Editor’s Note: Stakeholder governance is no longer a marketing posture. With B Lab’s V2 standards now in force across all certification submissions, B Corp Certification has moved from a points-based assessment regime to externally assured audit — bringing third-party assurance, mandatory baselines across seven Impact Topics, and surveillance audits over a five-year cycle. The shift deserves a place on the desk of any cybersecurity, information governance, eDiscovery, data privacy, or regulatory compliance professional advising vendors, counterparties, or portfolio companies. The V2 B Corp profile is a public artifact. Regulators can read it. Plaintiffs can subpoena around it. Bidders can compare it against your competitors.

The eDiscovery sector now has a real-world example: London-based Ethical eDiscovery certified in April 2026 as the first eDiscovery company anywhere in the world to hold the B Corp mark, an industry-first that gives counsel, procurement teams, and peer providers a usable reference profile to read alongside traditional SOC 2 and ISO attestations. Add a hard deadline to that picture: B Lab UK is directing recertifying B Corps impacted by the EU’s Empowering Consumers for the Green Transition Directive (ECGT) to submit self-assessments before July 15, 2026. Watch the V2 recertification window and the first wave of assured profiles — they will tell you whether the certification has finally caught up with its promise.


Content Assessment: Stakeholder governance gets a stricter audit

Information - 93%
Insight - 93%
Relevance - 91%
Objectivity - 93%
Authority - 91%

92%

Excellent

A short percentage-based assessment of the qualitative benefit expressed as a percentage of positive reception of the recent article from ComplexDiscovery OÜ titled, "Stakeholder governance gets a stricter audit."


Industry News – Sustainable Development Beat

Stakeholder governance gets a stricter audit

What B Lab’s V2 standards reset means for cybersecurity, information governance, and eDiscovery decision makers

ComplexDiscovery Staff

B Lab has begun processing certification submissions under Standards V2, turning what skeptics treated as a marketing stamp into an audit regime that procurement teams, in-house counsel, and investors should track. The new B Lab Standards move away from a cumulative points-based assessment historically anchored by an 80-point threshold to mandatory baselines across seven Impact Topics, third-party assurance, and disclosures that touch data privacy, human rights, and climate.

For professionals working in cybersecurity, information governance, and eDiscovery, the changes carry direct implications across vendor selection, regulatory disclosure, litigation hold, and investment screening. The shift from a points-based assessment regime to a third-party-assured certification process echoes the trajectory privacy and information security frameworks took a decade ago, and it produces a public artifact that regulators, plaintiffs, and competing bidders can read.

Inside the V2 reset

B Corp Certification is administered by B Lab Global, a nonprofit founded in 2006 by Andrew Kassoy, Bart Houlahan, and Jay Coen Gilbert. The organization certifies for-profit companies that meet defined standards of social and environmental performance, accountability, and transparency. At the April 8, 2025, launch of V2, B Lab described its community as approximately 9,600 certified companies across just over 100 countries, employing nearly 1 million workers. By the time B Lab announced its new global board on March 19, 2026, the network had grown to over 10,000 certified B Corps employing over 1 million people across 104 countries, the organization said. Data current as of April 29, 2026.

The United Kingdom hosts the largest national B Corp community. B Lab UK reports over 2,700 certified businesses in Britain and a workforce of over 200,000 employees connected to the program, citing March 2026 figures. The Better Business Act, a coalition led in part by B Lab UK Chief Executive Chris Turner, has campaigned to amend Section 172 of the Companies Act 2006 to require directors to consider stakeholder impact alongside shareholder returns. The campaign reports support from over 3,000 UK companies and cross-party parliamentary backing — a legal change that would push B Corp logic into baseline UK company law rather than treating it as a voluntary signal.

The April 8, 2025, standards revision, identified by B Lab as Standards V2.0 and refined through minor V2.1 and V2.2 updates published by February 2026, is the program’s seventh iteration and its broadest rewrite to date. B Lab said it developed V2 across four years of consultation, two public comment rounds, and 26,000 pieces of stakeholder feedback. “After four years, two public consultations, and 26,000 pieces of feedback from businesses, the public, and experts, we are confident that the new standards are clear, ambitious, and truly capable of raising the bar for businesses worldwide,” Judy Rodrigues, Director of Standards at B Lab Global, said in the April 2025 release.

Companies must now meet Foundation Requirements covering eligibility, transparency, and risk profiling, then satisfy a defined floor across seven Impact Topics: Purpose and Stakeholder Governance; Climate Action; Human Rights; Fair Work; Environmental Stewardship and Circularity; Justice, Equity, Diversity, and Inclusion; and Government Affairs and Collective Action. The standards reference frameworks already familiar to compliance teams, including the Global Reporting Initiative, the Science Based Targets initiative, and Fairtrade — interoperability designed to reduce duplicative reporting work.

According to B Lab UK guidance, all B Corp Certification submissions — whether first-time applicants or recertifying B Corps — are now processed on Standards V2. Companies will progress through Year 0 baselines plus milestones at three and five years, with surveillance audits — the periodic follow-up checks that punctuate ISO-style certification cycles — used between recertifications to monitor continued compliance. B Lab UK has frozen its certification fees through 2026 to support the transition.

On March 19, 2026, B Lab announced a new global board chaired by Francine Lemos, a former Sistema B Brasil executive director and former B Lab Global director. The board includes B Lab UK’s Chris Turner, Bates Wells partner Martin Bunch, B Lab co-founder Bart Houlahan, B Lab Africa co-founder Caroline Kamanja, and B Lab France founder Elisabeth Laville, among others. “It’s a privilege to chair our new board as the movement enters a new phase in its 20-year journey,” Lemos said in B Lab’s announcement. The same release confirmed that Clay Brown, who had served as Co-Lead Executive of B Lab Global, would move into a Chief Standards Officer role overseeing Standards, Certification, and Product Delivery. The organization is now headquartered as a non-profit Stichting in Amsterdam.

Why it matters for cybersecurity, information governance, and eDiscovery

For cybersecurity and information governance professionals, the most operationally relevant detail sits inside the Foundation Requirements and the customer stewardship dimension within the Customers section. B Lab’s customer stewardship framework evaluates data privacy and security alongside ethical marketing, product quality, and feedback channels — the structure has been visible in published B Corp profiles for years. Tech companies face elevated transparency expectations around how they collect, retain, and dispose of personal data — a posture that aligns with UK GDPR, the Data Protection Act 2018, the EU AI Act, and the patchwork of U.S. state privacy laws. A B Corp filing therefore becomes a public artifact a regulator, plaintiff, or competing bidder can read, mine, and quote back during examination, discovery, or due diligence. Counsel reviewing draft B Lab disclosures should treat them with the same care they apply to a 10-K risk factor section or a CISO’s annual board memo, and should expect those disclosures to interact with mandatory breach-notification regimes, the U.S. Securities and Exchange Commission’s cybersecurity disclosure rule, and the UK Financial Conduct Authority’s anti-greenwashing requirements.

A separate regulatory hook makes the V2 transition urgent for any B Corp doing business-to-consumer communications inside the European Union. B Lab UK is directing impacted recertifying B Corps to submit their B Impact assessments for audit before July 15, 2026, to allow sufficient time for recertification before the EU’s Empowering Consumers for the Green Transition Directive (ECGT) takes effect on September 27, 2026. B Lab UK has positioned V2 certification as designed to meet ECGT requirements for a valid sustainability label in the EU, including independent third-party verification, and notes that ECGT-related obligations apply regardless of where a B2C-communicating company is located. Information-governance teams supporting marketing and product organizations should treat the July 15 date as a hard internal deadline for evidence gathering, retention, and disclosure-readiness work.

For procurement teams and in-house legal departments at corporations and government agencies, the certification is tightening into a procurement filter. Sedex, a supply-chain transparency platform, has positioned B Corp certification as increasingly relevant to supplier documentation, audit evidence, and procurement-facing sustainability data. The V2 disclosures on Scope 3 emissions and human-rights diligence are likely to give buyers harder data points to score vendors against. Suppliers that cannot produce equivalent disclosures should expect requests for parallel documentation. Practitioners who manage vendor questionnaires should map existing security and privacy attestations — SOC 2 Type II, ISO 27001, ISO 27701, and CSA STAR — against B Lab’s customer-stewardship and human-rights questions to reduce duplicate evidence collection and to identify gaps where a B Corp claim is broader than the underlying control set supports.

Inside the legal market

Law firms have been part of the program from its early years. Bates Wells became the first UK law firm B Corp in August 2015 and, after a 2024 recertification, posted an overall B Impact score of 140.2 — well above the 50.9 median for businesses completing the assessment, according to its public B Lab profile. The firm’s profile shows a modest Customer Stewardship sub-score relative to its overall score — a reminder that even high-overall-scoring firms can have material room to improve on the customer stewardship dimensions most relevant to information-governance audiences. As of late April 2026, the Bates Wells profile lists Standards version 1.6, indicating the firm has not yet recertified on V2. Brabners holds the title of largest UK law firm B Corp by headcount, and Anthony Collins Solicitors and Radiant Law are also certified. Mishcon de Reya certified in August 2021 before withdrawing the following year, citing tension between sustainability commitments and professional obligations. The Mishcon withdrawal is itself an instructive data point: it signals that B Corp certification can collide with professional-conduct duties, particularly where client-confidentiality obligations limit a firm’s ability to publish supply-chain or matter-level data.

The eDiscovery sector now has its own first-mover. London-based Ethical eDiscovery, headquartered in the London Borough of Camden, certified in April 2026 as a B Corp and, in its certification announcement, presented itself as the first eDiscovery company anywhere in the world to hold the B Corp mark — a milestone in a sector that has historically been audited on SOC 2 and ISO controls but rarely on stakeholder governance. “Becoming a B Corp is a natural extension of how Ethical eDiscovery started and how we operate every day,” James MacGregor, the founder and managing director, said in the company’s announcement, framing the certification as a continuation of the firm’s founding intent to keep “disrupting the eDiscovery market” as a B Corp-certified provider. B Lab UK Chief Executive Chris Turner welcomed the certification in the same release: “Business is a powerful force and B Corps demonstrate that positive impact is possible in any sector,” Turner said. The company’s public B Lab profile shows an overall B Impact score of 86.8, well above the 50.9 median for businesses completing the assessment, with dimension scores of Governance 18.7, Workers 33.7, Community 25.3, Environment 7.2, and Customers 1.6. B Lab describes the Customers dimension as evaluating a company’s stewardship of its customers through the quality of its products and services, ethical marketing, data privacy and security, and feedback channels; the Customer Stewardship sub-score within that dimension is also 1.6 on Ethical eDiscovery’s profile. The Customers dimension grades stakeholder-facing customer practices and disclosures rather than operational cybersecurity controls, which sit in separate frameworks like SOC 2 Type II and ISO 27001. For context, Bates Wells’ Customers dimension scores 24.0 even at its 140.2 overall total, with Customer Stewardship as one sub-score of 3.9 — so a low Customers score for a newly certified service firm is not, by itself, a signal about operational data protection. For in-house counsel reading the Ethical eDiscovery profile alongside SOC 2 or ISO attestations, the practical takeaway is that the B Corp Customers dimension and traditional security and privacy attestations measure different things and are best read in parallel. The firm describes its services as covering data collection and interrogations, forensic investigations, eDiscovery, and AI-driven document review, and is a member of the Pro Bono Expert Support Scheme jointly delivered by the National Pro Bono Centre and Pro Bono Connect. Like Bates Wells, Ethical eDiscovery is currently certified on Standards version 1.6, meaning its first V2 recertification will be its first run at third-party-assured audit.

The program is not without its critics. Dr. Bronner’s, an early high-scoring B Corp, dropped its certification in early 2025, citing the program’s certification of multinational subsidiaries, including Nestlé Health Sciences in 2023 and Unilever Australia and Nespresso in 2022, as evidence that B Lab had drifted toward greenwashing. In July 2024, four agencies within the Havas group lost their B Corp status after B Lab cited their work for oil and gas firm Shell as a breach of community values. V2 was developed across roughly four years of consultation that predates these episodes, but the 2026 transition also functions as a response to credibility concerns raised by cases like the Dr. Bronner’s exit and the Havas revocation — a tighter floor, an outside auditor, and a publication-grade audit trail land in market just as that scrutiny peaks. For litigators and information-governance leads, the revocation precedent matters: it establishes that the certification can be pulled, that the rationale will be public, and that the underlying client-engagement records may become discoverable in a downstream dispute.

Investors face a related set of decisions. The Financial Conduct Authority’s Sustainability Disclosure Requirements (SDR) and the EU’s Corporate Sustainability Reporting Directive (CSRD) both push toward verifiable, third-party assured ESG data, and the ECGT adds a green-claims verification layer. A V2 B Corp profile, with its third-party assurance and audited Scope 3 disclosures, may start to look like an input that fits inside an institutional investor’s due diligence file rather than a marketing brochure. Family offices, sovereign-wealth funds, and asset managers screening for sustainability-linked exposure may want to treat B Corp filings as one signal among several, weighted appropriately against ratings from ISS, MSCI, Sustainalytics, and the issuer’s own SDR or CSRD filing. The same data set can carry litigation exposure under U.S. Rule 10b-5, UK financial-promotion rules, and FTC Green Guides enforcement when B Corp language ends up in marketing or investor materials that later prove unsupported.

There are limits worth recording. B Corp Certification confers no special legal status outside U.S. benefit-corporation states; in the United Kingdom and most other jurisdictions, certification operates as a contractual commitment to B Lab and a public disclosure, not a regulatory license. Certification does not exempt a company from prudential, antitrust, or sectoral regulation, and a B Corp logo on a vendor’s website does not relieve a buyer of its own privacy, security, and supply-chain diligence obligations. Practitioners who treat the certification as a substitute for diligence rather than a complement to it will misuse the signal.

What to do now

The practical takeaways follow as professional analysis rather than as claims by B Lab. For corporate counsel and information-governance leads: pull the public B Impact profiles of any vendor that holds the mark, log the standards version (V1.6 or V2) and certification date, and treat the V2 transition window as the moment to refresh vendor questionnaires. For litigation and eDiscovery teams: the new disclosures are likely to become a public source potentially admissible in matters touching ESG misrepresentation, supply-chain liability, or executive compensation tied to sustainability targets, so litigation-hold scoping should account for B Lab submissions, audit reports, and surveillance-audit findings, with the July 15, 2026, ECGT-aligned recertification deadline as a near-term trigger. For investors: the V2 framework moves B Corp data closer to assured ESG reporting, but it does not replace mandatory disclosure regimes — read the SDR or CSRD filing first, then layer the B Corp profile on top.

What changes in your vendor scorecard, your litigation-hold checklist, or your investment screen the day a counterparty’s B Corp certification is published, suspended, or revoked under the V2 standards?

News sources



Assisted by GAI and LLM Technologies

Additional reading

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.

 

Have a Request?

If you have information or offering requests that you would like to ask us about, please let us know, and we will make our response to you a priority.

ComplexDiscovery OÜ is an independent digital publication and research organization based in Tallinn, Estonia. ComplexDiscovery covers cybersecurity, data privacy, regulatory compliance, and eDiscovery, with reporting that connects legal and business technology developments—including high-growth startup trends—to international business, policy, and global security dynamics. Focusing on technology and risk issues shaped by cross-border regulation and geopolitical complexity, ComplexDiscovery delivers editorial coverage, original analysis, and curated briefings for a global audience of legal, compliance, security, and technology professionals. Learn more at ComplexDiscovery.com.

 

Generative Artificial Intelligence and Large Language Model Use

ComplexDiscovery OÜ recognizes the value of GAI and LLM tools in streamlining content creation processes and enhancing the overall quality of its research, writing, and editing efforts. To this end, ComplexDiscovery OÜ regularly employs GAI tools, including ChatGPT, Claude, Gemini, Grammarly, Midjourney, and Perplexity, to assist, augment, and accelerate the development and publication of both new and revised content in posts and pages published (initiated in late 2022).

ComplexDiscovery also provides a ChatGPT-powered AI article assistant for its users. This feature leverages LLM capabilities to generate relevant and valuable insights related to specific page and post content published on ComplexDiscovery.com. By offering this AI-driven service, ComplexDiscovery OÜ aims to create a more interactive and engaging experience for its users, while highlighting the importance of responsible and ethical use of GAI and LLM technologies.