That separation is closing fast. And for companies that have not yet connected those two tracks inside their own organizations, the first sign that it has closed may be a vendor review that does not go the way they expected.
The EPA's Enforcement and Compliance History Online database contains permit, inspection, violation, and enforcement action records for roughly 800,000 regulated facilities. It has always been publicly accessible. What has changed is who is using it and how systematically.
In FY2025, ECHO had over 650,000 users engaging in over 1.5 million sessions. The users include procurement teams, third-party sustainability rating platforms, and the ESG screening tools that major buyers are now deploying to evaluate their supply chains.
Platforms like EcoVadis, which scores suppliers for sustainability performance and is used by companies including Nestlé, General Motors, and Maersk, pull from public regulatory data sources including the EPA. EcoVadis uses external databases to screen every supplier assessed, including data from the U.S. Environmental Protection Agency, helping major brands identify and mitigate risks that could negatively impact brand reputation, financial performance, and consumer confidence.
That means a violation that appeared in ECHO in 2022 is potentially visible in a supplier's sustainability score in 2026. The EHS team resolved the underlying condition. The penalty was paid. The agency closed the matter. But the record in the public database, and by extension the third-party scoring platform, reflects that the violation occurred. The score carries it forward.
For some major buyers, EcoVadis ratings represent 30% of their overall vendor rating. Companies report winning business because of their sustainability performance and losing leverage in renewals when scores fall below thresholds their customers have established. General Motors has required tier-one suppliers to reach minimum EcoVadis scores in environmental and governance categories. A score pulled down by enforcement history is not a hypothetical commercial risk. It is a procurement score that influences contract decisions.
The enforcement history question is not limited to sustainability rating platforms. It is also showing up in the Scope 3 reporting obligations that large buyers now face.
California's SB 253 requires companies with more than $1 billion in annual revenue doing business in the state to begin reporting Scope 3 emissions in 2026, with assurance requirements escalating through 2030. The EU's Corporate Sustainability Reporting Directive (CSRD) and Corporate Sustainability Due Diligence Directive create similar obligations for large European companies and their supply chains.
Major buyers are moving toward mandatory supplier carbon disclosure, with Tier 1 suppliers across 70 to 80% of spend expected to disclose Scope 1 and Scope 2 emissions in 2025, with product-level carbon footprint data expected by 2026 to 2028.
When a large buyer is required to disclose and assure its supply chain emissions, it needs confidence in the environmental performance of its suppliers. A supplier with an enforcement history that suggests unreliable environmental controls, inaccurate permit reporting, or repeated violations becomes a data quality risk for the buyer's own disclosure obligations. That risk is not purely reputational. It can affect the buyer's ability to certify the accuracy of its reported data.
Suppliers that cannot provide reliable environmental data may become liabilities, potentially forcing companies to reconsider long-standing relationships. Enforcement history, particularly history that involves inaccurate reporting to regulators, is exactly the kind of signal that procurement teams evaluating supply chain data quality will weigh.
One assumption that EHS teams sometimes make is that a resolved enforcement matter is effectively gone from the practical record once the penalty is paid and the consent agreement closed. Regulators do close the matter. But the data in ECHO does not disappear. It reflects what occurred.
That asymmetry creates a specific problem. A company that received a significant violation in 2021, corrected the underlying condition thoroughly, and has had a clean compliance record since then will show the 2021 violation in ECHO data that feeds into a supplier scoring system in 2026. The correction is real. The improvement is real. But a procurement team running an automated screening sees the history.
The companies that are navigating this most effectively are the ones that have gotten ahead of the record rather than waiting for it to surface in a vendor review. That means being able to explain the enforcement history proactively, documenting the corrective actions taken, and in some cases providing a buyer's procurement team or a rating platform with context that the automated data alone does not include.
Some platforms allow suppliers to submit additional documentation and responses to specific findings. Most suppliers do not use this capability. The companies that do are the ones that control the narrative around their compliance record rather than letting the raw violation data speak for itself in a scoring algorithm.
What has changed in the last two years is not the existence of public enforcement records. ECHO has been searchable for decades. What has changed is the infrastructure that sits on top of it.
When a single ESG scoring platform is used by hundreds of major buying organizations to evaluate tens of thousands of suppliers, and when that platform pulls from public regulatory databases and weights the findings in an overall vendor score, a compliance event from several years ago has commercial consequences in real time.
Procurement teams are increasingly expected to demonstrate how their supplier choices contribute to a company's ESG performance. Organizations that overlook ESG in procurement face reputational damage, regulatory penalties, and operational disruptions from environmental non-compliance within their supply base. From the buyer's side, that pressure is driving the systematic review that suppliers are now experiencing.
For EHS and compliance professionals, the practical implication is that the work of managing environmental compliance history has extended past the regulatory relationship and into the commercial one.
The question that used to belong exclusively to the agency relationship now also belongs to the sales conversation: what does our enforcement record look like to a procurement team that has never spoken with our EHS department, is running a scoring platform on our facility, and is making a vendor qualification decision based on what they see?
