Scope 3 covers the emissions in a company's value chain, from the goods it buys to the way customers use what it sells. Few companies can measure those emissions directly, so most work from spend data and industry averages, filling in with supplier disclosures where they exist. AI makes that work faster and cheaper. A sector-average figure still describes a typical supplier in that industry, though, and the one named on the invoice may look nothing like it.
The International Auditing and Assurance Standards Board (IAASB) set December 15, 2026 as the effective date for the International Standard on Sustainability Assurance (ISSA) 5000, covering sustainability information for periods beginning on or after that date. On the same day, the board will withdraw International Standard on Assurance Engagements (ISAE) 3410, the dedicated standard for greenhouse gas statements. From then on, emissions assurance under IAASB standards runs through ISSA 5000.
Adoption is not universal. The IAASB's tracker, updated in September 2026, lists 24 jurisdictions that have adopted ISSA 5000 or a local equivalent, with 24 more in progress. For multinationals whose emissions data is assured in those markets, the new standard sets evidence expectations from the first covered period.
California is moving on its own track. Under Senate Bill (SB) 253, first-year reports covering Scope 1 and Scope 2 emissions are due to state regulators on November 10, and the California Air Resources Board (CARB) has said Scope 3 reporting begins in 2027. At a July 21 workshop, CARB staff proposed that 2027 reporting cover five Scope 3 categories, including purchased goods and services. Companies would also disclose the percentage of each category's emissions calculated with primary data from suppliers or other value chain partners, along with the method used. The same materials permit spend-based and industry-average estimates and propose no Scope 3 assurance. These remain staff proposals, not adopted rules.
Neither track is aimed at AI specifically, yet both land on the same question. A company could report Scope 3 in California without an auditor testing it and still have to show, category by category, how much of the total came from suppliers and how much was modeled. Where assurance does apply, ISSA 5000 brings the practitioner into the calculation itself.
KPMG, describes AI uses most carbon teams would welcome. Its examples include models that sort vendor spend into categories and read invoices, along with monitors that send outliers to an analyst for review. In one of the firm's examples, classified spend was mapped to U.S. Environmental Protection Agency (EPA) environmentally extended input-output (EEIO) factors to calculate purchased-goods emissions. KPMG's own summary is that AI handles the volume while people handle exceptions and approvals.
An auditor would not treat those jobs equally. Pulling a kilowatt-hour figure from a supplier's utility bill retrieves something that already exists. Assigning emissions to a supplier based on its industry code produces a number about an operation nobody at the buying company has measured. On most dashboards, the two numbers look identical once they are rolled into a category total.
Existing Greenhouse Gas (GHG) Protocol guidance already makes room for the second kind of number. Its Scope 3 calculation guidance treats the spend-based method as a fallback for when supplier-specific, hybrid and average-data approaches are not feasible, and it acknowledges that EEIO data lack the specificity of process-based methods. The Scope 3 Standard also requires companies to describe the data quality of what they report. Spend-based figures have known weak spots of their own, since commodity and inflation swings can move estimated emissions with no change in physical volume.
In its ISSA 5000 implementation guide, the IAASB names the extent of management's judgments, including assumptions behind estimates, as a factor that can raise the chance of material misstatement. It also asks practitioners to weigh the relevance and reliability of information drawn from external sources and value chain entities. When a company leans on a vendor platform to assign emission factors, that platform becomes one of the sources an assurance team has to evaluate.
That has a direct bearing on what finance should require when it buys software. Each consequential estimate should trace back to the original transaction or supplier document. From there, a reviewer should be able to see the assigned category, the emission factor and its vintage, the method and the person who approved it. Where the model inferred something, the record ought to flag that inference and its limits.
Some of this belongs in the contract. Data export rights and clear ownership of exception handling are far easier to settle before a multi-year platform agreement is signed than after an auditor asks for them. The assurance market is still sorting out who answers for the quality of the work, which gives companies another reason to keep their own records complete.
Consider a hypothetical manufacturer comparing two component suppliers. One provides emissions figures tied to its own production data. The other has never reported, so the platform assigns it a sector-average estimate that happens to come out lower. Procurement shifts volume toward the second supplier and books a reduction.
On the factory floor, nothing changed. The gap comes from two estimation methods, and a polished dashboard will hide that unless users can see which figures were measured and which were modeled. CARB's proposed primary-data percentage would surface that split at the category level in a public filing.
Software migrations cause a related problem. Switching tools or factor libraries can move a Scope 3 total sharply without any change in purchasing. The GHG Protocol calls for recalculating base-year emissions after significant methodology changes, and baseline resets can make progress look larger or smaller than it is. Finance teams should separate activity changes from method changes before crediting any sourcing program with a decline.
AI still has a real job in the inventory. GHG Protocol guidance recommends giving the largest emission sources the most precise data collection and improving quality over time where emissions are high and data quality is low. A screening pass across the full supplier base shows where the tonnes concentrate, which tells procurement which suppliers to approach for primary data first.
Used that way, modeled numbers direct effort instead of standing in as final answers. They get replaced with supplier data wherever a sourcing decision or a public claim depends on them. Companies that treat AI output as a starting inventory, with a plan to shrink the modeled share each year, will have an easier conversation with auditors and regulators. Several are already pushing carbon data into commercial decisions, which raises the stakes on knowing which figures came from a supplier.
CARB's first Scope 1 and Scope 2 reports arrive November 10. Its 2027 Scope 3 rules still have to pass through formal rulemaking, and the primary-data disclosure could change shape or disappear before adoption. ISSA 5000 takes effect five weeks later, on December 15, with ISAE 3410 retired the same day.
Further out, the GHG Protocol could change the math itself. Its July 2026 standard development plan lists options the Scope 3 working group is weighing, including restricting or phasing out the spend-based method, requiring data quality to improve over time and adding data quality transparency requirements. A consolidated draft is expected for public consultation in the second quarter of 2027, with a final standard estimated for the fourth quarter of 2028. No option has been decided yet. Even so, a chief financial officer signing a five-year carbon accounting contract this winter is buying software that may have to operate under different rules before the term ends. Procurement teams negotiating those contracts can ask vendors now how their models would handle a narrower role for spend-based estimates.
