If your company is in CSRD's second wave, the data year for your first report starts January 1, 2027. That's about 11 weeks from now. Every AI service you pay for in 2027 lands in that report's Scope 3 inventory.
This checklist tells you in five minutes whether your AI spend is ready to be counted.
What this checklist measures: whether your organization can produce a defensible Scope 3 Category 1 figure for purchased AI services under ESRS E1-6. Who it's for: sustainability, finance and IT leads at companies inside the post-Omnibus CSRD scope, plus suppliers who expect data requests from them. Basis: ESRS E1-6 (gross Scope 1, 2 and 3 emissions), the GHG Protocol Scope 3 Standard (Category 1, purchased goods and services) and the EU Omnibus I Directive as published in the Official Journal on February 26, 2026. Last checked: October 15, 2026.
What Changed in 2026, in Four Lines
- Scope shrank. Omnibus I limits CSRD to EU companies with more than 1,000 employees and more than €450 million in net turnover. Non-EU groups are in scope above €450 million in EU turnover, with an EU subsidiary or branch above €200 million.
- Wave 2 moved. The first report for newly covered companies now covers FY2027 and is published in 2028.
- Assurance stays limited. The planned move to reasonable assurance was removed. Limited assurance still applies, and auditors still test your Scope 3 boundary.
- Smaller suppliers got a shield. Companies with 1,000 or fewer employees in your value chain can decline data requests that go beyond the voluntary standard.
That last point matters for AI emissions. You can't lean on small vendors for the numbers. You'll need your own spend data and a documented method.
The Checklist
Answer each question Yes, No or Not Yet. Be strict. "Probably" is Not Yet.
| # | Question | Yes / No / Not Yet |
|---|---|---|
| 1 | Do you know your total annual spend on purchased AI services (APIs, copilots, AI features inside SaaS)? | |
| 2 | Can you list every AI vendor by name, including AI bundled into larger contracts like Microsoft 365 or Google Workspace? | |
| 3 | Does that spend data reach the ESG team without a manual request each time? | |
| 4 | Have you mapped AI spend to Scope 3 Category 1 in your inventory boundary? | |
| 5 | Have you picked emissions factors for AI and cloud spend, and written down where they came from? | |
| 6 | Is your calculation method (spend-based, activity-based or hybrid) documented in a way an auditor can follow? | |
| 7 | Have you asked your largest AI vendors for supplier-specific emissions data, and recorded what they sent or didn't send? | |
| 8 | Has AI spend been included in your double materiality assessment, with the reasoning written down? | |
| 9 | If you excluded AI services as immaterial, can you show the spend figure that justifies the exclusion? | |
| 10 | Is someone named as owner of this data for FY2027, with a date to close the gaps? |
How to Read Your Score
8 to 10 Yes. You're ready. Spend an hour stress-testing item 9. Auditors ask about exclusions more than inclusions.
4 to 7 Yes. You have the parts but not the pipeline. The usual gap is item 3. The spend exists in finance but never reaches ESG on its own. Fix the pipeline first. The math is the easy part.
0 to 3 Yes. Start with items 1 and 2 this month. You can't build a method around spend you can't see. Pull the last 12 months of AP and procurement records and search for AI vendors by name.
Why Each Question Is on the List
Items 1 and 2: you can't count what you can't find. AI spend hides. Some of it is a clean API invoice. Much of it is a Copilot seat inside an enterprise agreement, or an AI tier added to a tool you already pay for. I see more misses on item 2 than any other.
Item 3: the pipeline problem. AI spend sits in finance and procurement. ESG data usually arrives through other channels, like utility bills, travel systems and supplier surveys. AI services fit none of them. If the ESG team has to ask for the number every year, the number will be late and incomplete. I covered the structural reason in Your AI Stack Is a Scope 3 Problem.
Items 4 to 6: the method has to hold up. AI providers don't publish per-token or per-call emissions factors. Most companies will use spend-based factors for cloud and software services. That's acceptable under "best available data" rules, but only when the method is written down and applied the same way every year. Here's how the spend-based method works.
Item 7: show you asked. Supplier-specific data beats averages. If vendors don't respond, record the request and the non-response. That record is part of your audit trail.
Items 8 and 9: "no data" is not a safe position. Excluding AI services from Category 1 is allowed if you can show they aren't material. But you can't call something immaterial without measuring it. An exclusion with no spend figure behind it reads as a boundary drawn around an inconvenient number.
Item 10: an owner and a date. Without a named owner, this checklist turns into a 2028 audit finding.
What If You're Out of Scope Now?
Plenty of companies dropped out of CSRD with Omnibus I. Three reasons to finish this checklist anyway:
- Your customers may still be in scope. They need your data for their own Scope 3. The 1,000-employee cap limits what they can demand, but it doesn't stop them from preferring suppliers who can answer.
- California is next. SB 253 Scope 1 and 2 reporting started in 2026. Scope 3 reporting is scheduled to follow in 2027.
- AI spend is still growing. The number you skip measuring this year is smaller than the one you'll have to reconstruct later.
Scored under 8? That's normal for 2026. Salish Sea Consulting builds the AI spend pipeline and the documented method your auditor will ask for. Book a 30-minute call and bring your checklist answers. We'll tell you which gaps to close first.
Frequently Asked Questions
Do AI services count as Scope 3 emissions?
Yes. Purchased AI services fall under Scope 3 Category 1, purchased goods and services, in the GHG Protocol. ESRS E1-6 builds on that protocol. The emissions come from the data center energy needed to deliver the service.
When is the first CSRD report due for wave 2 companies?
After Omnibus I, wave 2 companies publish their first report in 2028, covering FY2027. The data for that report starts accumulating January 1, 2027.
Is reasonable assurance still coming under CSRD?
No. Omnibus I removed the planned move from limited to reasonable assurance. Limited assurance still applies.
How do you calculate emissions from AI services without vendor data?
Most companies use a spend-based method. You multiply annual spend by an emissions factor for cloud or software services, then document the factor's source and any adjustments. Activity-based methods are more precise but need usage data most vendors don't share yet.
Can we exclude AI services as immaterial?
You can, if your materiality assessment supports it. You'll still need the spend figure to show the exclusion is justified.