Article 2 · Commission Delegated Regulation (EU) 2026/872

Contents

Article 2Measures and safeguards in relation to the activities referred to in Article 16(1), points (d) and (f), of Regulation (EU) 2024/3005#

1.When involved in the activities listed in Article 16(1), points (d) or (f), of Regulation (EU) 2024/3005, ESG rating providers shall implement the following measures and safeguards:

(a)digital controls providing for role-based access;

(b)information controls that enable watermarking methods and data classification levels;

(c)policies and procedures for managing confidential information;

(d)regular employee training on the importance of information barriers;

(e)contractual obligations requiring employees to comply with internal policies throughout their employment;

(f)compliance monitoring activities to identify conflicts of interest.

2.ESG rating providers as referred to in paragraph 1 shall assess whether the measures and safeguards implemented pursuant to paragraph 1 are adequate for the purposes of Article 16 of Regulation (EU) 2024/3005 at least once every 24 months. Where that assessment is negative, the management body shall oversee the implementation of remedial actions.