Your customer wants your carbon data

A survey arrives with a deadline

The email comes from your largest customer's procurement portal on a Tuesday. It links to a supplier sustainability survey with 38 questions and a due date fifteen business days out. Question 4 asks for your Scope 1 and Scope 2 greenhouse gas emissions for fiscal 2025, in metric tons of CO2 equivalent. Question 9 asks whether a third party has verified the figures. Question 22 asks for your plan to reduce them.

Sales forwards it to the controller with one line: "They are 30 percent of revenue. Can you handle this?" The controller has three years of utility invoices in accounts payable, fuel card statements in the expense system, and nobody who has ever calculated a ton of CO2 equivalent.

This is an illustrative example. The pressure behind it is not. It comes from two rule sets that reached large companies in 2026 and now reach their suppliers through questionnaires like this one.

California counts its largest companies first

California's Climate Corporate Data Accountability Act, SB 253, applies to US companies with total annual revenue above $1 billion that do business in California. The California Air Resources Board (CARB) administers it. CARB's program page states that the deadline for reporting Scope 1 and Scope 2 emissions is 10 November 2026. The state's Office of Administrative Law approved CARB's initial regulation on 12 October 2026, and it took effect the same day.

The first cycle is deliberately light:

• Scope 1 and 2 only. Reports cover direct emissions and purchased energy for the prior fiscal year.
• No assurance yet. CARB will accept 2026 reports without third-party assurance.
• First-year flexibility. A company that was neither collecting nor planning to collect Scope 1 and 2 data on 5 December 2024 may file a statement of non-reporting instead.

Scope 3 is where suppliers come in

Scope 3 covers the emissions in a company's value chain, and that is where your numbers sit. SB 253 does not require Scope 3 for 2026. At a 21 July 2026 workshop, CARB previewed a separate rulemaking for 2027 and later years. It would phase in five of the fifteen Greenhouse Gas Protocol Scope 3 categories from 2027: purchased goods and services, fuel- and energy-related activities, waste generated in operations, business travel, and employee commuting. It would also require limited assurance over Scope 1 and 2 figures from 2027.

Purchased goods and services is the category that reaches suppliers, because much of a customer's footprint in that category is its suppliers' emissions. As of November 2026 the 2027 framework is a proposal, not a rule. Customers who ask now are building the data they would need if it is adopted.

California's companion law on climate-related financial risk, SB 261, remains enjoined by the Ninth Circuit pending appeal as of November 2026. The injunction does not pause SB 253.

Europe capped what customers can demand

The Omnibus I directive narrowed the EU's Corporate Sustainability Reporting Directive (CSRD) and entered into force on 18 March 2026. Mandatory reporting now applies to EU companies and groups with more than 1,000 employees and net turnover above €450 million. Non-EU groups come into scope only with more than €450 million of EU turnover and an EU subsidiary or branch above €200 million. Member states must transpose the changes by 19 March 2027.

For suppliers, the more important change is the value-chain cap. On 3 July 2026 the European Commission adopted a voluntary reporting standard for companies outside the CSRD, developed from EFRAG's voluntary SME standard (VSME). It was published in the Official Journal on 21 September 2026 as Delegated Regulation (EU) 2026/1560 and applies to financial years beginning on or after 1 January 2027.

Under the cap, a CSRD reporter may not require a company that is not itself in scope, and that averaged 1,000 or fewer employees in the preceding year, to provide information beyond the datapoints in Annex II of the voluntary standard. Annex II sets a separate cap for companies with ten or fewer employees.

Three limits keep the cap in proportion:

• It covers information gathered for CSRD sustainability reporting. Requests made to comply with other laws sit outside it.
• A protected company may share more if it chooses. The cap lets you decline; it does not stop the customer asking.
• It is a legal ceiling, not a commercial one. A customer can still prefer suppliers who answer fully.

The practical result: if you sell to a large EU group and average 1,000 or fewer employees, the voluntary standard's datapoints are a sensible scope for your answer library, and a courteous basis for declining requests that go well beyond them.

Most requests ask the same things

Whatever the format, a customer portal, a spreadsheet or a PDF form, most supplier climate requests come back to a short list:

1. Company profile: legal entity, sites, headcount and reporting year.
2. Activity data: electricity, natural gas and vehicle fuel used, by site.
3. Scope 1 and Scope 2 emissions, with the method and emission factors used.
4. Whether anyone other than the preparer reviewed the figures, and who.
5. Targets, policies and the person accountable for them.
6. An allocation: the share of your emissions attributable to that customer.

Integrity questions often travel in the same questionnaire: anti-bribery, sanctions screening, conflicts of interest and a speak-up channel. Treat them as part of the same library.

A response playbook in six steps

1. Log and classify the request

Record who asked, which regime they cite, the due date and which questions are mandatory. A request tied to the CSRD tells you the value-chain cap may apply. One tied to SB 253 tells you the customer is preparing for Scope 3.

2. Name one owner and one reviewer

The controller is usually the right owner, because most inputs are invoices already in the ledger. The reviewer should be someone who did not prepare the numbers.

3. Pull activity data from the ledger

Electricity and gas use appear on utility invoices in accounts payable. Vehicle fuel is on fuel card statements and expense reports. Refrigerant top-ups appear on HVAC service invoices. Build the dataset from those records by site and month, and keep the invoice references.

4. Calculate with a stated method

Use the Greenhouse Gas Protocol's Scope 1 and 2 definitions and published emission factors, and name the factor source and year. Say whether Scope 2 is calculated on a location basis, a market basis or both.

5. Answer inside your boundaries

Say what is included, what is estimated and what is not yet measured. "We do not yet measure Scope 3" is an acceptable answer. A precise-looking figure with no method behind it is not.

6. Approve, send and file

A named executive approves the final answer. File the exact version sent, with its date, so next year's answer starts from it and stays consistent.

Build the answer library once

Each answer you calculate once, with its source and owner, is one you will not rebuild for the next customer. A library for a supplier with a few sites fits in one workbook:

The method statement does most of the work in a review. A short one might read:

Our 2025 Scope 1 and 2 figures cover our two owned plants and one leased warehouse in the United States. They are calculated from utility, fuel card and HVAC service invoices using Greenhouse Gas Protocol definitions and the emission factors listed in the attached schedule. Scope 2 is location-based. Our CFO, who did not prepare the figures, reviewed them. No third party has reviewed them. We do not yet measure Scope 3.

Where to start

Start with the request in front of you and build the library as you answer it. Pull the utility and fuel invoices first, because every other answer depends on them. Our supplier disclosure readiness work builds the library and the method statement from your own invoices and the questionnaires you have already received. For the wider case for publishing what you already measure, read voluntary financial transparency for private companies.