There's a question on the 2026 CDP Corporate Questionnaire — Module 7, to be exact — that asks you to describe your "board-level oversight of climate-related issues, including the frequency with which climate-related issues are a scheduled agenda item." If you've filled out a TCFD report, an ISSB S2 disclosure, or a CSRD ESRS 2 GOV-2 datapoint in the last eighteen months, you've answered that question already. Word for word, almost. You're about to answer it again, in a slightly different text box, for a slightly different audience, because that's how CDP works.
This is the part of sustainability disclosure that nobody explains up front. CDP isn't asking you new things. It's asking you the same things you already told somebody else, in its own taxonomy, on its own portal, on its own deadline. And a very large amount of money — roughly $140 trillion in signatory investor AUM, depending on which year you count — is tied to whether you bother.
Let's break down what the thing actually is.
What CDP is, in two sentences
CDP is a UK-based nonprofit that runs the world's largest voluntary environmental disclosure platform, collecting standardized data on climate, water, forests, and plastics from roughly 24,800 companies on behalf of institutional investors and corporate buyers. Since 2024, it operates a single unified Corporate Questionnaire — one form, multiple environmental topics — that replaced the old split between the Climate (C), Water (W), and Forests (F) questionnaires.
The reason it exists is simpler than the reason it persists. It was founded in 2000 as the Carbon Disclosure Project — the "C" stood for carbon — by a small group of investors who wanted a consistent way to ask companies about emissions. Twenty-six years later, it has become the de facto benchmark that everyone from MSCI to your procurement department's ESG rater quietly pulls data from. You're not filling it out to impress CDP. You're filling it out because somebody else is reading the scores.
Who actually has to do this
Technically, CDP is voluntary. Practically, it isn't.
Three forces will put the questionnaire on your desk:
Signatory investors. Roughly 800 institutional investors, representing north of $140 trillion AUM, formally request CDP data from their portfolio companies each cycle. If you're on the request list for BlackRock, Legal & General, Amundi, or any of their peers, declining to respond shows up as a negative signal in their ESG screens. "Not scored" is functionally worse than a C.
Supply chain members. CDP's Supply Chain program has about 330 purchasing organizations — including Walmart, L'Oréal, Microsoft, Nestlé, and a long tail of mid-cap manufacturers — that request disclosures from their Tier 1 and Tier 2 suppliers. If a buyer representing 15% of your revenue sends you the request, you are not "voluntarily" disclosing. You are disclosing.
Self-selected disclosers. A smaller group files because their CFO wants the ESG rating bump, because they're benchmarking against a peer that made the A List, or because a bank covenant references it. That's a real group, but it's not why most respondents are in the room.
There's no formal revenue or sector threshold. In practice, if you're a listed company with a market cap above roughly €500M, or a private company selling into the EU, the US West Coast, or Japan, you will eventually receive a request. The 2026 cycle is expected to carry about 27,000 responders — up from 24,800 — largely because of Supply Chain program expansion.
The 13 modules, in plain English
The unified Corporate Questionnaire is organized into 13 modules. This structure — introduced for the 2024 cycle and refined in 2025 and 2026 — is aligned with IFRS S2 (the ISSB climate standard) and cross-referenced to ESRS, which is the part that should matter to you if you're also filing CSRD. Same concepts, same data points, same definitions in most places.
The modules, in order:
- Introduction — Who you are, reporting year, currencies, subsidiaries in scope.
- Identification, assessment, and management of dependencies, impacts, risks, and opportunities — The IRO matrix, roughly equivalent to ESRS's double materiality exercise.
- Disclosure of risks and opportunities — The actual risks and their financial magnitude, including transition and physical.
- Governance — Board oversight, management responsibilities, climate-linked remuneration. Largely the same text as ISSB S2 governance.
- Business strategy — Scenario analysis, transition plan, financial planning integration.
- Environmental performance — Climate change — Scopes 1, 2, and 3, targets, verification.
- Environmental performance — Forests — Commodity disclosures for timber, palm oil, soy, cattle, rubber, cocoa, coffee.
- Environmental performance — Water security — Withdrawals, discharges, water-stressed basins, targets.
- Environmental performance — Plastics — Production, packaging, circularity (newer module, still evolving).
- Environmental performance — Biodiversity — Nature-related dependencies and impacts, aligned with TNFD.
- Financial services — Sector-specific module for banks, insurers, asset managers (financed emissions, Scope 3 category 15).
- Further information — Voluntary supplementary data.
- Sign-off — Legal attestation.
Not every module is mandatory for every responder. Forests applies if you're in the relevant commodity sectors. Financial Services only opens for financial institutions. Plastics and biodiversity are still partly voluntary in 2026. The climate, water, governance, and strategy modules apply to essentially everyone.
How the scoring actually works
CDP scores you on four letter tiers, each with a minus and plain variant. That gives you eight possible grades: D-, D, C-, C, B-, B, A-, A. Plus F for "not scored" (usually because the response was rejected or the company refused to disclose).
The tiers aren't just presentation. They represent four sequential bars:
Disclosure (D- / D). You answered the questions. Completeness is all that's measured here. Did you provide a number for Scope 1? Did you answer the governance question? Low bar, but a surprising number of first-time filers fail it because they skip questions they don't understand.
Awareness (C- / C). You disclosed and you demonstrated that you understand how climate issues affect your business. You've identified risks and opportunities, named them, and linked them to your operations. Most first-time filers land here if they tried.
Management (B- / B). You disclosed, you're aware, and you're actively managing the issues. You have targets, policies, and governance processes in place. You've quantified financial impacts. This is where most "serious" filers sit after two or three cycles.
Leadership (A- / A). You're doing everything above, plus demonstrating best practice: science-based targets validated by SBTi, third-party verified emissions for Scopes 1–3, disclosed scenario analysis, integrated climate into executive remuneration, and — critically — you're leading your peer group on specific indicators.
The A List — companies scoring A on climate — includes about 15% of responders in a typical cycle. For the 2024 reporting year scored in January 2025, roughly 350 companies made the Climate A List. Another similar number made the Water A List. About 30 made the Forests A List. A small, elite group (Apple, L'Oréal, Unilever, Microsoft in recent years) made all three.
The A List is the thing boards care about. It's also, and this is the part nobody in CDP's press releases says, heavily gamed.
The part nobody tells you
Three things are true about CDP that the methodology guide won't emphasize.
First: enormous portions overlap with what you already reported. If you've done a GHG Protocol inventory, you have Scopes 1 and 2, and probably Scope 3 categories 1, 3, 4, 5, 6, and 7. Module 6 wants exactly that. If you've filed ISSB S2, you have governance, strategy, risk management, and metrics and targets — Modules 4, 5, 2, and 3. If you've filed CSRD ESRS E1, you have the same climate data plus transition plan plus financial effects. Module 2's IRO matrix is conceptually identical to ESRS double materiality, just with CDP labels.
You are retyping. Most first-time filers spend three to four weeks mostly retyping. A meaningful fraction of the reported Scope 3 figures in CDP submissions are slightly different from the same company's CSRD submission, not because the emissions changed, but because the person filling in the form copied from the wrong spreadsheet. CDP's own data team has commented on this.
Second: the A List is heavily gamed through narrative boilerplate. CDP's scoring is partly quantitative (did you report Scope 3? Is it verified? Is the target SBTi-approved?) and partly qualitative (did you describe your transition plan? Did you explain scenario analysis?). The qualitative portions are scored against rubrics that, once you know them, are beatable by writing in a specific structure with specific keywords. A cottage industry of CDP scoring consultants — charging $25,000 to $80,000 — exists almost entirely to ghostwrite narrative answers that hit the rubric bullets.
This is not a secret. CDP knows. They refine the rubric each year to push back on the most obvious templating. But the fundamental dynamic — that a well-written answer beats a well-managed program, year after year — is not going away.
Third: your score matters less than your consistency. A drop from A- to B+ year-over-year gets flagged in investor ESG screens as a deterioration signal. A stable B across three years reads as "credible mid-tier responder." A jump from C to A in a single cycle reads as "they hired a consultant," and increasingly as "they hired a consultant who wrote something the underlying program can't back up" — which is exactly the kind of finding an auditor picks up on during ISSB assurance.
Pick a tier you can sustain. Don't chase the A List unless your program can actually defend it.
The cycle and the deadlines
CDP runs on a steady annual rhythm:
- Mid-April: The questionnaire opens on the ORS (Online Response System). This year's version drops April 15, 2026.
- Early June: Supply Chain deadline for suppliers answering a buyer's request.
- Mid-September: Public disclosure deadline for the investor-request track. 2026 closes on September 16.
- Late November: Scoring period. CDP's scoring partners review submissions.
- December / January: Scores released. The A List press cycle kicks off in mid-January.
As of April 18, 2026, you have exactly five months to the September 16 deadline. If you're filing for the first time, that's tight but doable. If you're filing for the third or fourth time, and your data is already structured, it's a long-weekend exercise done properly.
The one trap in the timeline: CDP runs a "Reporter Services" advisory window in May and June where you can get direct feedback on a draft. Most first-time filers don't know it exists. Use it.
How Formist handles it
Formist is an AI-powered compliance platform built by WeCarbon. It behaves like a knowledgeable colleague sitting next to you — you talk to it, upload your existing documents, and it fills out the forms on your behalf. For CDP specifically, the trick is that most of the work has already been done somewhere else in your filing stack.
You upload whatever you have: your GHG inventory, last year's ISSB S2 disclosure, your draft CSRD ESRS report, your SBTi target letter, your water accounts if applicable. The Formist AI agent reads them, maps each datapoint to the correct CDP module and question, and pre-fills the responses. Module 4 governance pulls from your ISSB S2 governance narrative. Module 6 climate metrics pulls from your GHG inventory with the right Scope 3 categories in the right rows. Module 2 IRO pulls from your CSRD materiality assessment.
What you end up doing is reviewing, not typing. You check the AI's mappings in a structured card view, correct anything that's wrong, add the handful of CDP-specific narrative that doesn't exist in your other filings — usually the qualitative "explain your approach" boxes in Modules 3 and 5 — and export the ORS-compatible output. A filing that used to take a sustainability manager three weeks of cross-referencing becomes a focused day of review.
Formist doesn't promise you an A. Nobody honest can. It promises that the data in your CDP submission matches the data in your ISSB, CSRD, and GHG filings, which is the boring but rapidly important thing that auditors and investors are starting to check.
A closing note on what this is really for
The CDP questionnaire was built for a world where environmental disclosure was voluntary, inconsistent, and hard to aggregate. That world is ending. ISSB S2 is mandatory in roughly 20 jurisdictions already. CSRD, Omnibus adjustments aside, covers tens of thousands of EU and EU-adjacent companies. The SEC's climate rule, stalled as it is, still shapes investor expectations. In five years, most of what CDP asks will be reported into regulated filings instead.
Which is why the overlap matters so much right now. Treat CDP as a cross-check on the data you're already regulated to produce, not as a parallel disclosure universe. Your sustainability team has better things to do than retype the same Scope 3 figure into a twentieth portal.
Formist is built by WeCarbon, a climate tech company with offices in Shanghai, Paris, and Dubai. It supports CDP, CBAM, GHG Protocol, CSRD/ESRS, ISSB, EU Taxonomy, SBTi, and 15+ other sustainability frameworks.