Insights

ESRS S4 Consumers and End-Users: A Practitioner's Guide for CSRD Reporters

Last updated · August 12, 2026

The social pillar of CSRD has four topical standards. We've already published practitioner guides to ESRS S1 (own workforce), ESRS S2 (workers in the value chain), and ESRS S3 (affected communities). This guide closes the series with ESRS S4 - the standard that turns the lens outward, onto the people who actually buy, use, or are otherwise affected by your products and services.

S4 is the standard most teams have deprioritised. That's understandable: it's the last in the series, it covers territory that feels like it belongs to product, legal, or marketing rather than sustainability, and the Quick Fix deferral has given many Wave 1 reporters a reason to park it. That reasoning is partly right and mostly dangerous. Here's why.

What ESRS S4 Actually Covers

ESRS S4 "Consumers and End-users" is one of the four social standards within the ESRS framework, complementing S1 (own workforce), S2 (workers in the value chain), and S3 (affected communities). Its focus is the actual and potential, positive as well as negative, impacts of a company's products and services on the people who ultimately consume or use them.

The standard addresses three critical areas: information-related impacts, personal safety, and social inclusion. Each area breaks down into specific sub-sub-topics:

ESRS S4 Sub-topics at a Glance

Area	Sub-sub-topics	Practical Examples
Information-related impacts	Privacy, freedom of expression, access to quality information	Data protection practices, cookie consent, clear product labelling, protection from misleading advertising
Personal safety	Health and safety, protection of children, security of a person	Product recall processes, age-gating, cybersecurity for user accounts, chemical safety in consumer goods
Social inclusion	Non-discrimination, access to products and services, responsible marketing practices	Accessibility features, fair pricing, complaint channels, avoiding predatory targeting of vulnerable groups

The standard also requires an explanation of how these impacts - and the company's dependencies on consumers - can create material risks or opportunities for the business itself. That's the financial materiality dimension, and it matters for sectors where consumer trust is a core commercial asset.

One clarification worth noting: illegal or abusive use of products and services by consumers is explicitly excluded from S4's scope. The standard is about what the company does to consumers, not what consumers do with the company's products.

Who is most likely to find S4 material?

Wave 1 CSRD reports covering FY2024 showed a clear sectoral split. B2B industrials, energy, and raw materials companies overwhelmingly concluded S4 was not applicable, while consumer goods, technology, pharmaceutical, and financial services companies were more likely to report on it. When S4 was assessed as material, the most common sub-topics were product safety, data privacy and cybersecurity, and accessibility.

If your company sells directly to individuals - or if your B2B product ends up in the hands of consumers downstream - S4 deserves serious attention in your materiality assessment.

The Double Materiality Gate

Like every topical ESRS standard, S4 is governed by the principle of double materiality. A topic is material if it is significant on either the impact dimension (how the company affects consumers) or the financial dimension (how consumer-related issues affect the company's financial position) - or both.

For S4 specifically, the double materiality assessment focuses on each of the three sub-topics in turn:

Information-related impacts: How you handle customer data affects both your customers (privacy, autonomy, safety) and your business (regulatory fines, reputational risk, GDPR exposure).
Personal safety: Risks that could harm people using your products, and the financial consequences - product liability, recalls, regulatory action - if those risks materialise.
Social inclusion: Whether everyone can access and use your products fairly, and how exclusionary practices affect both affected groups and the company's market reach and licence to operate.

If the materiality assessment concludes that none of these sub-topics is material, a brief justification of that conclusion is sufficient - no further S4 disclosure is required. If one or more sub-topics are material, the full disclosure requirements kick in: policies, actions, targets, engagement with consumers, and grievance channels.

Sub-topic materiality matters. If only one of S4's three sub-topics is material, you report on that sub-topic only — not the full standard. The 2025 amended ESRS draft reaffirms this: if only a sub-topic is material, reporting is limited to that sub-topic. Document your reasoning for each sub-topic separately in your IRO register.

The 2026 Deferral: What It Means - and What It Doesn't

This is where many teams are making a costly mistake.

The European Commission's Quick Fix delegated regulation, published in the EU Official Journal on 10 November 2025, extended phase-in reliefs for Wave 1 reporters: all Wave 1 companies - not just those with fewer than 750 employees - may now defer full ESRS S4 disclosures for financial years 2025 and 2026, even if S4 has been assessed as material.

S4 sits alongside ESRS E4 (biodiversity), S2 (value chain workers), and S3 (affected communities) as the four standards for which this extended deferral is available.

But deferral is not exemption. Here is what the regulation actually requires even during the deferral window:

Companies must still assess S4 for materiality and, if material, provide summarised information under ESRS 2 General Disclosures paragraph 17 - including the outcome of the materiality assessment and summarised information about policies, actions, targets, and relevant metrics.

The distinction matters enormously in practice:

What you can defer	What you cannot defer
Full S4-1 through S4-4 disclosure requirements	The double materiality assessment itself
Detailed policies, actions, and targets disclosure	Disclosure of the materiality assessment outcome
Granular metrics and KPIs	Summarised policy/action/target information (if S4 is material)
Engagement process documentation	ESRS 2 SBM-3 narrative on consumer-related IROs

Teams that have interpreted the deferral as "we don't need to think about S4 until 2027" are building a problem. When full disclosure is required - for Wave 2 companies from FY2027, and for Wave 1 companies from FY2027 onward - the materiality assessment, IRO documentation, and policy frameworks need to already exist. You cannot run a credible, auditor-ready DMA in the weeks before filing.

Assurance providers will scrutinise your DMA. All CSRD sustainability statements are subject to limited assurance from year one. Auditors will check that your materiality assessment covers all ESRS topics — including S4 — and that the rationale for any topic assessed as non-material is documented. A gap in your S4 assessment is an assurance finding, not a technicality.

Practical Steps: Running the S4 Materiality Assessment Now

The deferral gives you time to get this right - not permission to skip it. Here is how to use that time well.

Map your consumer touchpoints

Identify every product or service your company provides that reaches an individual consumer or end-user, directly or through intermediaries. Include digital products, physical goods, financial products, and services. Note where vulnerable groups (children, elderly, people with disabilities) are likely to be among your users.

Run the IRO analysis for each S4 sub-topic

For each of the three sub-topics — information-related impacts, personal safety, social inclusion — identify your actual and potential impacts (positive and negative), the financial risks they create, and any opportunities. Use your product, legal, and data protection teams as subject-matter experts. Document the IROs in your central register, not in a separate S4 silo.

Score and threshold each IRO

For impact materiality, assess magnitude (scale and scope), severity (how hard to remediate), and likelihood separately before combining into a composite score. For financial materiality, evaluate likelihood of occurrence and potential financial magnitude. Apply your organisation's agreed materiality thresholds consistently — the same thresholds you use for E1, S1, and G1.

Engage relevant stakeholders

ESRS 1 requires the DMA to reflect stakeholder input. For S4, relevant stakeholders include consumer representatives, customer-facing teams, product safety officers, data protection officers, and — where feasible — actual consumers or their legitimate representatives such as consumer protection bodies. Document the engagement and how it influenced your conclusions.

Document the outcome and prepare the ESRS 2 summary

Record the materiality conclusion for each S4 sub-topic with explicit rationale. If any sub-topic is material, draft the summarised disclosure required under ESRS 2 paragraph 17 — covering the materiality outcome and high-level information on policies, actions, and targets. This is what you must publish even during the deferral period.

Build the full disclosure framework in parallel

Don't wait until FY2027 to design your S4 policies and grievance channels. Use the deferral period to put the governance structures in place — a consumer impact policy, a product safety review process, accessible complaint mechanisms — so that when full disclosure is required, you are reporting on what you actually do, not scrambling to create it.

Which Teams Own S4?

This is where S4 is genuinely different from S1, S2, and S3. The sustainability team cannot run the S4 assessment alone. The subject matter sits across:

Product and engineering - product safety, design for accessibility, age-gating
Legal and compliance - data protection (GDPR alignment), consumer protection law, advertising standards
Marketing - responsible marketing practices, avoidance of misleading claims
Customer service - grievance channels, complaint resolution, consumer engagement
Data protection / CISO - privacy, cybersecurity, data breach risk

The sustainability lead's role is to coordinate the IRO identification across these functions, apply the double materiality lens, and ensure the output feeds into the central ESRS 2 disclosure. Cross-functional ownership is not optional - it is what makes the assessment credible to an assurance provider.

Use This Time Wisely: An S4 Readiness Self-Check

Use the widget below to assess where your organisation stands on S4 readiness right now.

The Simplified ESRS and What It Changes for S4

The regulatory picture is still moving. EFRAG submitted its technical advice on simplified ESRS to the European Commission on 3 December 2025, cutting mandatory data points across all standards by approximately 61%. ESRS S4 saw one of the largest reductions at approximately 64%, with simplified reporting on safety, inclusion, and information-related impacts, and streamlined requirements for grievance channels and incident reporting.

The Commission published a draft revised delegated act for consultation in May 2026, with adoption targeted for around September 2026 and application from FY2027. The core principle of double materiality is expressly retained - it is the mechanics and data point volume that are being cut, not the obligation to assess and disclose.

The core ESRS S4 standard text in Delegated Regulation 2023/2772 remains in force until the revised act is formally adopted. Wave 1 companies reporting for FY2025 and FY2026 should align with the existing ESRS, applying the Quick Fix phase-in reliefs where available.

The practical implication: the materiality assessment you run now will remain valid under the simplified ESRS. The sub-topics are unchanged. The IRO framework is unchanged. The work you do in 2025 and 2026 is not wasted - it is the foundation for FY2027 disclosure under whichever version of the standard is finally adopted.

Key Takeaways

ESRS S4 covers three sub-topics: information-related impacts (privacy, access to information, freedom of expression), personal safety (health and safety, child protection, personal security), and social inclusion (non-discrimination, access, responsible marketing).
The standard applies only where the double materiality assessment finds one or more sub-topics to be material. If none is material, a documented rationale is sufficient.
Wave 1 companies may defer full S4 disclosures for FY2025 and FY2026 - but they must still complete the materiality assessment and publish a summarised ESRS 2 disclosure if S4 is material.
The deferral is not an exemption from assessment. Treating it as one creates an assurance risk and a scramble before FY2027 filing.
Cross-functional ownership - sustainability, product, legal, data protection - is essential for a credible S4 assessment.

This guide is part of our series on the ESRS social standards. Read the companion guides: ESRS S1 Own Workforce, ESRS S2 Workers in the Value Chain, and ESRS S3 Affected Communities.