Why your EcoVadis score might not survive a regulatory audit

This article is for informational purposes only and does not constitute legal advice. Consult a qualified legal professional for advice specific to your situation.

A score built for one purpose, tested against another

An EcoVadis score is designed to answer a procurement question: broadly, how does this supplier compare to others on ESG performance. It does that well. Buyers use it to screen large supplier portfolios, tier suppliers by risk, and set thresholds for onboarding. None of that is in dispute.

The question this article addresses is different. If an EU company's EcoVadis-based supplier screening programme is examined by a CSDDD regulator, or tested in a civil claim brought under CSDDD, does the EcoVadis score hold up as evidence that due diligence was actually conducted. The answer, for reasons specific to how the score is produced, is generally no, at least not on its own.

This is a separate question from whether EcoVadis satisfies CSRD reporting requirements, which is addressed in Does an EcoVadis score satisfy CSRD supply chain reporting requirements?. CSRD assurance and CSDDD enforcement apply different standards to different evidence. This article is about the second one.

What regulators and courts actually weigh

CSDDD enforcement authorities and courts assessing civil claims are not reviewing whether a report was fairly prepared. They are assessing whether a company's substantive due diligence conduct met the standard the directive requires. A detailed account of what that assessment looks for is set out in What evidence EU sustainability auditors actually look for, which identifies five characteristics that make evidence credible in this context: independence, contemporaneity, specificity, internal consistency, and proportionality to risk.

Measured against those five characteristics, an EcoVadis score has structural weaknesses that are worth naming individually.

Independence

EcoVadis is a verified self-assessment. The supplier completes the questionnaire and submits supporting documents. EcoVadis analysts review the submission and score it, but the underlying evidence originates entirely from the party being assessed. There is no site visit, no worker interview, and no independent verification that the practices described in the submitted documents are actually followed on the factory floor or in the office.

This is not a secret. EcoVadis does not claim to conduct on-site audits, and its own materials describe the methodology as document-based review. The limitation only becomes a problem when the score is treated, in an enforcement or litigation context, as though it carries the weight of independently verified evidence. A regulator or a court applying the independence standard will weigh a supplier-submitted questionnaire, however carefully reviewed by an analyst, well below evidence generated through a channel the supplier does not control.

Contemporaneity

EcoVadis scores are typically refreshed annually or on a subscription renewal cycle, and the underlying documents supporting a score may be older than the score itself. More significantly, the score itself disappears from the platform when the subscription lapses. This creates an odd evidentiary position: the company's proof of having assessed a supplier's ESG performance is contingent on an ongoing commercial relationship with a third-party platform, not on a record the company retains independently.

For CSDDD purposes, what matters is whether the company can produce a durable, dated record of its due diligence activity at the relevant point in time. A regulator examining a due diligence programme after the fact needs contemporaneous records that exist independently of platform access. A company that relied on EcoVadis scores and did not separately retain the underlying assessment data may find itself unable to reconstruct what it actually knew and when.

Specificity

A regulator or court applying the specificity standard wants to see evidence about particular suppliers, particular facilities, and particular risks, not general statements about approach. An EcoVadis score is a single number, or four sub-scores, summarising performance across broad themes. It tells a buyer that a supplier scored reasonably well on labour and human rights as a category. It does not tell the buyer what specific practices were assessed, what specific risks were identified, or what specific corrective actions, if any, were recommended.

This matters because CSDDD due diligence is meant to identify actual and potential adverse impacts with enough specificity to act on them. A score that says "labour: 62 out of 100" does not, by itself, identify an impact. It indicates a relative position. Translating that into the kind of specific finding CSDDD requires the company to act on takes additional work that the score alone does not provide.

Internal consistency

Internal consistency in this context means whether the evidence holds together: whether worker accounts corroborate document review, whether risk assessment findings are consistent with what is known about the sector and geography, and whether monitoring records show outcomes that are plausible given the actions taken. An EcoVadis score, being generated from a single source (the supplier's own submission) reviewed by a single reviewing party (an EcoVadis analyst), has no independent second source to be consistent or inconsistent with. There is nothing built into the process that would surface a discrepancy between what a supplier claims and what is actually happening at their facility.

This is not a flaw unique to EcoVadis. It is a feature of any self-assessment methodology. But it does mean that when a regulator or court is looking for corroboration across sources, a company that can point only to an EcoVadis score, with no supporting audit, worker engagement, or independent verification, has a thinner evidentiary record than a company that combined the score with other inputs.

Proportionality

The proportionality standard asks whether the depth of evidence matches the level of risk. A company using EcoVadis scores as a screening layer for its entire low-risk supplier base, while applying more rigorous, verified assessment methods to its high-risk suppliers (those in higher-risk sectors or geographies, or those identified through the screening process as warranting closer attention), is applying EcoVadis proportionately. A company relying on EcoVadis scores alone across its full supplier base, including suppliers in high-risk sectors and geographies, is likely to be judged as having applied an evidentiary standard that does not match the risk it should have recognised.

The distinction that matters most

The evidence standards article referenced above draws a distinction between a compliance programme designed to actually identify and address adverse impacts, and one designed to produce documentation of compliance. This distinction is directly relevant to EcoVadis. Requiring suppliers to hold an EcoVadis score, and treating that requirement as the substance of a supplier due diligence programme, can look from the outside like a documentation-generation exercise rather than a genuine identification process, even where the underlying intention was sound.

The way to avoid that characterisation is not to abandon EcoVadis. It is to use the score as one input that triggers further, more specific inquiry where warranted, and to retain independent records of what that inquiry found. A company that can show it used EcoVadis scores to identify suppliers requiring closer attention, and then documents what that closer attention involved and what it found, has a materially stronger record than a company that can only produce the scores themselves.

What this means in practice

For an EU company building a CSDDD due diligence programme, EcoVadis scores are legitimate and useful as a first-pass screening tool across a large supplier base. They should not be the terminal evidence for any supplier where the score, sector, or geography indicates elevated risk. Where risk is elevated, the programme needs an additional layer: independent verification, structured worker engagement, or a facility assessment conducted by a party the supplier does not select and does not pay.

For a non-EU supplier, a strong EcoVadis score is worth having and worth maintaining, but it should not be assumed to close the compliance conversation with an EU buyer operating a CSDDD programme. Buyers who understand the limitations described here will, and should, ask for more where the stakes warrant it. Suppliers who can supply that additional evidence when asked, rather than treating the EcoVadis score as a complete answer, are in a stronger position in the relationship.

Verdandi monitors CSDDD, CSRD, and EUDR continuously, including enforcement and evidentiary guidance as it develops, so due diligence programmes are built on current requirements rather than assumptions carried over from procurement practice. Start for free.