Nanotechnology, Corporate Social Responsibility, and Sustainable Business Practice: Towards an Assurance-Based Risk Governance Framework

Abstract

The continuing development and deployment of nanotechnologies offer an extensive and seemingly continually expanding range of business opportunities, but these technologies can also generate potential challenges for a wide range of stakeholders. Although there appears to be a clear consensus on the potential of nanotechnologies, little has been published on how specific companies are tackling the challenges associated with their use. This study adopts an inductive, qualitative methodology based on an analysis of existing literature, company websites, and international standards, to address this gap in the research literature. The paper explores how some of the largest companies working with nanotechnologies publicly address these challenges through their corporate social responsibility (CSR) approaches and examines the extent to which nanotechnologies feature in these approaches to establish organizational trustworthiness. Building on these findings, and with reference to relevant international standards such as ISAE 3000 and ISO/IEC TS 5723, the article proposes an assurance-based framework to foster verifiable trustworthiness by assessing and managing the impact of nanotechnologies in the corporate environment and to guide corporate governance and regulatory compliance. This will be of interest and relevance to business practitioners and researchers as findings suggest that awareness of the potential impacts of nanotechnologies remains limited, as reflected in their scant recognition in many CSR policies and related activities.

1. Introduction

Nanotechnology is the science and engineering of manipulating matter on an atomic and molecular scale. Since the first experiments using nanotechnologies at IBM in the late 1980s [1], applications have extended across a range of industries and in many application areas, including water purification and desalination, textile coatings, solar energy, healthcare diagnostic tools and semi-conductor design and manufacture. At this scale, materials often have unique physical, chemical and biological properties, which have enabled the development and deployment of novel technologies in a variety of fields, acting as the catalyst for radical innovation. In textiles, for example, “nanotechnology embodies a groundbreaking innovation … facilitating enhancements to the functionality and performance of textiles, including durability, resistance to water, odor, flame, stain, UV-protection, and antimicrobial properties” [2] (p. 1). As Pokrajac et al. [3] note “instead of incremental improvements to existing technologies, nanotechnology offers disruptive, game-changing breakthroughs and innovations that can provide immediate answers and solutions to help our society, environment, and the planet” (para. 10). Already, many everyday products currently harness nanotechnologies as evidenced by the following two simple examples. Nanoparticles of titanium oxide and zinc oxide have proved to be highly effective in sunscreens in blocking ultraviolet radiation and in feeling lighter on the skin; and when used in textiles, silica nanoparticles can help to create waterproof and stain-proof clothing.

Corporate Social Responsibility (CSR) is widely seen as a component of business strategy in which companies integrate social and environmental concerns in their business operations and interactions with their stakeholders rather than solely considering economic profits. Yassim and Beckmann [4] (p. 598) suggested “there is no consensus or widely accepted definition of CSR”, and that a popular definition is that proposed by Carroll and Buchholz [5] (p. 40), namely that the “social responsibility of business encompasses the economic, legal, ethical, and discretionary (philanthropic) expectations that society has of organizations at a given point in time”.

There is an overlap between CSR reporting and Environment Social and Governance (ESG) reporting. Both can be used to assess sustainability issues, but Duffy [6] notes that “CSR may be used as an internal framework, while ESG provides a measure of assessment for investors” (para. 3), and that “CSR can be used to build awareness and highlight goals within the business and is more qualitative” (para. 20). Christensen et al. [7] also note that “CSR could be in line with, or go against, the interests of shareholders. It encompasses a broad spectrum of environmental, social, and governance topics, activities, and policies” (p. 1179). In this context, Kandpal et al. [8] (p. 239), in their study of the two concepts in recent decades, concluded that “while the rise of E.S.G. reporting marks a shift towards transparency” lack of standardization remains an unresolved issue, and that “regulatory mandates, technological integration, and shifting stakeholder expectations” were key challenges for the future.

As regards nanotechnologies, CSR involves companies acting ethically and sustainably to manage the potential societal and environmental risks associated with this emerging technology. It includes achieving accountability both within the corporate structure and from regulatory bodies, as well as ensuring public trust and promoting responsible innovation. This is done through engaging with stakeholders and conducting transparent risk assessments. Nanotechnology offers potential benefits like targeted drug delivery and clean water solutions, but companies will need to integrate CSR to address health and environmental concerns, promote equitable access, and avoid exacerbating societal inequalities. Stannard [9] recently concluded that “while the potential benefits of nanotechnology are enormous, ongoing effective regulation is crucial to ensure its safe and responsible use”, and that “regulation needs to evolve in tandem with these technological advancements, focusing on aspects like quality control, safety, efficacy, and environmental and ethical considerations” (para. 9).

However, for these CSR commitments to be meaningful, they must be underpinned by a rigorous assurance framework and a holistic approach to trustworthiness. This is especially critical for nanotechnology, where traditional risk management primarily focuses on occupational safety and human health. While these safety protocols provide a necessary baseline, incorporating the principles of ISAE 3000, the International Standard on Assurance Engagements [10], enables an objective assurance mechanism to validate the ongoing effectiveness of these health-related safeguards. Furthermore, as defined by ISO/IEC TS 5723 [11] (which focuses on trustworthiness), achieving true trustworthiness in the nano-scale domain requires going beyond isolated safety measures; it demands a verifiable synthesis of reliability, resilience, and transparency. In this regard, assurance acts as the vital link that transforms CSR promises into a demonstrable state of trustworthiness, ensuring that responsible nano-innovation is not just a technical ambition, but a measurable organizational reality.

In this context, the principles embodied in the Governance, Risk and Compliance (GRC) management approach [12] are of relevance in developing an effective assurance-based framework for risk governance for nanotechnology deployment. GRC dates from 2007 when the Open Compliance and Ethics Group (OCEG) in 2007 introduced the approach as a strategy for the governance of risk that would also maintain compliance with industry and government regulations.

This paper thus addresses the following research questions (RQs) (Figure 1):

Figure 1. Research scope and research questions.

RQ1. In which industries are nanotechnologies (NTs) having the most impact and what are the key issues and concerns?

RQ2. What are the corporate social responsibility agendas of companies currently using nanotechnologies?

RQ3. Can an assurance-based risk governance framework be developed to provide verifiable trustworthiness and guide the industry in its approach to the deployment and exploitation of nanotechnology?

Building on the insights from RQ1 and RQ2 regarding the potential implications of nanotechnology deployment in industry, and considering the related CSR risk landscape, RQ3 develops an operational, application-oriented risk governance framework grounded in assurance, rather than providing only high-level conceptual guidance. The key element of this proposal is verifiability, supported by the complementary roles of ISO 31000 [13] in structuring the risk management process, ISO/IEC TS 5723 in defining trustworthiness-based evaluation criteria, and ISAE 3000 in providing an independent assurance mechanism. This mechanism specifies auditable criteria, outlines evidence requirements, and delivers assurance-ready outputs. Collectively, these components enable independent testing of CSR risk management practices and trustworthiness claims related to nanotechnology.

Prior governance and risk models often emphasize responsible innovation, stakeholder engagement, and broad risk management practices, while assurance-oriented verifiability and trustworthiness-based criteria are less explicitly operationalized. The framework proposed in this study extends prior approaches by anchoring governance in an ISO 31000–based risk management process, operationalizing CSR expectations through ISO/IEC TS 5723 trustworthiness criteria and enabling independent verifiability through an ISAE 3000–aligned assurance layer. Accordingly, the proposed framework moves beyond descriptive CSR governance toward an assurance-ready and operationally applicable model for emerging technologies such as nanotechnology.

Following this brief introduction, the three-phase research process is outlined in Section 2, including the approaches and methods used. Section 3 presents the results and directly addresses the research questions. In Section 4, some emergent issues are discussed further. Finally, Section 5 provides a conclusion, notes limitations, and highlights possible areas for future research studies in this field.

2. Research Method

There were three main phases to the research process (Figure 2). In phase 1, an interpretivist philosophy underpinned a qualitative assessment of relevant literature from which initial responses to the RQs were developed. This approach is particularly appropriate for exploratory research when the researchers are looking to find an explanation of the phenomenon under study [14]. In phase 2, the corporate social responsibility reports of 12 companies using nanotechnologies are assessed, and in phase 3, a risk governance framework for nanotechnology deployment is put forward, based on a combination of international standards. These three phases are discussed in more detail below.

Figure 2. The 3-phase research process.

2.1. Phase 1: Integrative Literature Review

Phase 1 comprised an integrative review of relevant literature to provide an initial assessment of key issues relevant to addressing the RQs. An integrative review allows for a more open and flexible research and analysis compared to a systematic literature review. A range of search strings was used to find appropriate material available on the Internet between September 2025 and January 2026, using a combination of search items derived from the RQs- “nanotechnologies”, “corporate social responsibility”, “CSR”, “governance risk compliance”, “GRC”, “industry sectors”, “challenges”, “benefits” and “drawbacks” and variations on these main themes. From the initial location of relevant sources, other references were pursued and assessed in a snowballing process. Bell et al. [15] noted that such an approach “may be more suitable for qualitative or inductive researchers, whose research strategies are based on an interpretative epistemology” (p. 97). Over 60 sources were located, but after an initial assessment, 20 main sources of particular relevance to addressing RQ1 were identified, the majority of which date from after 2020, and are journal articles.

This facilitated the mapping of the key concepts within the area of study, and identification of the types of evidence that are available. It was a “broad scan of contextual literature” through which “topical relationships, research trends, and complementary capabilities can be discovered” [16] (p. 351). Snyder [17] (p. 335) notes that “for newly emerging topics, the purpose [of an integrative review] is rather to create initial or preliminary conceptualizations and theoretical models, rather than review old models. This type of review often requires a more creative collection of data, as the purpose is usually not to cover all articles ever published on the topic but rather to combine perspectives and insights from different fields or research traditions”.

The located sources were reviewed and analyzed using framework analysis, which involves the building of frameworks within which emergent themes can be classified. Goldsmith [18] notes that the method is “an inherently comparative form of thematic analysis which employs an organized structure of inductively- and deductively derived themes (i.e., a framework) to conduct cross-sectional analysis using a combination of data description and abstraction”, and that “the overall objective of framework analysis is to identify, describe, and interpret key patterns within and across cases of and themes within the phenomenon of interest” (p. 2061). This was based on the construction and development of x-y axes tables with sources on one axis and emergent issues on the other, with relevant quotations, perspectives and issues noted in the framework cells. From this data, the narrative accounts were assembled, and the provisional conceptual framework (PCF) was developed. Merriam and Simpson [19] observe that a PCF is normally grounded in a preceding literature review and represents the researcher’s map of the area being investigated. Whilst concrete models may have precise variables and unambiguous parameters, the PCF provides an initial understanding and conceptualization of the subject under study [20].

2.2. Phase 2: Case Example Analysis for CSR Agenda

In Phase 2, a more focused set of search items was used to locate major companies that were employing nanotechnologies, and which also presented information on their approach to CSR. Using appropriate internet searches, the main industry sectors identified in addressing RQ1 were assessed, and companies were located that admitted to some use of nanotechnologies or nanomaterials and that also published a CSR report (or similar). The number of companies that met both these criteria was limited, and thus whilst there was clearly a subjective element in the choice of companies, the authors felt that to find and analyze twelve companies that met both criteria would provide an adequate snapshot of how nanotechnology deployment was treated in corporate CSR reporting. The identified companies come mainly from the pharmaceuticals, chemicals, and electronics and computing industries, with some involvement in textile, energy and healthcare sectors, providing a reasonable cross-section for an exploratory investigation into the industries using nanotechnologies.

The searches identified a further 20 sources relating to twelve major companies: BASF SE (Ludwigshafen, Germany), Applied Materials Inc. (Santa Clara, CA, United States), Thermo Fisher Scientific Inc. (Waltham, MA, USA, Merck Group (Darmstadt, Germany), Evonik Industries (Essen, Germany), Cabot Corporation (Boston, MA, USA), DuPont (Wilmington, DE, USA), Taiwan Semiconductor Manufacturing Company (Hsinchu, Taiwan), Intel Corporation (Santa Clara, CA, USA), GSK plc (London, UK), IBM (Armonk, NY, USA), and Toray Industries Inc. (Tokyo, Japan), which offered some publicly available material on CSR, and which provided the basis for Phase 2 of the study. All twelve companies presented information on their approach to CSR in a variety of formats, namely, CSR report, sustainability report, impact report, code of conduct, and website information, although the volume of information varied considerably from company to company.

Brief pen pictures of these companies are provided below, and their use of nanotechnologies is indicated in Table 1. BASF SE is a European multinational company, and it is the world’s largest chemical producer. It was founded in 1865, has 112,000 employees, and its headquarters are in Ludwigshafen, Germany. Applied Materials is an American corporation that supplies equipment, services and software for the manufacture of semiconductor chips for electronics, flat panel displays for computers, smartphones, televisions, and solar products. It was founded in 1967, it has some 36,000 employees, and its headquarters are in California, in the US. Thermo Fisher Scientific is a US life sciences and clinical research company. It was founded in 1956, it has 125,000 employees, and its headquarters are in Boston, the US. The Merck Group is a German multi-national corporation operating in health care, life sciences, and electronics. It was founded in 1968, has 60,000 employees, and its headquarters are in Darmstadt, Germany. Evonik is a German chemical company. It was founded in 2007 and has 30,000 employees, with its headquarters located in Essen in Germany.

Table 1. Twelve case example companies, industry sector, and their use of nanotechnologies.

Company	Industry Sectors	Nanotechnology/Nanomaterials Use
BASF SE	Chemicals	The company uses nanotechnologies to create new materials and enhance current products such as coatings and sunscreens. It is also involved in battery developments, providing nano-enabled solutions.
Applied Materials	Electronics and Computing, Energy	Nanotechnology is used to create lighter, stronger engineered materials at the atomic level. This includes electronics components (like IoT, memory), as well as energy sector products (fuel cells).
Thermo Fisher Scientific	Analytical Instruments, Lab Equipment, Software.	The company provides nanoscale research tools (like electron microscopes and mass spectrometers for nanoparticles), and other services to help design, create, and analyze materials at atomic level.
Merck Group	Pharmaceuticals, Chemicals, Healthcare, Electronics	The company uses nanotechnology in a number of product areas, often in conjunction with nanotechnology co-development companies. These include cadmium-free quantum dots (nanomaterials for ultra-bright displays); nanomaterial-based sensors; and semiconductor and electronics materials.
Evonik	Chemicals	Evonik uses nanotechnologies to provide advanced materials and solutions for the pharmaceutical, food, electronics and automotive sectors. Applications include improved drug delivery, sustainable products (e.g., microplastic-free cosmetics), and more efficient electronics.
Cabot Corporation	Chemicals and Performance Materials	Cabot Corporation specializes in carbon-based nanomaterials (e.g., carbon nanotubes and fumed silica), for batteries and electronics infrastructure.
DuPont	Chemicals	Nanotechnologies are evident in innovative solutions for water purification membranes, electronics, and developing risk frameworks for nano applications. Nanotechnologies are used in some of their firefighting equipment products.
Taiwan Semiconductor Manufacturing Company	Electronics and Computing	The company is the largest global chip manufacturer and makes nanoscale integrated circuits for a wide range of computing and electronics applications.
Intel	Electronics and Computing	The company uses nanotechnology for manufacturing transistors at nanometer scales to increase performance and has pioneered new systems to execute the extreme precision required for nanometer-scale fabrication.
GSK	Pharmaceuticals	The company uses nanotechnologies in the development and manufacturing of vaccines and healthcare products.
IBM	Electronics and Computing	Nanotechnologies are used in the development of semiconductors for high-performance computing and also diagnostic tools for biomedical research and healthcare applications.
Toray Industries	Chemicals, Textiles, Electronics	Toray Industries uses nanotechnology to create advanced materials for use in the textile industry, water treatment and electronics.

The Cabot Corporation is a US speciality chemicals and performance materials company. It was founded in 1882, it has 4500 employees, and its headquarters are in Boston, the US. DuPont is a multinational US chemical company. It was founded in 1802 and has 24,000 employees; its headquarters are located in Delaware, US. Taiwan Semiconductor Manufacturing Company, manufacturers semi-conductors. It was founded in 1987, it has 84,000 employees, and its headquarters are in Hsinchu in Taiwan. GSK plc is a major British global biopharmaceutical company, formed in 2000 from the merger of Glaxo Wellcome (London, UK) and SmithKline Beecham (London, UK). It is headquartered in London and its business centers on the discovery, development and manufacture of medicines and vaccines. Toray Industries is a Japanese multinational chemical company, headquartered in Tokyo. It was founded a century ago and is a global leader in advanced materials, with products spanning a wide range of application areas including fibers, textiles, plastics, fine chemicals, films, carbon fiber composites, IT-related products, pharmaceuticals, and water treatment solutions. Intel is a US multinational technology company. It was founded in 1968, it has 109,000 employees and its headquarters are in Santa Clara in the US. IBM is a multinational US technology company. It was founded in 1911, it has 290,000 employees and its headquarters are in New York in the US.

These companies provide case examples of how CSR reports approach issues related to nanotechnology deployment: they occur within a brief time frame, are simple and straightforward, with reporting being brief [21]. The findings do not pretend to provide a comprehensive analysis of how the companies are treating nanotechnology issues, but rather they provide illustrations of relevant CSR reporting that quotes directly from the source material.

2.3. Phase 3: Development of a Risk Governance Framework

Phase 3 focused on developing a risk governance framework based on international standards that could be incorporated into company CSR strategies for nanotechnology management. As discussed above, CSR is widely regarded as a component of business strategy, in which companies integrate social and environmental concerns into their business operations and interactions with stakeholders, rather than solely focusing on bottom-line profitability. In the context of nanotechnology, three international standards are particularly relevant in supporting a risk governance framework: ISO/IEC TS 5723 [11] and ISAE 3000 [10], noted above, but also ISO 31000 [13]. In combination, these standards can provide a platform for developing a CSR vision and strategy that is operational, measurable and credible.

The ISO 31000 risk management standard provides the foundational process for identifying, analyzing, evaluating and treating the social and environmental risks associated with nanotechnology, ensuring that uncertainty and potential harm are managed systematically rather than remaining abstract commitments.

ISO/IEC TS 5723 strengthens this process by adding a trustworthiness lens—introducing dimensions such as safety, reliability, resilience, transparency, explainability and accountability—which translate CSR principles into concrete evaluative criteria that can be embedded directly into the risk assessment stage of ISO 31000.

ISAE 3000 offers an independent assurance mechanism that verifies whether the organization’s nanotechnology risk management practices and trustworthiness commitments are implemented as claimed, thereby enhancing credibility and preventing greenwashing, and providing stakeholders with the evidence-based confidence they require. Together, these three standards have the potential to enhance CSR by introducing a structured, trustworthy and externally validated governance framework for emerging technologies such as nanotechnology, rather than just being a declarative responsibility.

3. Results

3.1. RQ1. In Which Industries Are Nanotechnologies Having the Most Impact and What Are the Key Issues and Concerns?

Research and publication on the impacts of nanotechnology in industry can be traced back for at least a quarter of a century. Lee and Jose [22] (p. 113) argued that at that time, given the uncertainties associated with nanotechnologies, “it may be necessary to rely on corporations behaving in a socially responsible manner by self-regulating when dealing with the conceptualization, development, use and disposal of nanoparticles”, and that “caught between the reality and rhetoric, corporate managers need to manage trade-offs between corporate advantage and social responsibility in ways that may have a significant bearing on the survival of their firms and the future development of nanotechnology itself”. Further, Robinson [23] (p. 1222) recognized that nanotechnology promised many benefits across society, but argued that “those wishing to coordinate and develop appropriate governance strategies for nanotechnologies need to consider both the wide spectrum of nanotechnology research and development lines, the governance landscape surrounding nanotechnology and the application areas it will affect, and how these may co-evolve with each other”. The following year, McCarthy and Kelty [24] (p. 405), looked “at attempts by nanotechnologists to make do able and calculable in a setting where the established language and tools of risk and risk analysis are seen as inadequate”.

In the years since this work was published, a number of themes, namely environmental and health impacts, ethical and societal concerns, governance and risk management, and stakeholder engagement, can be identified in research on nanotechnology and its impact in industry. Recent publications have tried to be more specific in identifying in which industries nanotechnologies will be deployed and in which application areas. This is not easy to pin down because of the rapid advancement of nanotechnology applications and their unknown potential in some areas.

Omietimi et al. [25] provide a summary of the main industries impacted by nanotechnology use. In summary, these are: healthcare and medicine; the pharmaceutical industry; agriculture; the chemical industry; energy; textiles; electronics and computing; the food industry; and wood-based products industries (Figure 3). Various authors have investigated the impacts of nanotechnologies in some of these industry sectors, but the majority of the literature examines cross-industry issues. Ma et al. [26], for example, looked to explore the landscape of nanotechnology in healthcare whilst also examining the critical aspects of safety and environmental risks associated with its widespread application. This work focused on the elucidation of the diverse healthcare applications of nanotechnology, spanning medical diagnostics, tissue engineering, targeted drug delivery, gene delivery, cancer therapy and the development of antimicrobial elements. In conclusion, the authors emphasized the importance of balancing innovation with safety and environmental stewardship, while charting a path forward for the responsible integration of nanotechnology in healthcare. In related work, Jansma et al. [27] explored citizens’ contributions to the development of nanotechnology for health. The findings suggested that citizens were able to contribute to implementation and their concerns about the effect of such technologies were centered around well-being, autonomy and privacy.

Figure 3. Industries and application areas impacted by nanotechnology deployment.

More generally, in examining ethical and social concerns, Subramanian et al. [28] looked to assess the social impact of nano-enabled products through their life cycle, using a quantitative methodology. Five indicators associated with impacts of nano-enabled products were identified. Two of these indicators were concerned with the impact of nanotechnology on employees, and three focused on wider social and community issues. Dabare et al. [29] suggested that nanotechnology-enabled water treatment has emerged as a transformative solution for bolstering water security and tackling the global water crisis associated with climate change. More specifically, the authors employed global case studies to explore how nanotechnologies can help to create resilient, circular water systems.

In focusing upon stakeholder engagement, Jeffcoat et al. [30] argued that in order to maintain consumer confidence in today’s nano-economies and realize the benefits of tomorrow’s nanotechnology applications, multidisciplinary approaches are required to ensure that health, environmental, regulatory, reputational, and economic risks are appropriately addressed, and that social acceptance and consumer confidence are maintained.

A number of the potential environmental problems might be taken as simple examples. If nanomaterials in manufactured products enter the environment, as atmospheric emissions or liquid discharges from production facilities, for example, then this can have toxic effects on ecosystems, and can lead to health problems. Here, the accumulation of copper oxide nanoparticles can reduce the photosynthesis and transpiration rates of plants and can cause harmful effects to earthworms which often improve soil structure and create important channels for air and water. Silver and copper nanoparticles can also be toxic to fish and other aquatic life. At the same time, there are also concerns about nanoparticles being absorbed by soil microbes and algae, which are then transferred up to the human food chain. More generally, at the present time, there is only limited understanding of the long-term effect that continuing exposure to nanoparticles could have on the environment, and a great deal of further research seems to be required in what is a complex and rapidly changing arena.

A wide variety of health problems have also been associated with nanotechnologies, from exposure to nanoparticles which may enter the body through inhalation, ingestion or skin contact. These problems include pulmonary inflammation, cancer, brain, liver and kidney damage, and neurodegenerative problems, and there are concerns that nanoparticles may exacerbate existing respiratory conditions, such as asthma and chronic obstructive pulmonary disease. Some carbon and silica particles, for example, can cause lung inflammation and fibrosis.

A number of ethical issues also pose causes of concern, including privacy and surveillance using nano-scale devices, equity and access to benefits, public trust, data security, informed consent, and fears about using nanotechnology to create lethal autonomous weapons. In focusing on data security, for example, there is the potential for nanotechnology to be used to break encryption, in that advances in nanoscale engineering, which are essential for the development of large-scale quantum computers, may create long-term risks for breaching modern encryption, and exposing personal and financial information. Informed consent can also be seen as a vital issue in that there is a need for workers and for patients to understand, and consent to, the potential risks involved in nanotechnology applications.

In summary, the existing literature suggests there are three main areas of concern regarding nanotechnology deployment: health and safety; ethics; and wider environmental issues. As depicted in Figure 4, these three areas of concern are multidimensional and have wide-ranging potential impacts. This constitutes a challenge to risk governance mechanisms in many corporate environments and calls for a comprehensive approach to provide a sound assurance-based framework for nanotechnology risk management, with associated procedures and monitoring measures. This provides the provisional conceptual framework for examining the CSR strategies of the case example companies.

Figure 4. Key areas of concern for assurance-based nanotechnology risk governance (provisional conceptual framework).

3.2. RQ2. What Are the Corporate Social Responsibility Agendas of the Selected Companies?

In addressing the potential impacts of nanotechnologies, Kuzma and Kuzhabekova [31] argued that CSR was an important aspect of nanotechnology oversight given the role of trust in shaping public attitudes about nanotechnology and the lack of data about the health and environmental risks of nanoproducts. The authors argued that CSR is strengthened by adopting stakeholder-driven models and by paying attention to moral principles in policies and programs. Here, however, the information on CSR posted by the case example companies was dominated by issues relating to sustainability, widely defined, and there was little specific reference to the impact of, or risks associated with, nanotechnologies.

Nevertheless, there was some evidence of a corporate commitment to risk management, which can be assumed apply to risks related to nanotechnology deployment. Thermo Fisher Scientific [32] (p. 1), for example, emphasized that “as the world leader in serving science, we understand that we have a unique opportunity and responsibility to use our position to make a positive impact on society—by enabling our customers’ success and also through our actions as a company to make the world a better place”. Perhaps more specifically, Intel [33] (p. 5) noted the importance of creating value for the company and its stakeholders by mitigating risk, reducing costs and building brand value: all built on a “strong foundation of transparency, governance, ethics and respect for human rights”. Toray Industries [34] note their commitment to “continually revise management systems, strengthen internal controls as part of efforts to fulfill the company’s social responsibilities” (p. 1).

Sustainability covered a number of interlinked themes of relevance to nanotechnology deployment: environmental management, stakeholder engagement, social information, and governance. For the Merck Group [35] (p. 1), for example, “scientific progress and responsible entrepreneurship go hand in hand, enabling us to create a sustainable future for everyone”. BASF [36] (para. 7) claimed to be “powering the transition to a more sustainable future”, and the Evonik 2024 Sustainability Report [37] (p. 93) looked to “provide our stakeholders with a transparent and objective picture of our sustainability performance” and included environmental, social and governance information. DuPont [38] (p. 4) looked to highlight “our commitment to sustainability and the value it brings to every aspect of our business—driving improvements and differentiation in our product portfolios, improving our manufacturing sites and supply chains, and creating an environment that empowers our people”, and focused upon its commitment to “innovate for good”, “protect people and planet”, “empower people to thrive”, and on “governance”.

A wide variety of environmental agendas can be identified across the sustainability information provided by the selected companies. These concerned climate change, which was seen as a pressing environmental, economic and social problem and a major challenge to sustainability. Water stewardship was another environmental agenda for the selected companies, with companies concerned to improve the efficiency of water use within their own operations. and along their upstream and downstream value chains. The improved management of waste materials was another focus here, with some companies claiming to be implementing waste reduction and management plans, whilst others are keen to report on how they are implementing circular economy strategies for their waste streams. More specifically, Applied Materials [39] (p. 53) emphasized its commitment to “promoting the circular economy”, and illustrated this commitment with its work with semiconductor manufacturing equipment and the development of materials and processes that enable the reuse, repair and recycling of components in high technology industries.

A number of companies emphasized their approach to responsible chemistry, which usually centered on strong chemical compliance, on enhancing accountability and transparency, and the safe use of chemicals throughout supply chains. Intel [33] (p. 64), for example, claimed its responsible chemistry programme was centered around “strong chemical compliance and the safe and responsible use of chemicals throughout our supply chain” and its “objectives include minimizing the use of hazardous substances, promoting the development of safer alternatives, and enhancing transparency and accountability”. More generally, a number of the selected companies stressed their commitment to environmental management and to reducing the impact of their operations on the environment. IBM [40] (para. 7), for example, emphasized “its continuing commitment to take deliberate actions to drive real results for environmental responsibility”, while the Taiwan Semiconductor Manufacturing Company [41] (p. 4) reported that “each year, we advance our commitment to operating with minimal environmental impact”.

The importance of stakeholder engagement is emphasized by a number of companies, with a common emphasis on transparency and open communication designed to develop trusted relationships with a wide range of stakeholders including investors, employees, suppliers, customers, governments, non-governmental organizations and communities. The Cabot Corporation [42] (p. 33), for example, stressed that “maintaining strong relationships with our stakeholders is critical to our success, including our ability to evaluate sustainability impacts and implement actions for positive change”. Further, the company claimed to “seek out opportunities for meaningful interactions with stakeholders to understand the nature of our business and our commitment to improving sustainability performance and the respect for human rights, as well as to collectively identify”, that “our open-door policy provides the framework for employees to raise concerns and report suspected violations of corporate policies or the law”, that “employees may utilize several points of contact, such as supervisors, the Office of Compliance, or the Cabot hotline”, and that “manufacturing facilities have formal processes to engage with the local community, including Community Advisory Panels and Community Engagement Days, where our neighbors can visit our facilities and interact directly with Cabot employees and learn more about plant operations” [42] (p. 33).

Many of the selected companies addressed a number of issues, including employee satisfaction, diversity and equal opportunities, health and safety, and communities, under the social umbrella. Here, many companies claim to see diversity as an opportunity, rather than a political or social obligation, and qualified and motivated employees are seen as essential to companies’ long-term success, with the promotion of employees’ career development being an important element in this process. Corporate human resources strategies often take a practice-oriented approach, and many companies claim to offer a supportive working environment, flexible working models and transparent development opportunities. More generally, companies encourage their employees to use their experience to help a wide range of communities.

In addressing governance, companies emphasize that reliable and ethical company management is the basis for long term success, fair competition and acceptance by society. Here many companies are active in fighting corruption and money laundering and respecting human rights, both within their own operations and across their supply chains. DuPont [38] (p. 61), for example, argued that “strong governance is the foundation of their “sustainability strategy”, and that the company had “management processes and defined responsibilities for sustainability topics” to ensure that and commit to reporting on progress. The company’s robust governance framework ensures that “sustainability is fully embedded in functions and each of our businesses, driving consistent and impactful actions”.

In marked contrast to the wealth of general information on CSR challenges provided by the companies working with nanotechnologies and nanomaterials, specific, detailed information on the CSR issues associated with nanotechnologies was, at best limited, and often conspicuous by its absence in CSR company reports and information. While the Taiwan Semiconductor Manufacturing Company [41] reports on the health and safety of its employees, for example, there is no reference to nanotechnologies. In a similar vein, the Cabot Corporation [42] (p. 54) claims that “promoting a safe and healthy workplace is a shared responsibility across our global operations”, and reports on enhancing programs for contractor safety management, workplace hazard recognition, and working at heights. In their Responsible Business Performance Report 2024 [43], GSK reported on six focus areas to “help us to address what is most material to our business and most important to our stakeholders” (p. 4), these being access to healthcare, global health and health security, environment, inclusion and diversity, ethical standards, and product governance. As in the examples noted above, there are many references to good practice concerning the environment, the sustainable development goals and staff welfare. As regards product governance, the company notes “ensuring the quality, safety and reliable supply of our products is critically important to protect our patients” (p. 34), but there is no specific reference to nanotechnologies. Under the heading “keeping our people safe”, the company notes “responsibilities for safety as leaders and as individuals have been reviewed at all levels of the organization”, and “risk assessments are a key part of the environment, health and safety control framework that governs our approach to identifying and controlling hazards” (p. 37). Again, there is no specific reference to nanotechnologies or nanomaterials.

While various dimensions of environmental management, were, as reported above, prominent in many of the reports and information posted by the selected companies, there were no specific references to the environmental impact of nanotechnology or nanomaterials. In her “Letter from our Chief Executive Officer”, in the DuPont 2025 Sustainability Report [38], Lori Koch drew attention to the company’s “breakthrough technologies”, including “nanofiltration membranes” which had “received top awards for advancing safe, clean water and green hydrogen production” (p. 4). However, the company provided no further details of such awards or how their claims were verified.

The ethical issues surrounding privacy and surveillance, equity and access to benefits, public trust, data security, informed consent, and fears about using nanotechnology to create lethal autonomous weapons, receive little or no attention. Thus, while the Cabot Corporation [42] emphasized their commitment to “conducting business with the highest ethical standards, and we expect the same from our suppliers”, perhaps less positively, the Merck Group [35] (p. 18) reported that the company had not identified impacts, risks or opportunities for “bioethics and digital ethics”, and thus did not include these topics in its report.

However, several of the selected companies do address nanotechnology risks and risk governance procedures in other publicly available documents. GSK issued its “Public Policy Position” on nanotechnologies over 10 years ago [44], in which it noted “we also accept that there are numerous societal concerns about the potential human and environmental impact of engineered nanomaterials. We are fully committed to engaging in the public debate around addressing these issues and supporting ongoing research where possible (p. 1). More recently, in the company’s position statement on Hazardous Chemicals Management [45], the company notes “nanomaterials are similar to chemicals/substances, and these are also covered by the same rigorous regulatory framework that ensures the safe use of all such materials” (p. 4).

DuPont, who use nanotechnologies in some of their firefighting equipment products [46], jointly developed the “Nano Risk Framework” with Environmental Defense Fund, which “is a new framework intended to help businesses, governments and the public at large evaluate and discuss the potential risks from nano-scale materials” [47] (para. 1). More specifically, it “was developed as a systematic process for evaluating and addressing the environmental, health and safety risks of nanomaterials across all stages of a product’s lifecycle—from initial sourcing through manufacture, use, and recycling or disposal” (para. 2). Included in the process described by the Framework are six steps [48]: describing the material and the intended application; profiling the material’s lifecycle in this application; evaluating the associated risks; assessing risk management options; deciding and documenting actions; and regularly reviewing new information and adapting actions accordingly. Linda Fisher, DuPont’s Chief Sustainability Officer, said the framework was not a substitute for regulation, but DuPont hopes that it helps governments around the world develop effective regulations. She added that this six-step framework has already become part of the company’s mandatory product stewardship process. As part of the evaluation process for the framework, DuPont tested three different classes of nanoscale materials: a new titanium dioxide-based product, carbon nanotubes and zero valent iron [47] (para. 6).

Merck operates under a group policy for the responsible “Handling and Use of Nanomaterials” [49]. The company emphasizes transparency and safety, ensuring products are marketed only if their safety and environmental impact can be ensured based on available scientific information. The company maintains that economic considerations do not take precedence over safety and health issues. Thermo Fisher Scientific, who provide tools for nanoscale research and manufacture [50], has its internal risk governance processes, but also participates in the development of a unified, global nanotechnology risk governance (NRG) framework, driven by international and European Union-funded initiatives in collaboration with industry, regulators, and research institutes. There are three main objectives: firstly, to develop consistent and transparent methods for hazard and exposure assessment of nanomaterials; secondly, to establish international standards and testing guidelines (e.g., via the OECD and ISO) for the safe and sustainable use of nanomaterials; and thirdly, to create robust, science-based decision-making tools and platforms for managing potential risks across the nanotechnology value chain. This has already resulted in collaborative frameworks (such as the RiskGONE and NANORIGO projects) which provide a scientific and regulatory framework for the management of the specific risks associated with nanotechnology.

BASF [51] has also collaborated in pan-European projects related to nanotechnology governance. The company notes “safe handling of nanomaterials is stipulated in our Nanotechnology Code of Conduct”, which is monitored by the Environmental Protection, Health, Safety, and Quality (EHSQ) unit in the Corporate Center. BASF also reported that “two European Union-sponsored projects on assessing nanosafety–GRACIOUS and PATROLS—were completed with BASF’s assistance. The results were documented and communicated in 2022 in numerous publications with BASF’s involvement” (para. 12).

Evonik [52] notes that “our long-standing experience helps us implement measures to protect employees, customers, and consumers in the handling of nanomaterials” and that “Evonik supports the establishment of new methods of investigation aligned to the specific effects of nanomaterials, which refine the evaluation of risks. We are also continuously investigating the potential hazards and safe handling of these materials” (para. 2). Similarly, Cabot Corporation addresses nanotechnology risk governance through proactive collaboration with health and safety organizations like the National Institute for Occupational Safety and Health (NIOSH) [53]. The company incorporates safety-by-design principles and works within existing regulatory frameworks for nanomaterials. The company’s overall corporate governance structure emphasizes integrity, respect, and responsibility, which provides the foundation for managing environmental, health, and safety (EHS) risks, including those related to nanotechnology. Similarly, the Taiwan Semiconductor Manufacturing Company [54] incorporates nanotechnology risks within its comprehensive Enterprise Risk Management (ERM) framework and specific Environmental, Safety, and Health (ESH) policies.

Overall, many of the companies studied made general pronouncements in their CSR reports on environmental, ethical and health-related issues without specific reference to how they would be applied in the context of nanotechnology use. However, more detail on nanotechnology risk governance are evident in some of the other company documents available online.

3.3. RQ3. Can an Assurance-Based Risk Governance Framework Be Developed to Guide Industry in Their Approach to Nanotechnology Deployment and Exploitation?

Renn and Roco [55] emphasized that the international agreements on nanotechnology inadequately address essential human issues, such as resources (water, energy, and food) and environmental concerns, similar to other emerging technologies, and presented a risk assessment and management framework for nanotechnology by the International Risk Governance Council (IRGC) [56]. Some companies are actively involved in developing frameworks and regulations for international control and monitoring of nanotechnology deployment. For example, DuPont and the Environmental Defense Fund presented a Risk Framework, focusing on current environmental, health, and safety practices [48]. In 2021, with the adoption of the IRGC approach [56], the Nanotechnology Risk Governance Framework (NRGF) was presented [57].

A key issue here is that these previous frameworks significantly overlook the concept of “assurance”, as defined by ISAE 3000, and the multidimensional nature of “trustworthiness” outlined in ISO/IEC TS 5723. By integrating Corporate Social Responsibility (CSR) into their governance model, this study posits that companies must act ethically and sustainably to manage the societal and environmental risks associated with nanotechnology. Within this framework, CSR is not merely philanthropic; it is a strategic mechanism for achieving corporate and regulatory accountability, ensuring public trust, and fostering responsible innovation through transparent risk assessment and robust stakeholder engagement.

Table 2 sets out how these standards can be used in combination, integrating the three complementary international standards. ISO 31000 provides the overarching risk governance and decision-making process (context, identification, analysis, treatment, communication, and continual improvement); ISO/IEC TS 5723 complements this by defining trustworthiness attributes—such as reliability, security, resilience, and ethical impact—together with measurable criteria, evidence requirements, and transparency mechanisms that translate abstract uncertainty into auditable elements; and ISAE 3000 strengthens the trustworthiness layer by supplying the assurance perspective: suitability of criteria, quality of evidence, roles and responsibilities, use of experts, documentation, reporting, and the treatment of limitations and uncertainty.

Table 2. CSR-based nanotechnology governance framework based on ISO 31000, ISO/IEC TS 5723 and ISAE 3000.

Dimension/Aspect	ISO 31000	ISO/IEC TS 5723	ISAE 3000
Primary role	Provides the risk management framework	Sets trustworthiness criteria and vocabulary	Establishes an assurance standard
Objective	To identify, analyze, evaluate and treat risks	To establish trustworthiness parameters	To provide independent assurance that claims are valid
Core focus	Managing uncertainty and risk	Defining properties of trustworthiness	A methodology for assurance engagements
Type of guidance	Process framework (context, identification, analysis, evaluation, treatment)	Conceptual definitional framework	Evidence, evaluation and reporting standard
Key outputs	Risk register, risk criteria, and risk treatment plans	Trustworthiness dimensions and criteria	Assurance reports
Relevance to nanotechnology deployment	Frames nano-specific risks systematically	Provides trustworthiness criteria for nano trust & transparency	Verifies nanotechnology risk & trustworthiness claims
CSR contribution	Ensures social and environmental risks are managed	Aligns CSR values with trustworthiness attributes	Provides credibility and prevents greenwashing
Position in overall framework	The “backbone” risk management core	Provides a trustworthiness lens	Adds an assurance layer
Interaction with others	Uses TS 5723 criteria during risk evaluation	Criteria are embedded into ISO 31000 evaluations	Assurance tests ISO 31000 process and TS 5723 criteria

Together, these three standards form a tri-layered governance model: ISO 31000 structures the process, TS 5723 defines what must be demonstrated to earn trust, and ISAE 3000 ensures that the resulting trust claims are credible, evidence-based, and assurance-ready. In combination, these standards can operationalize nanotechnology risk governance as a coherent, transparent, and auditable system capable of addressing scientific ambiguity, social/ethical concerns, regulatory fragmentation, stakeholder communication challenges, and institutional inertia.

Building on the complementary roles summarized in Table 2, organizations can operationalize ISO/IEC TS 5723 by specifying, for each selected trustworthiness dimension, the evidence to be collected (e.g., technical documentation and SDS, exposure/hazard assessments, EHS control records, governance decision logs, training and supplier attestations) and linking it to the relevant ISO 31000 activities (identification/analysis, treatment planning, monitoring and communication). These mapped criteria and evidence requirements can then be consolidated into ISAE 3000–aligned assurance outputs by defining the subject matter and criteria, documenting evidence procedures, and producing an assurance conclusion/report (limited or reasonable) that records findings and exceptions.

Malakar et al. [58] classified risks in the nanotechnology domain into 10 categories (A1, A2–E1, E2), which can be used as a worked example to illustrate the application of the framework outlined above. These risk categories do not represent discrete system vulnerabilities in a technical sense; instead, they are domains of epistemic, social, regulatory, and institutional uncertainty that require deliberate governance. For example, the authors emphasize that “limited scientific knowledge of nanoparticle behavior and long-term toxicity complicates formal risk assessment”, illustrating how uncertainty—rather than a specific hazard—creates risk in emerging nano-innovation ecosystems. Table 3 indicates how the three standards can be used to manage these uncertainty-driven risks in a structured manner.

Table 3. Integrated Governance Framework: Application of ISO 31000, ISO/IEC TS 5723, and ISAE 3000 to address Malakar et al.’s [58] Ten Nanotechnology Risks.

Risk Code & Title	ISO 31000— Primary Management Actions	ISO 31000 Clause/Sub-Clause	ISO/IEC TS 5723 Trustworthiness Support	ISAE 3000 Supporting Key Clauses for ISO/IEC TS 5723
A1—Limited scientific knowledge	Define uncertainty tolerance in the context; establish a living risk register; implement periodic monitoring and review; apply precautionary risk treatment where evidence is incomplete.	4 (Principles—Best available information); 6.3 (Scope, context, criteria); 6.4.2–6.4.4 (Risk identification, analysis, evaluation); 6.5 (Risk treatment); 6.6 (Monitoring & review)	3.1.1 (Trustworthiness—“verifiable way” despite limited knowledge); 3.2.2 (Accuracy—“strive for true values” with incomplete data); 3.2.19 (Transparency—“openly acknowledge knowledge gaps”); 3.3.5 (Measurability—“use measurable metrics”); 3.3.7 (Objective evidence—“evidence over subjective assumptions”)	Criteria & limitations: 12(c), 63, 69(e), A143–A145—ensure criteria are measurable and limitations are explicit. Evidence under uncertainty: 44, 48–50, 64–66—define adequate evidence levels despite knowledge gaps.
A2—Uncertainty in social & ethical risks	Define value-based risk criteria; maintain continuous consultation with stakeholders; embed ethical considerations in the risk context and criteria.	4 (Principles—Best available Information/Human and cultural factors); 6.2 (Communication & consultation); 6.3 (Scope, Context & criteria)	3.1.1 (Trustworthiness—“meet stakeholders’ expectations”); 3.2.1 (Accountability—“state of being accountable”); 3.2.9 (Privacy—“freedom from intrusion”); 3.2.17 (Safety—“does not lead to state where human life, health endangered”); 3.2.19 (Transparency—information—“clear and understandable presentation of social/ethical implications”); 3.3.8 (Stakeholder—“can affect, be affected by, or perceive itself to be affected by social/ethical risks”).	Accountability & stakeholders: 24(a), 69(b), 12(m), A16–A18—identify responsible party and stakeholder expectations for social/ethical outcomes. Ethical criteria: 12(c), 63, A10—ensure criteria address privacy, safety, and ethical concerns.
B1—Diverse/fragmented regulation	Develop a unified risk policy; integrate roles and responsibilities across agencies; harmonize risk-evaluation and treatment criteria.	5.2 (Leadership & commitment); 5.3 (Integration); 5.4 (Design); 6.4 (Risk assessment) –6.5 (Risk treatment)	3.1.1 (Trustworthiness—“verifiable way across regulatory jurisdictions”); 3.2.1 (Accountability—“allocated responsibility in fragmented regulation”); 3.2.19 (Transparency—information—”clear presentation of regulatory divergence”); 3.2.20 (Transparency—systems—“openness in regulatory compliance”).	Roles & accountability: 24(a), 31–36, 69(b)—define responsible parties and engagement partner responsibilities across jurisdictions. Common criteria & transparency: 12(c), 63, 69(d), 78—establish shared criteria and transparent reporting of regulatory divergence.
B2—Limited resources in agencies	Prioritize based on impact and uncertainty; design proportional treatment plans; allocate resources in line with risk appetite and severity.	5.4.4 Allocating resources, 5.5 (Implementation), 6.3 (Scope, context and criteria); 6.4 (Risk assessment); 6.5 (Risk treatment)	3.1.1 (Trustworthiness—“meet expectations despite constraints”); 3.2.1 (Accountability—“accountable with limited resources”); 3.2.4 (Availability—“accessible despite constraints”); 3.2.11 (Quality—system—“maintain regulatory quality despite constraints”); 3.3.2 (Capability—“measure of capacity to achieve regulatory objectives despite constraints”)	Accountability & planning: 24(a), 31–36, 37–43—ensure accountability and achievable scope despite resource constraints. Risk-based approach: 44, 48–50, 64–66, A92–A100—focus on material matters and design proportionate procedures to maintain quality.
C1—Public awareness gaps	Establish a transparent communication plan; provide simplified safe-use guidance; publish regular public reports on risks and safeguards.	4 (Principles—Inclusive, Best available information); 5.4.5 (Establishing communication and consultation); 6.2 (Communication & consultation); 6.7 (Recording & reporting)	3.1.1 (Trustworthiness—“build trust through verifiable information to public”); 3.2.19 (Transparency—information—“provide clear, accessible nanotech information”); 3.2.20 (Transparency—systems—“ensure openness in public communication processes”); 3.2.21 (Usability—“make information usable for public understanding”); 3.3.5 (Measurability—“assess public awareness levels against metrics”); 3.3.8 (Stakeholder—“identify public as key stakeholder in awareness”)	Stakeholders & measurable criteria: 12(c), 12(m), 63, A16–A18—identify public as stakeholders and ensure awareness criteria are measurable. Report clarity & processes: 69(k), 69(e), 78, A173–A177—provide clear, informative summaries and transparent communication processes.
C2—Multi-stakeholder communication difficulty	Define roles/RACI; ensure continuous two-way consultation; adopt shared terminology and evidence pathways across stakeholder groups.	5.2 (Leadership and commitment); 5.3 (Integration); 5.4.3 (Assigning roles, authorities, responsibilities & accountabilities); 5.4.5 (Establishing communication and consultation); 6.2 (Communication & consultation)	3.1.1 (Trustworthiness—“meet stakeholders’ expectations”); 3.2.1 (Accountability—“being accountable to multiple stakeholders”); 3.2.19 (Transparency—information—“clear and understandable presentation to diverse audiences”); 3.2.20 (Transparency—systems—“openness and accountability in multi-stakeholder communication”); 3.2.21 (Usability—“information usable by diverse stakeholder groups”); 3.3.8 (Stakeholder—“multiple groups with different perspectives on nanotech communication”)	Stakeholders & accountability: 12(m), 24(a), 31–36, A16–A18—identify diverse stakeholder groups and ensure accountability to all. Communication & reporting: 69(k), 78, A173–A177—provide informative summaries and transparent multi-stakeholder communication processes.
D1—Need for interdisciplinary integration	Conduct multidisciplinary risk-identification workshops; establish shared risk criteria; implement integrated governance across domains.	4 (Principles—Inclusive, Integrated, Structured and comprehensive); 5.3 (Integration); 6.2 (Communication & consultation); 6.4 (Risk assessment—collaboratively)	3.1.1 (Trustworthiness—“meet stakeholders’ expectations”); 3.2.1 (Accountability—“state of being accountable across boundaries”); 3.2.8 (Integrity—systems—“accuracy and completeness across disciplines”); 3.2.19 (Transparency—information—“clear presentation of interdisciplinary knowledge”); 3.3.2 (Capability—“measure of capacity to integrate diverse disciplinary expertise”); 3.3.8 (Stakeholder—“experts from multiple disciplines affected by integration needs”)	Stakeholders & accountability: 12(m), 24(a), 31–36, A16–A18—identify experts from multiple disciplines and ensure accountability across boundaries. Expert coordination & reporting: 52–55, 69(k), A120–A135—govern expert work to ensure competence and clear presentation of integrated findings.
D2—Limited public deliberation	Perform stakeholder mapping; design feedback loops; publish responses to public input and explain how it influenced decisions.	4 (Principles—Inclusiveness, Best available information); 5.4.5 (Establishing communication and consultation); 6.2 (Communication & consultation); 6.3.4 (Defining Risk criteria—“views of stakeholders”); 6.7 (Recording & reporting)	3.1.1 (Trustworthiness—“meet stakeholders’ expectations through inclusive deliberation”); 3.2.1 (Accountability—“state of being accountable to public in deliberative processes”); 3.2.19 (Transparency—information—“clear presentation of information enabling informed deliberation”); 3.2.20 (Transparency—systems—“openness and accountability in public deliberation processes”); 3.2.21 (Usability—“information usable by public for meaningful deliberation”); 3.3.8 (Stakeholder—“public as stakeholder in deliberative decision-making on nanotech”)	Stakeholders & accountability: 12(m), 24(a), 69(b), A16–A18—identify public as stakeholders and ensure accountability for deliberative processes. Transparency for deliberation: 63, 69(e), 78, A143–A145—make criteria explicit and ensure transparent processes to enable meaningful public participation.
E1—Evolving technology & impacts	Implement predefined re-evaluation gates; ensure continuous improvement; update controls and governance based on new field data.	4 (Principles—Dynamic); 5.7.1 (Adapting); 5.7.2 (Continually improving); 6.4.2 (Risk identification—“indicators of emerging risks”); 6.6 (Monitoring and review)	3.1.1 (Trustworthiness—“meet stakeholders’ expectations despite evolving technology”); 3.2.4 (Availability—“accessible and usable despite technological evolution”); 3.2.12 (Reliability—cybersecurity—“consistent intended behaviour despite changes”); 3.2.13 (Reliability—system—“ability to perform as required under evolving conditions”); 3.2.14 (Resilience—governance—“ability to adapt to evolving technology”); 3.2.15 (Resilience—system—“maintain functions despite internal and external change”); 3.2.16 (Robustness—“maintain performance under variety of evolving circumstances”)	Monitoring & adaptation: 61, 64–66, 79–83—monitor technological developments, re-evaluate evidence, and document judgments for iterative updates. Continuity & reliability: 21–26, 37–43, 48–50—ensure engagement continuity and maintain reliability despite technological evolution.
E2—Institutional inertia vs. adaptivity	Ensure leadership accountability; define risk-performance KPIs; integrate risk management into culture; conduct internal audits and reviews.	4 (Principles—Human and cultural factors, Continual improvement); 5.2 (Leadership and commitment); 5.3 (Integration); 5.4.2 (Articulating risk management commitment); 5.6 (Evaluation); 5.7 (Improvement)	3.1.1 (Trustworthiness—“meet stakeholders’ expectations through adaptive institutional response”); 3.2.1 (Accountability—“being accountable for institutional adaptivity”); 3.2.11 (Quality—system—“institutional characteristics fulfil evolving requirements”); 3.2.13 (Reliability—system—“ability to perform as required despite institutional inertia”); 3.2.14 (Resilience—governance—“ability to anticipate and adapt to overcome institutional inertia”); 3.2.15 (Resilience—system—“capability to maintain functions and degrade gracefully during institutional change”); 3.3.2 (Capability—“measure of institutional capacity and ability to overcome inertia and achieve adaptive objectives”)	Objectives & accountability: 10–11, 24(a), 31–36, 64–66—establish explicit objectives, ensure leadership accountability, and measure institutional capacity. Learning & adaptation: 79–83—document significant matters to support organizational learning and cultural change.

While this study establishes the key domains of concern for assurance-based nanotechnology risk governance (Figure 4) and demonstrates operational applicability through a standards-integrated worked example (Table 3), a concrete next step toward demonstrating verifiable trustworthiness can be a focused pilot application within a single nanotechnology-intensive company or a clearly bounded sectoral context. The pilot should begin with structured stakeholder engagement to confirm scope, risk criteria, and trustworthiness expectations across health & safety, ethics, and environmental domains. Using Table 3 as the implementation blueprint, the organization would apply the ISO 31000 risk management process, evaluate risks using ISO/IEC TS 5723 trustworthiness criteria, and generate ISAE 3000–aligned assurance artifacts (defined criteria, evidence requirements, and an assurance report) for independent review. This “Verify/Activate” step would provide a rigorous empirical test of the framework’s central proposition by assessing whether CSR-related risk management and trustworthiness claims can be translated into verifiable evidence and actionable governance improvements in practice.

4. Discussion

Many key points emerge from the above results and warrant further discussion. Firstly, in many ways the selected companies’ approaches to CSR can be seen as being built around economic efficiencies and business continuity, and thus to reflect the demands of their businesses as much fundamental concern for environmental and social capital or for the impact of nanotechnology. For example, commitments to equality and diversity in the workplace and to health and safety initiatives can be seen to promote stability and loyalty amongst the workforce as well as suggesting a concern for their well-being.

Secondly, however, little or no attention is devoted to the challenges posed by working with nanotechnologies and nano materials in the CSR reports themselves, but issues relating to nanotechnology deployment are covered by several of the companies in other statements and policy documents issued by these companies. The reason for this discrepancy is not clear. On the one hand, Broomhill [59] (p. 8), for example, argued that large companies with a global reach possess enormous power, which “is often wielded ruthlessly in their own self-interest and frequently at the expense of society and the environment”. Such arguments see CSR policies and practices as not only being “naïve, ineffectual and inadequate”, but also as being deliberately designed by large companies “to deflect attention away from external regulation and control of corporate behavior and power, and to disguise and legitimate other activities which are socially and environmentally destructive” [59] (p. 8). On the other hand, it may simply be that companies are reluctant to draw attention to nanotechnology use in their CSR reports, this being a potentially controversial subject that may have a negative impact on company image. Companies working with nanotechnologies and nano materials might be seen to be using their public approaches to other CSR issues to draw public attention away from the impact of such technologies and materials on the environment and society. For the future, it may also be that companies will look more to their ESG reporting to cover off nanotechnology risk governance. Duffy [6] recently noted that “essentially, ESG considers the ethics of the business in terms of people and the planet, and while in the past, the focus might have been on profits, this has now been swapped out with governance” (para. 16). Duffy also notes, however, that “both CSR and ESG could be used by a business simultaneously” (para. 10). Of relevance here are the recent moves to regulate sustainability reporting. The Corporate Sustainability Reporting Directive (CSRD) [60] is the new, mandatory EU regulation (in effect from 1 January 2024) requiring large and listed companies to report on environmental, social, and governance (ESG) issues, replacing the old Non-Financial Reporting Directive (NFRD). It demands detailed disclosures aligned with European Sustainability Reporting Standards (ESRS), enhancing transparency and accountability for investors.

Thirdly, there clearly are valid initiatives from companies like DuPont and Thermo Fisher to develop appropriate regulatory frameworks. However, the framework put forward here provides a structured way to identify and manage social and environmental risks, which at one level is the central purpose of CSR strategy and activity. CSR begins with the obligation to understand and mitigate the social and environmental consequences of business activities, and this obligation becomes particularly demanding in the context of nanotechnology, where risks are often invisible, uncertain and scientifically complex. The application of ISO 31000 empowers a company to systematically identify health, environmental, ethical and supply-chain risks associated with nanotechnology, and can provide a framework and process for explicitly acknowledging scientific uncertainty and data gaps rather than ignoring or downplaying them. It can also evaluate potential impacts on workers, local communities, consumers and ecosystems in a consistent and transparent manner. As a result, the organization is not merely “aware” of nanotechnology-related risks; it actively and systematically manages them in a socially responsible manner, as required by a robust CSR approach.

Fourthly, the presented framework can support companies in integrating “trust and transparency” into CSR through the TS 5723 trustworthiness criteria. CSR heavily depends on stakeholder trust; however, in nanotechnology, this trust is structurally fragile due to limited public understanding, unknown long-term impacts, and technically demanding scientific communication. ISO/IEC TS 5723 introduces explicit trustworthiness dimensions—such as safety, reliability, resilience, transparency, explainability and accountability—that translate directly into CSR values and can be operationalized. Transparency ensures that stakeholders receive clear, honest information about uncertainties, limitations and risks associated with nanotechnology. Safety places human and environmental protection at the forefront of design, production and deployment decisions, and accountability assigns clear responsibility for social and ethical impacts across the organization and its value chain. Together, these elements move CSR from generic claims such as “we care about sustainability” to measurable, technical and verifiable criteria that define what “responsible nanotechnology” means in practice.

Fifthly, the framework could be used to align CSR with independent, verifiable credibility through ISAE 3000 assurance. CSR statements are often criticized as potential greenwashing, and nanotechnology amplifies this concern because many of its impacts cannot be easily observed or independently assessed by lay stakeholders. By incorporating ISAE 3000-based assurance into the framework, CSR–nanotechnology risk assessments are subjected to independent, third-party review. Data on toxicity, environmental impact and safety must be validated for quality, completeness and reliability and trustworthiness claims are required to be grounded in sufficient and appropriate evidence rather than aspirational language. CSR reporting becomes credible and externally validated information, rather than a self-asserted narrative. The framework can engender a repurposing of CSR from self-declared responsibility into proven responsibility, strengthening stakeholder confidence, supporting regulatory legitimacy and enhancing the overall integrity of nanotechnology governance. These points can equally apply to ESG reporting.

Finally, the framework can strengthen stakeholder engagement and public acceptance, which is essential for successful CSR outcomes. Public acceptance will be required for the long-term viability of nanotechnology, and effective CSR must therefore engage with community concerns, expectations of transparency, ethical debates and broader social impact questions. The framework enables clear and meaningful communication of risks and uncertainties through the transparency and explainability dimensions of TS 5723. It demonstrates robust internal risk management processes under ISO 31000 that stakeholders can see, scrutinize and understand, and provides independently verified reports under ISAE 3000 that external parties can trust as credible representations of an organization’s behavior. These features can build a foundation of trust, legitimacy and accountability between the company and its stakeholders, which is at the heart of CSR and is particularly critical for emerging and often opaque technologies such as nanotechnology.

Table 4 summarizes the key discussion themes and explains why each issue necessitates an assurance layer beyond internal risk management when integrating nanotechnology risks into corporate CSR strategies.

Table 4. Rationale for an Assurance Layer Beyond Internal Risk Management in Nanotechnology Governance.

Themes	Why Internal Risk Management Is Insufficient	Rationale for an Assurance Layer (ISAE 3000)
Engagement & Transparency	Internal risk management processes primarily support internal decision-making and compliance, but provide limited credibility for external stakeholders regarding how nano-specific risks are identified, assessed, and managed.	An assurance layer enables independent verification of disclosures, enhancing stakeholder trust by validating that stated CSR commitments and risk controls are implemented as claimed.
Interdisciplinary Integration	Nanotechnology risks span technical, environmental, ethical, legal, and social domains, which are often managed by separate internal functions (e.g., R&D, EHS, CSR, compliance), leading to fragmented governance.	Assurance provides a unifying evaluation mechanism that assesses whether interdisciplinary inputs are coherently integrated and governed under a consistent, auditable framework.
Adaptability Over Time	Internal risk management is typically periodic and policy-driven, making it difficult to demonstrate responsiveness to evolving scientific evidence, regulatory expectations, and societal concerns related to nanotechnology.	Assurance supports continuous credibility by independently assessing how organizations update risk assessments, controls, and CSR strategies in response to emerging nano-related knowledge and risks.
Accountability & Responsibility Allocation	Internal controls may define responsibilities, but accountability for nano-specific risks can remain diffused across organizational boundaries and supply chains.	Assurance clarifies accountability by evaluating governance structures, responsibility assignments, and escalation mechanisms against explicit assurance criteria.
Public Trust & License to Operate	Internal risk management alone cannot convincingly address public skepticism or concerns about hidden or long-term impacts of nanotechnology.	Independent assurance strengthens legitimacy by demonstrating that nano-risk governance and CSR practices are subject to external scrutiny rather than self-declaration.

5. Conclusions

This article has explored several themes related to nanotechnology deployment in industry. The review of CSR strategies pursued by companies using nanotechnologies revealed that they publicly addressed a wide range of themes in reporting on their approach to CSR, but many of these themes (climate change, water stewardship, waste management, workplace rights, occupational health, and community development) can effectively be seen to constitute standard approaches that inform many corporate CSR reports. There were very few specific references to the environmental impact of nanotechnology or nanomaterials, with minimal coverage of the range of ethical issues surrounding nanotechnology deployment, signaling a significant gap between generic CSR commitments and demonstrable assurance regarding specific nano-risks.

However, there was significant recognition of the need for nanotechnology risk governance in other documentation provided by many of the companies studied. In this context, the development of an assurance-based risk governance framework built around three international standards (ISO 31000, ISO/IEC TS 5723, and ISAE 3000) provides a robust mechanism to move beyond mere compliance towards verifiable trustworthiness. This enables companies to integrate nanotechnology risk governance into CSR policy and strategic decision-making. CSR is not only about how a company communicates its values but about how it embeds responsibility into the core of its strategic and operational decisions. The proposed framework can ensure that CSR is not treated as an “add-on” or marketing layer, but functions as an auditable governance mechanism that provides ongoing assurance over how nanotechnology is researched, developed, manufactured, deployed and monitored over time.

The paper has a number of limitations, not least that it is exploratory and is drawn from the Internet and secondary sources. In addition, publicly available company information is difficult to verify, and triangulation of findings is problematic without undertaking primary research in these companies. However, the authors take the view that the paper offers an initial picture of how companies involved in working with nanotechnologies and nano materials are publicly reporting and providing information on CSR challenges and provides an assurance-based framework grounded in established international standards for verifying responsible nanotechnology use within CSR strategy. Future research could empirically validate the proposed framework through case studies or pilot implementations that jointly apply ISO 31000–based risk management processes, ISO/IEC TS 5723 trustworthiness criteria, and ISAE 3000–aligned assurance engagements in nanotechnology-intensive industries. Further research endeavors could include detailed first-hand investigations into if, and how, companies working with nanotechnologies look to identify the CSR challenges and how the proposed assurance-based framework can be applied, adapted, and externally verified in practice. Research into customers’ perceptions of the impacts of nanotechnology and nano materials on the environment and on society, and if such perceptions may influence patterns of buying behavior, may also merit attention.

Integrating nanotechnology-related risks into corporate social responsibility (CSR) strategies poses significant practical challenges at the implementation level. As shown in Figure 4, these challenges occur at the intersection of CSR strategy, the technically complex domains of nano-risk (including health and safety, environmental, and ethical concerns), and assurance requirements. CSR functions are generally focused on high-level policy commitments and standardized reporting. In contrast, nanotechnology risks are uncertain, context-dependent, and demand close coordination with research and development (R&D), environmental, health, and safety (EHS), and risk management functions. Consequently, companies may encounter constraints related to scientific uncertainty, the limited measurement and traceability of nanomaterials across complex value chains, and the organizational, financial, and capability demands of producing assurance-ready evidence. These constraints help explain the variations in how firms incorporate nanotechnology risks into their CSR strategies. They also underscore the importance of a structured, standards-based framework that facilitates phased adoption and alignment between CSR commitments, risk governance, and independent assurance.

The limited nano-specific detail observed in corporate CSR disclosures may be interpreted in multiple ways. Beyond potential governance gaps, it may also reflect the scientific uncertainty and contested evidence base surrounding long-term nano-impacts, firms’ reluctance to disclose commercially sensitive information (e.g., formulations, process parameters, or supplier relationships), and the practical challenges of tracing nanomaterials across complex value chains. Moreover, integrating nanotechnology risks into CSR strategies can be constrained by uneven internal capabilities (risk and data maturity), resource and cost burdens associated with generating assurance-ready evidence, and the evolving nature of regulatory expectations across jurisdictions. Accordingly, while the proposed ISO 31000–ISO/IEC TS 5723–ISAE 3000 framework provides a structured pathway toward verifiable trustworthiness, its adoption and the level of public disclosure are likely to vary across sectors and organizational contexts, reinforcing the need for phased implementation and empirical validation in future work.

It is also important to acknowledge that the rapid development of nanotechnology and use of nano materials cause critical problems for companies that are looking to frame CSR policies to tackle the challenges posed by such technologies and materials. CSR policies designed to tackle these issues should be clearly articulated in tandem with the developments themselves, and not as a much later response; and if public awareness of nanotechnology becomes increasingly widespread, then the major companies working in the field may need to address these challenges sooner rather than later, if they are to maintain public trust through demonstrable assurance, and retain an effective license to operate. It is hoped the assurance-based framework put forward here may be of value to companies involved in pursuing this endeavor.