ESG ratings and data: buyer guide (October 2026)

The short answer

Pick by the question the rating has to answer. If you run a portfolio and need a view on every holding, license an analyst-built investor rating such as MSCI or Morningstar Sustainalytics. Expect them to disagree about the same company. If you want the inputs rather than an opinion, buy disclosure-based data from a platform such as LSEG or Bloomberg and set your own weights.

If you are the company being rated, the work is answering questionnaires. S&P Global's Corporate Sustainability Assessment and CDP score what you submit. If customers ask you, or you ask your suppliers, for a sustainability scorecard, buy a supplier rating such as EcoVadis. If the question is what a counterparty has been accused of this week, buy controversy data such as RepRisk.

Why esg ratings and data matter

ESG ratings feed decisions that a company does not control. Investors use them to screen holdings and build portfolios. Procurement teams use supplier ratings to decide which suppliers to keep.

The ratings disagree. MIT Sloan's Aggregate Confusion Project found that ratings from prominent agencies correlated at 0.54 on average, against 0.92 for Moody's and S&P credit ratings. Differences in measurement explained 56% of the gap. The study, published in 2022, covered 6 agencies. A company can score well with one provider and poorly with another.

The rules and the vendor list are changing. The EU ESG Ratings Regulation applies from July 2, 2026, and makes ESMA the supervisor of ESG rating providers operating in the EU. Moody's closed its ESG ratings business in 2024. Clarity AI and Glass Lewis announced their combination in September 2026. CDP announced in June 2026 that it will split into a Permira-backed commercial company and a charity.

Who buys it

Asset managers, pension funds, sovereign wealth funds, banks and insurers license ratings and data for screening, portfolio construction, engagement and regulatory reporting.

Companies buy from the other side. Sustainability, investor relations and finance teams pay to disclose, benchmark and improve their own scores. Procurement teams buy supplier ratings to assess suppliers at scale.

Typical triggers: an investor or customer asks for a score, a rating is cut, a new disclosure rule arrives, or a supplier or portfolio company is caught in a controversy.

Before you buy: what teams do without one

Without a vendor, analysts read sustainability reports and CDP responses and keep the numbers in spreadsheets.

Some access is free. MSCI lets rated companies review their data and send feedback through an online portal at no cost. LSEG publishes top-level ESG scores for individual companies in a free online finder, though commercial use needs a license.

Buying pays when the list gets long: hundreds of holdings, thousands of suppliers, or a regulatory report that needs every data point traced to a source. It also pays when investors or customers already use a provider's score, because you need to see what they see.

What good looks like

Capability	What good looks like	Why it matters
Coverage of your list	The provider runs your holdings, suppliers or peers against its universe and names every gap, including private companies.	A missing rating leaves a blank in screening, supplier onboarding or a regulatory report.
Stated materiality lens	The methodology says whether it scores risk to the company, the company's impact on the world, or both, by industry.	Two providers using different lenses can rate the same company far apart.
Traceability to source	Every score drills down to the data points, weights and documents behind it.	Auditors, regulators and rated companies challenge the inputs, not the letter grade.
Update frequency	Controversy data refreshes daily; ratings follow a published review cycle and recalculate when new disclosures arrive.	An annual score can miss an incident that happened last week.
Issuer feedback process	Rated companies can see their data and submit corrections through a documented channel, year round.	Errors are cheaper to fix before investors or customers act on them.
Delivery into your systems	Data arrives by feed, API or the terminal and portfolio tools you already use, not only a separate portal.	Scores that stay in a portal do not reach screening, procurement or reporting workflows.
EU regulatory status	The provider has notified ESMA and applied for authorization under the EU ESG Ratings Regulation, or explains why it is out of scope.	From July 2, 2026, ESG rating providers operating in the EU fall under ESMA supervision.

How esg ratings and data are built, and who sells each kind

Vendors in this category can take a labeled Spotlight slot on this guide. How Spotlight works

Analyst-built investor ratings

Analysts score each issuer on the ESG issues judged material to its industry and publish a rating or risk score for investors, such as MSCI's AAA to CCC scale.

Fits: Investors who need a comparable opinion on every holding for screening, portfolio construction and engagement.

MSCIInvestors that want industry-relative AAA to CCC ratings on more than 17,000 issuers.
Morningstar SustainalyticsInvestors that want an absolute ESG risk score, in 5 severity levels, on more than 16,000 companies.
ISS STOXXInvestors that want corporate ratings on 8,600 companies alongside screening and stewardship services.

Disclosure-based scores and data

Providers collect reported data points, standardize them and compute scores with published weights, often inside a market data platform, such as Bloomberg or LSEG.

Fits: Teams that want the underlying data and the freedom to build their own scores.

LSEGLSEG data users that want ESG scores and 240+ standardized metrics on more than 16,000 companies.
BloombergTerminal and Data License users that want scores built only from company-disclosed data on 12,000+ companies.
Clarity AIInvestors that want AI-processed data on listed and private companies and funds, delivered by API or feed.

Company questionnaire assessments

Companies answer a detailed questionnaire and are scored on what they submit, such as S&P Global's Corporate Sustainability Assessment or CDP.

Fits: Companies that want to shape the data investors and customers see, and benchmark against peers.

S&P Global Sustainable1Companies that want to be scored on their own submissions; 3,600 took part in the 2025 assessment.
CDPCompanies asked by investors or customers to disclose climate, water and forests data for a public score.

Supplier sustainability ratings

Suppliers submit evidence once and share one scorecard with every customer that asks, such as EcoVadis.

Fits: Procurement teams assessing many suppliers, and suppliers answering many customers.

EcoVadisProcurement teams rating suppliers, and suppliers whose customers ask for a shared scorecard.

Controversy and incident data

Providers screen news and other public sources for reported misconduct and tag each incident to a company or project, such as RepRisk.

Fits: Banks, investors and corporates that need early warning on counterparties, not an annual score.

RepRiskBanks, investors and corporates screening counterparties for reported misconduct, with data updated daily.

How to choose

Who or what is rated

Listed issuers, private companies, funds, suppliers or projects. Coverage of your own list matters more than a headline count.

Opinion or inputs

Analyst-built ratings give a judgment. Disclosure-based data gives the inputs and the weights. Decide whether you want to adopt a view or build one.

Materiality lens

Some providers score financial risk to the company; others also score the company's impact on society and the environment. Read the methodology before comparing scores.

Role of the rated company

Questionnaire and supplier ratings depend on what the company submits. Investor ratings mostly use public data, with an optional feedback channel.

Update speed

Controversy data is daily. Questionnaire scores are annual. Ask how fast a rating moves after an incident or a new report.

Independence and regulatory status

Several providers also run indices or proxy advice, or are owned by exchanges. Ask how conflicts are managed and where the provider stands with ESMA.

How pricing works

MSCI, LSEG and Bloomberg do not list prices on their ESG pages. Each asks buyers to request a demo, request details or contact sales (websites, October 2026).

Check what the license allows. LSEG's terms require a license for any commercial use, redistribution or systematic reproduction of its ESG scores. Bloomberg sells its scores through the Terminal and through Bloomberg Data License.

Rated companies face a different model. CDP charges disclosing companies an annual admin fee in tiers, and raised it by about 5% in 2026. EcoVadis sets supplier subscriptions by company size and plan. MSCI lets rated companies see their own data at no cost.

Budget for increases at renewal. BCG Expand and Substantive Research reported that ESG data spend rose 18% on average in 2024, after increases of more than 50% in earlier years.

Model	How it works	Watch for
Investor data license	The investor licenses scores and data for its own use, delivered by terminal, data feed or API, as with Bloomberg's Terminal and Data License.	Redistribution and commercial use need their own license terms; LSEG's terms say so explicitly.
Free issuer access	Rated companies see their own data and send corrections at no cost, as through MSCI's issuer portal.	The portal covers your own data. Ask what else, if anything, is included.
Discloser fee	The rated company pays to submit and be scored, as with CDP's tiered annual admin fee.	Tiers change the extras. At CDP, the enhanced tier adds a comparative analysis report on peers.
Supplier rating subscription	The buyer pays an annual fee to rate its suppliers. EcoVadis sets enterprise fees by company size and allows unlimited suppliers and users.	Suppliers may also pay for their own subscription, which can slow uptake in your supply base.

Implementation

Name the decisionsList where the data will be used: screening, portfolio construction, regulatory reports, supplier onboarding or investor relations. Each use may need a different approach.
Test coverageSend each shortlisted provider your list of holdings, suppliers or peers. Compare coverage and scores for the same 50 names.
Connect the dataLoad feeds into portfolio, procurement or reporting systems and set alerts for downgrades and new controversies.
Set up the rated-company sideIf you are rated, register on each provider's issuer portal, assign an owner and review your data before each rating cycle.
Review every yearCheck methodology changes, ownership changes and EU regulatory status before renewal.

Confirm before you sign

Coverage report run against our actual list of issuers, suppliers or peers.
Methodology documents for every score we will use, including the materiality lens.
Drill-down from each score to data points and source documents.
Update frequency for ratings, data points and controversy alerts, in writing.
License terms for redistribution, client reporting, index use and internal AI tools.
Delivery format: feed, API, platform or terminal, and the history included.
Process and timeline for rated companies to correct data.
ESMA notification or authorization status under the EU ESG Ratings Regulation.
How the provider manages conflicts with index, proxy or consulting businesses it owns.
Renewal price cap and notice period for methodology changes.

Questions to ask in a demo

Run our list of 200 holdings or suppliers now. How many do you cover, and which are estimated rather than assessed?
Pick one company we know well. Show every data point behind its score and the document each came from.
Does your score measure risk to the company, its impact on the world, or both? Show where the methodology says so.
How quickly does a rating change after a major controversy? Show a recent example with dates.
What does a rated company see, and how does it correct an error? How long do corrections take?
Which of your products count as ESG ratings under the EU ESG Ratings Regulation, and where is your ESMA application?
What does the license allow: client reports, index construction, loading into our own AI tools?
What changed in your ownership, team or methodology in the last 2 years, and what is announced for the next 12 months?

Frequently asked questions

What is an ESG rating?

An ESG rating is a provider's assessment of how a company handles environmental, social and governance issues. Some measure risk to the company: MSCI rates resilience to financially relevant, industry-specific risks on a AAA to CCC scale. Others score what a company discloses, as CDP does for climate, water and forests. Supplier ratings such as EcoVadis score suppliers for their customers. The same word covers different measurements, so read the methodology before comparing.

Why do ESG ratings from different providers disagree?

They measure different things in different ways. MIT Sloan's Aggregate Confusion Project, published in 2022, compared 6 prominent agencies and found their ratings correlated at 0.54 on average, against 0.92 for Moody's and S&P credit ratings. Measurement differences explained 56% of the divergence and scope differences 38%. Treat a single provider's rating as one view, and check which issues it weights.

How much does ESG data cost?

MSCI, LSEG and Bloomberg do not list prices on their ESG pages; buyers request a demo or contact sales. Check the license terms as well as the fee: LSEG requires a license for commercial use or redistribution of its scores. Rated companies pay separately: CDP charges disclosing companies a tiered admin fee, raised about 5% in 2026, and EcoVadis prices supplier subscriptions by company size and plan. BCG Expand and Substantive Research reported that ESG data spend rose 18% on average in 2024.

Does the EU regulate ESG rating providers?

Yes. The EU ESG Ratings Regulation (EU 2024/3005) applies from July 2, 2026, with ESMA as the direct supervisor. Providers that want to keep operating in the EU must notify ESMA, then apply for authorization between August 2 and November 2, 2026. Notified providers can keep operating while their applications are decided. Ask each vendor where its application stands.

What are the alternatives to MSCI ESG Ratings?

Other analyst-built investor ratings come from Morningstar Sustainalytics and ISS STOXX. If you want inputs rather than a rating, LSEG, Bloomberg and Clarity AI sell disclosure-based scores and data. For controversy screening, RepRisk tracks reported misconduct daily. Moody's is no longer an option: it closed its ESG ratings business in 2024 and now offers MSCI data to its clients.

Can a company see or challenge its own ESG rating?

MSCI runs an issuer portal where rated companies can view their metrics and send data feedback year round at no cost. Questionnaire-based assessments such as S&P Global's CSA and CDP score what the company submits, so the company controls the inputs. Assign one owner for each provider and review your data before each rating cycle.

Sources

Written by Stratrix editors from public sources and checked claim by claim by a second AI model against those sources. Vendors named in the editorial sections did not pay to be included. Spotlight listings are paid and labeled. Methodology and corrections

ESG ratings and data: what each type measures and who it fits