ESG update: EU mandates 40% women on boards

Rules will also require 33% women in senior roles by 2026

In the latest ESG legislative initiative to come from the EU, the trialogue discussion between the Commission, Parliament and Council have agreed to adopt landmark mandatory quotas to ensure ‘the underrepresented sex’ will have at least 40% of seats on corporate boards.

The requirements will come into force 30 June 2026 and require large companies with over 250 employees operating in the EU to also ensure 33% representation of women in all senior roles, including non-executive directors and C-suite.

This is another key marker of ESG standards that global companies will need to take seriously. As by 2026, to not comply with EU rules will put the company at a severe governance disadvantage and will impact on their ESG score.

National authorities across the 27-member states will be required to enforce the directive, and be empowered to impose fines. National courts will be able to annul boardroom selections if a company breaks the law.

Across the EU, women sit on 30.6% of boardroom seats across the EU, but the variation is staggering. Estonia has only 9% of board seats held by women, while France, which already has a 40% mandatory target, is nearing parity with 45.5% of boardroom seats held by women.

The UK, which rejected mandatory targets when the discussion was first raised in the EU a decade ago, has 39.1% of FTSE100 boardroom seats held by women.

What to do now for female board compliance

Understand your current gender breakdown at all levels of the business
Flag any ‘hot spots’, teams or departments which are over 90% male
Consider internal promotion tracks and management programmes to support women’s growth in the company
Set targets for the board and senior roles, with regular reviews to ensure targets are met by 2026

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”