. Estimates are accepted as long as the company explains its method, its sources and its starting point. A footprint estimated from revenue by activity and country is an acceptable first step, which can be refined later with purchase volumes or site data.
Read this way, the revised E4 comes down to 3 questions a company can actually answer: where are our sites compared to sensitive natural areas, what do our activities do to nature, and what do we depend on.
How Darwin can help
Darwin answers those 3 questions from data the company already has. For the group mentioned above, we needed the address of each site, the type of site (store, warehouse, factory, farm), and revenue by activity with its sector and country. No field survey was needed, and the work took a few days from data collection to delivery.
Site screening
Every site checked against 100+ spatial layers: Natura 2000, UNESCO natural World Heritage, Ramsar sites, national protected areas including marine ones, ZNIEFF, intact forests, mangroves, Indigenous and local community lands, habitats of threatened species (GBIF data). Sites in or near a sensitive area listed by type of area, area named. 1 of 3 materiality levels per site, combining activity and proximity.
Inputs from the company
Site locations and type (store, warehouse, factory, farm)
E4 requirement served
E4-5 locations and areas; E4-2 own-sites item
Impact footprint
Corporate footprint per pressure and biodiversity impact in Mean Species Abundance (MSA) or Potentially Disappeared Fraction of species (PDF), from own operations to value chain, by commodity and origin. Documented method, sources and baseline.
Inputs from the company
Revenue by activity (per business line or site, with sector and country)
E4 requirement served
E4-5 impact metrics; E4-2 traceability focus
Dependency assessment
Dependencies on 27 ecosystem services (ENCORE classification) at corporate level, and the activities behind them.
Inputs from the company
Same inputs (no additional data)
E4 requirement served
E4-5 ecosystem services; risk side of the materiality assessment
Actions and progress
Action catalogue ranked by pressure reduction, estimated cost per action, results measured against a documented baseline.
Inputs from the company
Footprint baseline (from the 2 outputs above)
E4 requirement served
E4-3 and E4-4: opex and capex, targets or effectiveness tracking; material for E4-1
The site screening covers legally protected areas as well as areas recognised for their ecological importance without legal protection, including the habitats of threatened species built from GBIF occurrence data. It lists the sites near those areas with the name and type of each area, which is what the metrics require, and ranks them so the company knows which ones to report individually and which to group.
The footprint gives the drivers of change (pressures) and the ecosystem condition (MSA or PDF); the screening gives the threatened species present around the sites and their IUCN status, as a presence signal; the dependency assessment gives the ecosystem services. The 4 metric families are covered with a method the company can explain and refine over time, and because everything is measured against a documented starting point, actions and targets can be set on a stable reference.
The same outputs also answer investors' questions
Under the SFDR, funds and banks must report the share of their investments in companies whose activities negatively affect biodiversity-sensitive areas (PAI 7, mandatory for every financial market participant), and may report whether those companies have a biodiversity protection policy covering such sites (PAI 14.2) and sustainable land, oceans and deforestation practices (PAI 11, 12 and 15). The site screening answers PAI 7 directly and the E4-2 items answer the others. A company that has done the E4 work can answer its investors from the same results, and a company outside the CSRD can use them to answer without producing a full sustainability report.
What this changes
The revision changes 3 things for companies.
The calendar is now set. Biodiversity reporting has been postponed and rewritten so many times that many companies stopped preparing for it. The text is now stable, it applies to the 2027 financial year, and the first reports will be audited. Companies already in scope have about a year to get organised. Those entering the scope later can still omit E4 during their first 2 financial years, but the direction is set.
The requirement has become concrete. The earlier version of E4 read like a long questionnaire; the revised one comes down to a few factual questions about sites, pressures and dependencies. The work is easier to plan and to explain internally, and the answers are comparable from one company to another.
Fewer companies report, but more will be asked. With the scope narrowed to the largest companies, most mid-sized companies no longer have to publish an E4 section. Their investors, banks and large customers still do, and they will ask their suppliers and portfolio companies for the same 3 pieces of information. For those companies, the question is less whether the CSRD applies to them than whether they can answer when asked.
Most of the answer already sits in the company's own data. A list of sites and a breakdown of revenue are enough to produce a first, credible version of the E4 metrics. Policies, actions and targets can then be built on that basis rather than on paper.
See what your E4 metrics would look like
Send us your site list and your revenue breakdown by activity, and we will run a first screening of your sites and a first footprint. It works the same way for a single company and for a fund's portfolio. To get started, use the Book a demo button below.