Perspectivas
The recommended focus for businesses in 2025 across the global landscape is adaptation, driven by political transitions, technological advancements, evolving operational risks, anticipated regulatory shifts, and changing economic conditions.
Through our work advising Fortune 100 companies, Global 200 law firms, top insurance companies, financial institutions, and government agencies – and understanding some of the most impactful topics on people’s minds, along with the external factors expected to influence organizations – we have curated insights to help clients navigate risks and capitalize on emerging opportunities in the year ahead.
Haga clic en los siguientes enlaces para ir a un tema destacado:
By providing greater clarity on these themes and their associated risks and opportunities, we will be partnering with clients to anticipate, adapt, and advance in 2025. If you have any questions or would like to further discuss the report, email [email protected].
Sustainability continues to be a hot issue around the world. While many jurisdictions are creating additional frameworks in support of greater consideration of sustainability, others, most notably the US, are either dragging their feet or even backsliding. When examining Environmental, Social & Governance (ESG) regulations from different parts of the globe, new ESG regulations are creating a challenging backdrop for businesses and organizations as conflicting compliance requirements, some of which may be conflicting, come into effect.
Significant uncertainty will affect multinational companies selling into the EU market, driven by the EU's Corporate Sustainability Due Diligence Directive (CS3D). Adopted in 2024, CS3D requires EU and non-EU companies to conduct due diligence to identify and prevent adverse environmental and human rights impacts within their business and supply chain. Conflicts in climate-related reporting and disclosures requirements in different jurisdictions remain among the most significant challenges facing companies today.
Meanwhile, in the US, the term "ESG" itself has become controversial, leading many to now refer more widely to sustainability and discuss ESG as the reporting component of efforts under the broader banner. Several US states have mandated ESG criteria - including climate risk assessment - for investment decisions in state-related retirement funds, while other states have opposed such ESG considerations. Even so, organizations will need to be mindful according to overall sustainability practices since certain permits in many jurisdictions cannot be obtained without addressing environmental impact. With the arrival of the second Trump administration, environmental justice directives established by the Biden administration will be early targets for elimination, as well as grants and tax credits enacted for sustainability.
Businesses can also expect closer judicial scrutiny in the wake of recent Supreme Court opinions, such as the Loper Bright ruling, which undercut agency authority to define regulatory compliance or noncompliance. The ruling will make challenges to sustainability and other environmental compliance regulatory programs more likely.
The Corporate Sustainability Due Diligence Directive (CS3D) Broken Down
CS3D applies to three main groups:
Companies must apply their ESG due diligence policies to the following direct and indirect business partners in their supply chain:
Companies must comply starting with the largest in size in 2027, and continuing over the following two years with additional smaller-sized companies:
Anti-Greenwashing and Greenhushing Rules to Watch For
Click images to expand
The importance of the global supply chain has never been more apparent since the COVID-19 pandemic resulted in worldwide shortages of products and drove prices and inflation skyward.
Supply chain disruptions have become the norm, attributable to an array of modern-day events and conditions including climate change, natural disasters, cyberattacks, fraud, or geopolitical instability, such as conflict in the Middle East or the Russia-Ukraine war. Gone are the days when companies could blame production problems on their suppliers and not take responsibility. Increased globalization from the interconnectedness of companies makes them and their supply chain more vulnerable, ranging from cyber incidents caused by internet proliferation to basic material shortages.
Further, customers are demanding to know where a company's products come from, how they are sourced, how they are manufactured, and if any part of the process has a deleterious effect on people or the environment. Governments have responded by enacting new rules and regulations, or enforcing older ones, to ensure supply chain accountability is a major priority for companies in every industry. This is true especially within the European Union, where individual member-states have enacted protective legislation and rules.
As consumers, governments, and corporations acknowledge the effects of supply chain risks, transparency and due diligence will become more critical to the internal compliance structure of global businesses. The enactment and greater enforcement of laws focused on sustainability issues have increased the obligations on companies to examine the sources and actions of their suppliers and how it all impacts the entire value chain.
Click images to expand
While the cryptocurrency industry is still relatively young, its adoption by various economic sectors and the evolution of the technology itself is growing, along with the tokenization of assets, AI-powered smart contracts, and decentralized finance (DeFi) becoming more accessible to customers. Yet, with all the hype and opportunity surrounding crypto, concerns over security, volatility, and regulatory scrutiny are increasing as well.
Companies in every sector are looking at the use of crypto to gain an advantage. Even the gaming industry has entered the crypto space with bridging services offering "Play-to-Earn" games. Anonymity is a key feature in both the risk and success of cryptocurrency. The concept of "Know Your Customer" on centralized platforms is still required, but anonymity attracts some participants to DeFi platforms who want to transact on a peer-to-peer level without a third party. Anonymity is also prompting criminals to use virtual currencies to conduct illicit activities and conceal their profits. Other concerns still looming for governments include crypto asset company bankruptcies and the 2022 failure of the FTX crypto exchange.
In the US, with the new Trump administration’s pro-crypto position, there will likely be a shift from the previously restrictive policies which the Securities & Exchange Commission had been enforcing. Many are hoping for a regulatory reset as well as more clearly defined regulation that will spur innovation and allow companies to blossom. The EU has moved farther along in regulating crypto, enacting regulations on the transfer of crypto assets in an effort to deter money-laundering. The EU’s Markets in Crypto-Assets (MiCA) law requires any company issuing or trading crypto to obtain a license. Starting in 2026, MiCA will also require crypto asset service providers to collect information about the sender and beneficiary of transfers. The UK requires any company offering cryptocurrency to obtain authorization from the nation’s Financial Conduct Authority. China has banned cryptocurrency trading and mining outright, while both Japan and Canada require crypto companies to register with their governments and abide by anti-money laundering laws. With all that said, risk and legal uncertainties abound since crypto is classified differently depending on the regulatory agency.
Click images to expand
Artificial Intelligence (AI) has been touted as the answer to a multitude of business challenges. However, AI - along with machine learning and large language models (LLMs) - is still fraught with technical and regulatory challenges as the technology evolves. Threat actors use AI to create deepfake videos, text, and audio; craft convincing phishing emails; bypass security measures; and automate malicious activities - prompting national and international security concerns. Companies are developing their own Generative AI (GenAI) models to improve efficiency and boost their bottom line. However, GenAI algorithms demand massive amounts of data to train the system, which means using vast datasets from diverse sources, resulting in privacy and copyright concerns over data collection.
In response, governments are proposing and / or enacting new laws and regulations to prevent or mitigate harm that AI usage may cause. For example, new regulations in Europe are designed to protect fundamental rights, including privacy of consumers' personal information, as well as other justice and ethics issues. While that may put the region at a competitive disadvantage due to increased reporting burdens on companies, it also clarifies obligations and reduces the burden of trying to harmonize varying rules. Despite such issues, companies seeking to build an AI framework need to realize that with more data comes more risk, and proper risk protocols should be in place to help ensure privacy, security, and consideration of the wider Environmental, Social, and Governance (ESG) policies that each organization has put into place.
The EU Artificial Intelligence Act Classifies AI According to Its Risk
Click image to expand
Cyber incidents such as the 2024 event involving Change Healthcare, which compromised the personal information of over 100 million people, highlight the evolving nature of cyber threats - increasingly becoming risk management challenges driven by disruptive new technologies, including AI. Such incidents can halt operations, prompt regulatory investigations, and result in significant financial costs. They often lead to increased insurance claims, litigation from affected parties, and even open the door for further issues like fraud. The Change case also underscores the steady rise in both the number and severity of cyberattacks and data breaches.
In response to these trends, regulators and legislators, such as the US Securities and Exchange Commission (SEC) and European Union, have sought to enact new laws and regulations protecting consumers, patients, and investors. While the threats continue to evolve, and new laws are drafted, organizations are fighting back by enacting stronger controls as part of new minimum cybersecurity thresholds mandated by common protection frameworks, such as the one outlined by the National Institute of Standards and Technology (NIST) in the US.
Another key question around this topic: whether or not to pay a ransom. While companies should be asking their insurer if payment would be covered by their policy, paying a ransom could also inadvertently put a company in legal jeopardy - for example, by violating sanctions policies of the US Office of Foreign Assets Control. All told, the onus is on organizations to act proactively by establishing an information security and incident response program, having proper backup and protocols in place, and maintaining a deep understanding of what their cyber insurance covers for data breaches and other cyberattacks.
A Closer Look at Cyber Regulations
Click image to expand
We would like to thank our experts for their contributions in the 2025 J.S. Held Global Risk Report.
Para obtener más información, comuníquese con: [email protected].
En el informe de riesgo global de J.S. Held, combinamos nuestra experiencia técnica, científica, financiera y estratégica para brindar información sobre los temas con mayor influencia de 2024...
En colaboración con Lockton, hemos desarrollado un manual de estrategias que incluye medidas para minimizar el riesgo cibernético y orientación para mitigar interrupciones cuando se producen incidentes.