Ask most mid-sized firms where ESG pressure is coming from, and the first answer is usually “a regulator, eventually.” For a growing number of their clients, that’s not actually where it’s coming from first. It’s arriving through an email from a much larger customer’s procurement team, or a question on a tender document that wasn’t there last year, or a lender asking for data nobody has been collecting.

The Pattern: Pressure Arrives Through the Supply Chain First

Large enterprises facing their own mandatory disclosure requirements need ESG data from their suppliers to complete it — which means a mid-sized client can be asked for emissions, workforce or governance figures by a customer many times their size, on that customer’s timeline, regardless of what applies to the client’s own jurisdiction directly. The same pattern shows up in tenders, where ESG credentials are increasingly a qualifying line item on contracts that have nothing to do with sustainability on the surface, and in lending conversations, where the questions are starting earlier in the relationship than they used to.

Why This Catches Firms Off Guard

A firm that has been watching for regulatory deadlines can still be caught out, because this pressure doesn’t follow a regulatory calendar — it follows whichever large customer or lender a client happens to be dealing with, on that party’s schedule, not a published compliance date. By the time the request lands, there’s rarely three months’ notice to build a data collection process from nothing.

What Firms Are Actually Being Asked For

  • Emissions or energy-use figures for a specific reporting year, often with short notice
  • Workforce and health-and-safety metrics in a format the requesting party can plug into their own disclosure
  • Basic governance information — board structure, policies, risk oversight — that most clients have never had to formalise before
  • Evidence the figures are more than an estimate, even where full assurance isn’t required yet

Getting Ahead of a Request That Hasn’t Landed Yet

The firms handling this best aren’t waiting for a specific request before building the capability — they’re identifying which clients sell into large enterprise supply chains or rely on institutional lending, and starting the data-collection conversation with those clients before the request arrives, not after. For firms specifically navigating Middle East regulatory requirements on top of this, that’s a related but separate set of obligations worth its own conversation.

Regulatory ESG deadlines are visible and plannable. Supply-chain and lender pressure isn’t — which is exactly why it’s the version most firms are underprepared for.