There is a version of climate risk disclosure that has become familiar: forward-looking scenario language, qualitative discussion of extreme weather exposure, a paragraph about business continuity planning. It satisfies a lot of existing frameworks. It does not come close to what regulators are now requiring around worker heat exposure specifically, and the distance between those two things is where most sustainability and EHS teams are sitting right now.
The convergence is real and it is not slow-moving. Australia updated its Safe Work guidance on heat management at the start of 2026, with new workplace exposure limits arriving in December 2026. The European Union's Corporate Sustainability Reporting Directive (CSRD), even after scope was narrowed through the Omnibus I package, still requires companies with more than 1,000 employees and 450 million euros in net annual turnover to disclose physical climate risks under the European Sustainability Reporting Standards (ESRS) E1 standard — and heat is a physical climate risk. In the United States, the Occupational Safety and Health Administration (OSHA) published its proposed federal Heat Injury and Illness Prevention standard in August 2024, held public hearings through 2025, and is moving toward finalization. California, Oregon, and Washington already have state heat standards in place that go beyond anything at the federal level.
What CSRD Physical Climate Risk Disclosure Actually Requires Around Heat Exposure
ESRS E1 is the standard most sustainability teams are working through right now, and the heat disclosure requirement inside it is more specific than the high-level climate risk language most companies have been producing. The standard requires reporting on physical climate risks at the asset level, across multiple climate scenarios, with double materiality applied: companies must assess both how heat risk affects their business and how their operations affect the conditions that create heat exposure for workers and communities. Qualitative narrative does not satisfy that requirement. Scenario-based modeling at operational locations does.
The CSRD reporting timeline has been delayed for wave two and wave three companies until 2028, but wave one companies — those that were already reporting under the Non-Financial Reporting Directive (NFRD) — are disclosing now, using 2025 data. For companies with significant European operations and more than 1,000 employees, that timeline is not distant. It is the current reporting cycle.
The OSHA Federal Heat Standard and What It Means for U.S. EHS Programs Before Finalization
The OSHA rulemaking on heat is further along than most EHS teams have built into their planning. The notice of proposed rulemaking was published in August 2024. OSHA received more than 43,000 public comments. Virtual hearings ran through June 2025. Post-hearing comment periods closed in October 2025. The agency is in the final stages before a rule is issued. When it arrives, it will require employers across outdoor and indoor settings, in general industry, construction, maritime, and agriculture, to implement written Heat Injury and Illness Prevention Plans (HIIPPs), monitor conditions, and document protective actions taken.
California, Oregon, and Washington have had operational heat standards for years. Companies with multi-state footprints that have already built those state requirements into their EHS programs are better positioned than those that have been waiting for federal direction. Those that have been waiting have less runway than they think.
What Sustainability and EHS Teams Should Have in Place Before the Reporting Deadline Hits
Three things tend to separate teams that make it through mandatory heat disclosure requirements without scrambling from those that do not. First, they have mapped their operational locations against heat hazard data, not just company-wide climate exposure. A facility-level picture of where workers face wet bulb temperature thresholds above which the human body cannot cool itself effectively is different from a corporate climate narrative. Regulators are asking for the former. Second, they have incident data. OSHA's recordkeeping requirements already capture heat-related illness, and that data is being reviewed alongside new disclosures. Third, they have a written plan — not a policy document, but an operational procedure that names thresholds, identifies responsible parties, and documents actions taken when those thresholds are crossed.
The companies that will have the hardest summer are the ones treating heat disclosure as a 2027 problem. The regulatory calendar says otherwise.
