The primary-data classification problem in CSRD ESRS E1 Scope 3 inventories

Here's the issue: The Corporate Sustainability Reporting Directive (Corporate Sustainability Reporting Directive) wave-2 filers face European Sustainability Reporting Standards (European Sustainability Reporting Standards) E1 for the first time in 2026. Limited assurance (limited assurance) this year, reasonable assurance by 2028. Most procurement teams budget their Scope 3 programs around reducing emissions totals. But the actual assurance cost—and the audit failure risk—is set by how you classify your data quality.

However, a CSRD-compliant Scope 3 inventory consists of two things: the emissions totals themselves, and the primary versus secondary data disclosure required under ESRS E1. CFOs allocate headcount and software budget to the first.

The primary data disclosure on its own has no value to the business. The emissions total is what the business is actually managing and what targets are set against. But here is the inversion: auditors under limited assurance are not verifying your emissions number in isolation—they are verifying that your data quality classification is defensible. If you misclassify activity-based data (physical units multiplied by industry-average emission factors) as primary data, you inflate your reported primary data percentage. That creates an assurance risk, because ESRS E1 defines primary data narrowly: supplier-reported emissions, environmental product declarations, and product carbon footprints obtained directly from value chain partners.^[1] Activity-based data uses average factors from databases like ecoinvent or DEFRA. It is secondary data, full stop.

While the cost of calculating a Scope 3 total using spend-based estimates has become cheaper—software platforms automate the multiplication of procurement spend by environmentally-extended input-output factors—the cost of documenting your primary versus secondary data split has become more expensive. If your top 20 suppliers by emissions contribute 60 percent of your Scope 3 total, and only five of them provide supplier-specific data, your primary data coverage is 15 percent by supplier count but potentially 30 percent by emissions, depending on which suppliers responded. The auditor will ask you to prove both calculations, document the request trail, and explain why the non-responders are classified as secondary. If your methodology narrative does not match your spreadsheet, the limited assurance engagement extends by two weeks. At EUR 15,000 per week for a Big Four assurance team, that misclassification costs EUR 30,000 in fees, plus the reputational cost of a qualified opinion.

How do you solve this? I think you solve it by treating the primary versus secondary data split as a compliance deliverable from day one, not a reporting footnote you add at year-end. The operators we work with at Emission3 start their Scope 3 programs by tagging every data point—spend-based estimate, activity-based factor, supplier-provided value—at the transaction level, so the split is calculable on demand. For now, that is the only approach that survives limited assurance without rework.

The shape of the argument, visualised below.

The ESRS E1 data quality disclosure requirement

ESRS E1-6 requires companies to disclose the percentage of Scope 3 emissions calculated using primary data versus secondary data, reported separately for each of the 15 Scope 3 categories where material.^[2] This is not an optional narrative—it is a mandatory quantitative disclosure, structured as a table in your sustainability statement.

The table structure is prescribed. The percentages must sum to 100 percent per category. The auditor will test the calculation logic: if you report 22 percent primary data for purchased goods, they will sample your supplier data requests, verify which suppliers provided data, calculate the emissions contribution of those suppliers, and confirm the 22 percent figure is reproducible from source documents.

What counts as primary data under ESRS E1

The classification boundary is where most first-time filers fail. ESRS E1 defines primary data as data obtained directly from companies in the value chain, including:

• Supplier-specific emissions data provided by the supplier (their Scope 1 and 2 inventory, or their product-level emissions)
• Environmental product declarations (EPDs) covering the specific product you purchased
• Product carbon footprints (PCFs) calculated to ISO 14067 or GHG Protocol Product Standard

Secondary data includes:

• Spend-based estimates using environmentally-extended input-output factors (EXIOBASE, USEEIO)
• Activity-based calculations using industry-average emission factors (ecoinvent, DEFRA, IEA)
• Proxy data from similar products or suppliers

The error pattern we see: procurement teams treat activity-based data as primary because it uses physical units (kilograms of steel purchased, kilowatt-hours of electricity consumed by the supplier) rather than monetary spend. But physical units multiplied by average factors are still secondary data. The factor came from a database, not from the supplier's own measurement.^[3]

"Activity-based data uses industry-average emission factors, which ESRS E1 classifies as secondary data. Only data obtained directly from value chain partners, like supplier-reported emissions, EPDs, and PCFs, is primary. Misclassifying the split inflates the reported primary data percentage and creates an assurance risk." — Normative, Scope 3 Reporting: CSRD & SBTi Requirements (2026)^[1]

The practical implication: if your Scope 3 inventory is 80 percent activity-based (industry averages applied to physical quantities), your primary data percentage is zero, not 80.

The supplier engagement threshold for tier-2 visibility

The materiality screening determines which categories require primary data collection. Most DACH manufacturers find that Category 1 (purchased goods and services) contributes 50 to 70 percent of total Scope 3 emissions, followed by Category 11 (use of sold products) and Category 4 (upstream transportation).^[4] Focusing supplier engagement on the top three categories is a defensible proportional approach under EFRAG Implementation Guidance 2.

The engagement threshold: start with suppliers representing 70 percent of emissions within your material categories, not 70 percent of suppliers by count.^[5] For a mid-sized industrial firm, that typically means 30 to 50 suppliers in Category 1. Request primary data using a standardized template: ask for their Scope 1 and 2 inventory if they are a service provider, or a product-level PCF if they are a goods supplier. Document every request with a timestamp and follow-up log. Non-responses remain classified as secondary data, but the request trail proves you made a good-faith effort to obtain primary data.

The double materiality filter: if a Scope 3 category is not material under your double materiality assessment (double materiality), you are not required to engage suppliers in that category. But you still must disclose the category, report it as not material, and explain the exclusion rationale. Limited assurance tests whether your materiality threshold is reasonable, not whether your emissions total is precise.

The assurance-ready documentation structure

Limited assurance under ISAE 3000 (revised) or ISAE 3410 requires the auditor to obtain sufficient appropriate evidence to conclude that your sustainability statement is free from material misstatement. For the primary versus secondary data split, that means:

1. Supplier data request log: A timestamped record of every supplier contacted, the data requested, the response received, and the follow-up actions. The log must map to your supplier master data in your ERP system. Auditors will sample 10 to 15 suppliers and verify the request trail exists.

2. Data classification mapping: A table linking every line item in your Scope 3 inventory to its data source, with a binary flag: primary or secondary. If you calculated 5,000 line items using spend-based factors and 200 line items using supplier-provided data, the auditor will test whether the 200 items are genuinely primary (backed by supplier invoices, EPDs, or PCF reports) and whether the classification logic is applied consistently.

3. Emission factor source documentation: For every secondary data point, document the database name, version, and publication year. If you used DEFRA 2025 factors for upstream transport and ecoinvert 3.10 cut-off factors for purchased materials, cite both with version numbers. Auditors will check whether you used the most current version available at the reporting date.^[6]

4. Primary data verification trail: If a supplier provided a PCF or EPD, retain the certificate, the calculation methodology, and evidence the supplier is the actual producer of the goods you purchased. If a supplier provided their Scope 1 and 2 total, retain their sustainability report or GHG inventory statement. The auditor will test whether the supplier data is specific to your transaction or a generic company average.

The calculation lineage structure Emission3 builds for clients: every emissions line item links to a source document (invoice, bill of materials, supplier statement), an emission factor (if secondary data), or a supplier-provided value (if primary data), with a unique identifier that persists across reporting years. When the auditor asks, "How did you calculate the 22 percent primary data figure for Category 1?", you export a filtered view of the lineage table and hand it over. No manual reconstruction, no Excel archaeology.

The 2028 reasonable assurance timeline pressure

ESRS E1 requires limited assurance for the first two reporting years (2026 and 2027 for wave-2 filers), then reasonable assurance starting in 2028.^[7] Reasonable assurance is the same standard as a financial audit: the auditor must obtain sufficient evidence to express a positive opinion that your sustainability statement is fairly presented in all material respects. The evidence threshold is higher. The sample sizes are larger. The fee is typically 1.5 to 2 times the limited assurance fee.

The timeline problem: if your primary data coverage is 15 percent in 2026, you have two years to improve it before reasonable assurance begins. Most auditors expect primary data coverage of 50 percent or higher for material Scope 3 categories by 2028, because a 15 percent figure is not consistent with a credible data quality improvement plan.^[8] That means you need to onboard 15 to 20 additional suppliers per year, negotiate data-sharing agreements, and build the internal workflow to process supplier-provided PCFs and EPDs.

The budget implication: reasonable assurance for a mid-sized CSRD filer with EUR 500 million turnover and three material Scope 3 categories costs EUR 80,000 to EUR 120,000 annually, assuming your inventory infrastructure is assurance-ready. If your primary data classification is not defensible, the audit scope expands to verify the underlying spend-based and activity-based calculations, which adds another EUR 40,000 to EUR 60,000 in substantive testing. That cost differential—EUR 40,000 to EUR 60,000 per year—is the penalty for misclassifying secondary data as primary in 2026.

The workflow integration with procurement systems

The primary data classification problem is not solvable at the sustainability team level. It requires procurement workflow integration: when a purchase order is issued, the system must flag whether the supplier is in scope for primary data collection, whether a data request has been sent, and whether the supplier has responded. If the response is a PCF, the system must link the PCF to the specific SKU on the purchase order, verify the product match, and tag the transaction as primary data. If the supplier does not respond, the system defaults to secondary data (spend-based or activity-based, depending on data availability) and logs the non-response for the assurance trail.

The ERP integration point: most Scope 3 platforms sit outside the ERP and rely on monthly or quarterly exports of procurement data. That creates a version-control problem: the emissions calculation is based on March data, but the auditor is reviewing the April close, and the supplier response log was updated in May. Emission3's document classification engine integrates at the invoice level: every supplier invoice triggers a classification workflow (primary data available? yes/no), and the classification result is written back to the ERP as a custom field. When the auditor asks for the primary data percentage, you run a query against your own procurement database—no separate Scope 3 tool, no reconciliation risk.

The regulatory convergence with SBTi and IFRS S2

The primary versus secondary data split is not unique to CSRD. The Science Based Targets initiative (SBTi) Corporate Net-Zero Standard requires companies to disclose their data quality improvement plan, with a clear trajectory from spend-based estimates toward supplier-specific primary data.^[1] IFRS S2 (Climate-related Disclosures) requires companies to describe the measurement approach for Scope 3 emissions, including the proportion calculated using primary data.^[6]

The practical convergence: if you build your inventory to ESRS E1 standard—with category-level primary versus secondary data disclosure—you simultaneously satisfy the SBTi data quality disclosure and the IFRS S2 measurement disclosure. All three frameworks reference the GHG Protocol Corporate Value Chain (Scope 3) Standard as the methodological foundation, so the underlying 15-category structure is stable. The disclosure format differs, but the data classification logic is identical.

The California SB 253 implication: California's Climate Corporate Data Accountability Act requires Scope 3 disclosure starting in 2027 for companies with over USD 1 billion in annual revenue. The California Air Resources Board (CARB) confirmed in September 2025 it accepts ISSB-aligned and other international standard disclosures for SB 253 compliance.^[6] If you build an ESRS E1-compliant Scope 3 inventory with primary versus secondary data classification, you can reuse the same disclosure for California SB 253, adjusted for US GAAP presentation.

How Emission3 fits

Emission3 is built for procurement teams and sustainability managers who need audit-ready Scope 3 inventories, not generic carbon accounting dashboards. Our document classification engine processes supplier invoices, bills of materials, and utility bills at the line-item level, tags every transaction as primary or secondary data, and exports the classification mapping in the table format ESRS E1 requires. When a supplier provides a PCF or EPD, the system links it to the specific purchase order, verifies the product match, and recalculates the emissions total using the supplier-provided value. When the auditor asks for your primary data percentage, you export the classification table—every line item, every data source, every emission factor—and hand it over.

The workflow integration: we connect to your ERP at the invoice level, so every procurement transaction triggers a classification decision (primary data available? yes/no). If yes, the system pulls the supplier-provided value. If no, the system applies a secondary data factor (spend-based or activity-based, depending on data availability) and logs the gap for your supplier engagement roadmap. The supplier data request log, the follow-up timestamps, and the response tracking are built into the platform, so your assurance trail is complete by default.

The assurance-ready output: our exports include the ESRS E1-required table (total emissions, primary data percentage, secondary data percentage per category), the calculation lineage (every line item linked to a source document), and the emission factor source documentation (database name, version, publication year). For reasonable assurance in 2028, we add the evidence pack: supplier invoices, PCF certificates, EPD reports, and methodology narratives, indexed by line item. That is the documentation structure Big Four auditors expect.

Book a CBAM readiness call

If your Scope 3 inventory is heading into limited assurance in 2026 and your primary data classification is not defensible, you need workflow-level intervention, not a better spreadsheet. Emission3 customers start with a readiness call: we map your material Scope 3 categories, identify your tier-2 supplier data gaps, and scope the implementation. No anonymous self-serve onboarding—every engagement starts with a conversation about your audit timeline and your current inventory architecture. Book a CBAM readiness call here.^[9]

---

^[1] Normative, Scope 3 Reporting: CSRD & SBTi Requirements (2026)
^[2] EFRAG, European Sustainability Reporting Standards (ESRS) E1
^[3] Senken, CSRD - A Practical Climate & ESRS E1 Guide
^[4] Anthesis Group, CSRD Scope 3 Reporting Requirements: What's Mandatory, What's Changed (2026)
^[5] Normative, Scope 3 supplier engagement: collecting primary carbon data
^[6] Finrep, Scope 3 Emissions Disclosure Methodology: 2026 Practitioner's Guide
^[7] Emission3, The assurance-escalation gap in CSRD wave-2 ESRS E1 filings
^[8] Dazzle Platform, How to align your scope 3 strategy with CSRD requirements
^[9] Emission3, Book a CBAM readiness call