Pre-IPO ESG and sustainability disclosure readiness for HKEX (AI issuer perspective)

Stages (26–39 weeks, estimate)

1. 1. Stage 1 — Choosing the disclosure basis and diagnosing gaps

   3–5 weeks

   Fix the basis before drafting. HKEX Appendix C2 has three operative parts: Part B mandatory disclosure requirements, Part C “comply or explain” provisions, and Part D climate-related disclosures; disclosure prepared in compliance with IFRS S1 and IFRS S2 is considered to comply with Part D, so preparing directly on the ISSB basis is often both simpler and more readable for international investors. The output is a gap diagnosis: which disclosures existing data can support, which metrics have no underlying data at all, and which require new processes. If a US listing is in scope, settle the status of the SEC climate rules here so effort is not spent on a false premise.

   Obligations in this stage

   • Track the actual status of the rule and do not prepare disclosure as if it were in forceSEC climate-related disclosure rules (stalled and proposed for rescission) · 89 FR 21668；89 FR 25804；91 FR 33296 · Severity Medium

   Deliverables

   HKEX ESG report outline (Listing Rules Appendix C2, including Part D climate disclosures)ISSB (IFRS S1 / S2) sustainability-related financial disclosure report outline

   Evidence to retain

   • · Basis-selection memorandum comparing direct Appendix C2 preparation against preparation under IFRS S1/S2, with the conclusion
   • · Applicability determination record (board, LargeCap constituent status, first reporting year)
   • · Metric-by-metric gap diagnosis table (metric × existing data × gap × remediation × owner)
   • · Multi-listing basis comparison, including a written conclusion on the status of the SEC rules

   Common blockers

   • · Treating the ESG report as a post-listing matter: the data chain needs a full financial year to produce comparable figures, and starting at filing is usually too late.
   • · Copying a peer report structure: Appendix C2 Part B is mandatory, and borrowed structures routinely omit required elements.
   • · Preparing against the US SEC climate rules: they never took effect and are the subject of a rescission proposal, so effort spent on them is wasted.

2. 2. Stage 2 — Governance structure and materiality assessment

   4–6 weeks

   Appendix C2 Part B opens with a board statement: the board’s oversight of ESG issues, the board’s ESG management approach, strategy and prioritisation, and how the board reviews progress against targets. For an AI issuer that statement must bring data and algorithm governance inside the ESG governance frame — including the appointment of a personal information protection officer and the periodic compliance audit arrangement — because investor diligence treats “data and algorithm governance” as the core ESG topic for such companies. In parallel, complete the materiality assessment and identify which climate-related risks and opportunities could reasonably be expected to affect cash flows, access to finance or cost of capital.

   Obligations in this stage

   • Appoint a personal information protection officer and run periodic compliance auditsPersonal Information Protection Law · 第五十二条、第五十四条；《个人信息保护合规审计管理办法》第四条、第十一条、第十二条 · Severity High
   • Personal information protection impact assessment (PIPIA), retained for three yearsPersonal Information Protection Law · 第五十五条、第五十六条 · Severity Critical

   Deliverables

   Double materiality assessment workpaper (CSRD / ESRS basis)HKEX ESG report outline (Listing Rules Appendix C2, including Part D climate disclosures)

   Evidence to retain

   • · Board ESG oversight terms of reference and meeting minutes
   • · Materiality assessment workpapers (identification, prioritisation, conclusions and stakeholder engagement records)
   • · Note bringing data and algorithm governance into the ESG topic set, covering the personal information protection officer and the compliance audit arrangement
   • · ESG target-setting and progress-review mechanism documentation

   Common blockers

   • · A board statement ghost-written by ESG advisers with no actual board discussion: minutes that do not match the statement are a frequent finding in assurance and regulatory enquiry.
   • · A materiality assessment that runs surveys without a financial link: Part D asks about reasonably expected effects on cash flows, access to finance or cost of capital.
   • · An AI issuer writing generic manufacturing materiality topics: data governance, algorithmic fairness, content safety and compute energy use are this industry’s real topics.

3. 3. Stage 3 — GHG inventory and the metrics data chain

   6–10 weeks

   The longest and most underestimated stretch of the whole exercise. Scope 1 and scope 2 are the mandatory starting point, and for an AI issuer scope 2 — purchased electricity, particularly for owned or rented compute — is usually where the emissions actually sit, requiring electricity invoices, rack power, PUE and cloud-provider disclosures to be joined into a checkable data chain. Scope 3 is frequently the largest category for companies running on heavy third-party compute, and even where it is not disclosed this period the data-acquisition path should be established now. The output must withstand third-party assurance tracing, so each figure needs its source, calculation method and reviewer recorded in the workpapers.

   Obligations in this stage

   • Retain greenhouse gas and climate data capability for other disclosure demandsSEC climate-related disclosure rules (stalled and proposed for rescission) · Severity Low

   Deliverables

   Greenhouse gas inventory workpaper (GHG Protocol Scope 1 / 2 / 3)

   Evidence to retain

   • · GHG inventory workpapers (scope 1 / 2 / 3, each line annotated with data source and calculation method)
   • · Organisational and operational boundary definitions
   • · Data-acquisition plan for compute-related electricity, covering both owned facilities and cloud providers
   • · Emission factor selection record (source, version, applicable year)
   • · Data quality control records (reviewer, review date, treatment of anomalies)

   Common blockers

   • · Cloud providers unable to supply electricity or emissions data attributable to your company: the most common data break for AI issuers, and one to raise as a contract clause at renewal.
   • · No version record for emission factors: factor sets are updated annually, and missing versions make year-on-year figures incomparable and draw immediate assurance challenge.
   • · Data scattered across finance, administration and IT on inconsistent bases: half the inventory effort comes from here, and the longer it waits the more it costs.

4. 4. Stage 4 — AI-issuer-specific disclosures and the domestic compliance position

   4–6 weeks

   Turn “our AI compliance position in China” into disclosable, diligence-ready material. Sponsors and investors check item by item: the security assessment and filing status for generative AI services, the algorithm filing number and its publication, implementation of labelling for AI-generated content, the data classification/grading and important-data determinations, and whether personal information protection impact assessments have been carried out. These are not only risk-factor content — they are the substance of the “data and algorithm governance” topic in the ESG report.

   Obligations in this stage

   • Security assessment and algorithm filing for services with public-opinion attributes or social-mobilisation capabilityInterim Measures for the Management of Generative AI Services · 第十七条；《互联网信息服务算法推荐管理规定》第二十四条、第二十六条；《人工智能生成合成内容标识办法》第十二条 · Severity Critical
   • File the algorithm within ten working days, publish the filing number and run the security assessmentProvisions on the Administration of Algorithmic Recommendation in Internet Information Services · 第二十四条、第二十五条、第二十六条、第二十七条 · Severity Critical
   • Submit labelling materials at filing and assessment, and conform to the mandatory national standardMeasures for Labelling AI-Generated and Synthetic Content · 第十一条、第十二条 · Severity High
   • Build a classification-and-grading register and identify important dataData Security Law · 第二十一条；《促进和规范数据跨境流动规定》第二条 · Severity High
   • Personal information protection impact assessment (PIPIA), retained for three yearsPersonal Information Protection Law · 第五十五条、第五十六条 · Severity Critical

   Deliverables

   Filing pack for generative AI services and algorithm filing, including the security assessment reportInvestor ESG due diligence pack (for fundraising and pre-IPO)

   Evidence to retain

   • · Filing status list (service/algorithm × filing number × filing date × where published)
   • · Security assessment reports and submission records
   • · Implementation note and sampling results for AI-generated content labelling
   • · Data classification and grading register and important-data determinations
   • · Personal information protection impact assessment reports and their retention records
   • · Record of domestic regulatory interactions (enquiries, remediation, outcomes)

   Common blockers

   • · Filing status inconsistent with what is actually live: shipping a new feature without the new-product security assessment is a recurring hard finding in diligence.
   • · Withholding the filing number as a trade secret: the number is subject to publication requirements, and withholding it invites questions instead.
   • · Compliance material scattered across product lines: listing diligence aggregates by legal entity, and a last-minute consolidation exposes inconsistent bases.

5. 5. Stage 5 — Third-party assurance readiness and the investor diligence pack

   4–7 weeks

   Appendix C2 allows issuers to seek independent assurance voluntarily to strengthen credibility, and requires the level, scope and processes adopted to be described clearly in the report. In practice institutional investors increasingly read the presence of assurance as a signal of data quality. Two jobs here: prepare traceable workpapers on a limited-assurance-first basis, and consolidate the governance, data and domestic-compliance threads into one investor ESG diligence pack.

   Obligations in this stage

   • Appoint a personal information protection officer and run periodic compliance auditsPersonal Information Protection Law · 第五十二条、第五十四条；《个人信息保护合规审计管理办法》第四条、第十一条、第十二条 · Severity High

   Deliverables

   Third-party sustainability assurance readiness checklist (starting from limited assurance)Investor ESG due diligence pack (for fundraising and pre-IPO)

   Evidence to retain

   • · Written agreement on assurance scope and level, including the intended assurance statement wording
   • · Traceable workpaper pack in which every disclosed figure traces back to source evidence
   • · Assurance provider’s preliminary enquiry list and the responses
   • · Investor ESG diligence pack (governance, metrics, compliance position, targets and progress)

   Common blockers

   • · Defining the assurance scope too broadly: a first engagement should focus on the most traceable metrics such as scope 1 and scope 2, and over-broad scope invites a qualified conclusion.
   • · Workpapers containing only summary tables and no source evidence: assurance providers trace on a sampling basis, and figures that cannot be traced are carved out of scope.
   • · Vague wording on the assurance level in the report: Appendix C2 requires the level, scope and processes to be described clearly, and vagueness is itself a disclosure defect.

6. 6. Stage 6 — Publishing the first report and establishing the annual cadence

   3–5 weeks

   Back-plan against the hard constraint that the ESG report publishes at the same time as the annual report: audit and annual-report finalisation dates determine the ESG report’s finalisation date, and assurance work must complete before that. On publication, move immediately into the annual cadence: next year’s data collection starts at the beginning of the new financial year, not at annual-report season. Also stand up a mechanism for tracking changes in basis — both exchange rules and ISSB standards are amended, and multi-listed issuers must additionally track divergence between jurisdictions.

   Obligations in this stage

   • Track the actual status of the rule and do not prepare disclosure as if it were in forceSEC climate-related disclosure rules (stalled and proposed for rescission) · 89 FR 21668；89 FR 25804；91 FR 33296 · Severity Medium

   Deliverables

   HKEX ESG report outline (Listing Rules Appendix C2, including Part D climate disclosures)Sustainability report outline for issuers on the Shanghai, Shenzhen and Beijing exchanges (aligned to the MOF Basic Standard)

   Evidence to retain

   • · Publication schedule (annual report finalisation × ESG finalisation × assurance completion × board approval dates)
   • · The published ESG report and the contemporaneous annual report
   • · Next year’s data collection plan and assignment of responsibilities
   • · Tracker for changes in disclosure basis (exchange rules, ISSB standards, domestic exchange rules)

   Common blockers

   • · Scheduling the ESG report after the annual report: the rules require simultaneous publication, and publishing later is non-compliance.
   • · Disbanding the team after publication: nobody maintains the data chain, year two is rebuilt from scratch at double the cost, and the comparatives are not comparable.
   • · Being simultaneously listed onshore without aligning the two bases: the Shanghai/Shenzhen/Beijing exchange rules and the MOF basic standard have their own requirements, calling for one preparation exercise with two adaptations.