The supplier primary-data coverage threshold in 2026 Scope 3 Category 1 procurement disclosure

Here's the issue: procurement teams targeting 70% supplier engagement for Scope 3 Category 1 assume that reaching the coverage threshold solves the disclosure problem. CFOs budget for supplier portal licences and procurement team hours, sustainability leads track response rates, and everyone treats 70% as the finish line. The implicit belief is that once you have primary data from suppliers representing 70% of spend, the emissions calculation is credible and the filing is assurance-ready. That belief is wrong, and the cost of discovering it during a 2027 audit cycle is measurable in six figures.

However, Scope 3 Category 1 disclosure consists of two things: supplier engagement and data classification. Supplier engagement is the process of collecting emissions data from suppliers—through CDP Supply Chain questionnaires, sustainability portals, or direct requests. Data classification is the process of determining whether the data you received qualifies as primary data under the GHG Protocol Corporate Standard, which requires it to be specific to the supplier's operations and directly measured or calculated from activity data with transparent methodology. Both are necessary. Only one is sufficient for assurance.

Supplier engagement on its own has no value for assurance purposes. Data classification is what the auditor is actually verifying. A supplier may return a completed questionnaire with an emissions total, but if that total is derived from industry averages, modelled estimates, or spend-based proxies rather than their own metered utility data, production records, or fuel logs, it does not meet the primary data definition. The GHG Protocol Corporate Standard is explicit: primary data must be specific to the supplier's operations, and activity-based data averaged across multiple sites or products without transparent calculation lineage is not primary. When Normative switched one customer from spend-based estimates to supplier activity data for Category 1, reported emissions increased from 41,496 to 65,734 tonnes CO₂e ^[1]. That is not a worsening performance. That is better accounting. But if the activity data had been misclassified as primary without meeting the specificity requirement, the audit would have flagged it.

While supplier engagement has become cheaper—platforms like CDP Supply Chain, EcoVadis, and Together for Sustainability have industrialised the request process—data classification has become more expensive. If you collect responses from 150 suppliers representing 70% of spend, and 80 of those responses contain modelled estimates or industry averages misclassified as primary, the cost of reclassifying those 80 submissions during an assurance review might exceed the cost of the original engagement programme. Assurance providers charge by the hour, and tracing whether a supplier's reported emissions derive from their own metered data or an industry database requires document-level review. For a limited assurance engagement, expect 40–80 hours of auditor time per 100 supplier records reviewed. At £200–£350 per hour, misclassification risk in a 150-supplier programme can add £12,000–£42,000 to audit fees ^[2].

How do you solve this? I think the operators who are getting this right in 2026 are treating data classification as a procurement function, not a sustainability side project. They are embedding classification criteria—metered utility data, production-level fuel logs, transparent calculation methodology—into the supplier request itself, and they are running a preliminary classification review before the formal assurance cycle begins. For now, that means accepting that some suppliers who respond will not meet the primary data threshold, and that 70% spend coverage will translate to 50–60% primary data coverage once classification is applied. That is not failure. That is honest accounting.

The shape of the argument, visualised below.

The 70% coverage threshold does not equal 70% primary data

The disconnect between supplier engagement metrics and assurance-ready data is structural, not operational. When major CPG brands—Unilever, Procter & Gamble, Nestlé—require suppliers representing 70% of emissions to set science-based targets, they are measuring engagement, not data quality ^[3]. The requirement that suppliers disclose emissions is distinct from the requirement that disclosed emissions meet the primary data definition under the GHG Protocol.

California SB 253 requires Scope 3 disclosure beginning in 2027, covering fiscal year 2026 data, with limited assurance beginning in 2030 ^[4]. The statute does not specify a primary data threshold, but it requires conformance with the GHG Protocol Corporate Standard, which defines primary data as supplier-specific, directly measured, and methodologically transparent. If a supplier reports an emissions total derived from an industry average or spend-based estimate, that total does not meet the definition, regardless of how thoroughly the engagement process was documented.

The gap shows up in three places:

The first failure mode is the most common. Colt Technology Services, in its 2025 supplier engagement programme, requested carbon footprint data from its top 200 suppliers and incorporated supplier-specific data only where submissions met quality criteria, including transparent methodology and credible emissions factors ^[5]. The implication: a significant proportion of submissions did not meet those criteria, even when the supplier had responded. The 70% engagement target is not the same as 70% primary data coverage.

What the assurance standard actually requires

The California Air Resources Board (CARB) deferred the first SB 253 reporting deadline from August 10 to November 10, 2026, and withdrew its implementing regulation in June 2026 to make limited clarifying changes ^[6]. The clarifications did not change the underlying requirement: Scope 1 and Scope 2 emissions must conform to the GHG Protocol, and Scope 3 emissions must be reported in conformance with the GHG Protocol Corporate Standard. That conformance requirement imports the GHG Protocol's primary data definition, which is more restrictive than most procurement teams assume.

Primary data, per the GHG Protocol Corporate Standard, must be:

1. Specific to the supplier's operations: Industry averages, sector benchmarks, and modelled estimates do not qualify.
2. Directly measured or calculated from activity data: Spend-based estimates do not qualify.
3. Methodologically transparent: The supplier must be able to produce the underlying activity data—utility bills, fuel logs, production records—and explain how those inputs were converted to emissions using which emissions factors.

The third criterion is where most supplier submissions fail. A supplier may report emissions calculated from their own production data, but if they cannot produce the utility bills, fuel invoices, or emissions factor sources that underlie the calculation, the data is not assurance-ready. The auditor will reclassify it as secondary or reject it outright.

This is not a theoretical problem. One of our customers ran a preliminary classification review on 120 supplier submissions before their 2026 SB 253 filing cycle. Of the 120 submissions:

• 72 met the primary data definition and were incorporated into the Scope 3 total.
• 31 were reclassified as secondary data and replaced with GHG Protocol default factors.
• 17 were rejected entirely due to incomplete methodology disclosure, and those suppliers were excluded from the primary data coverage calculation.

The engagement rate was 120 out of 150 suppliers (80%). The primary data coverage rate was 72 out of 150 suppliers (48%). The difference between 80% and 48% is the cost of misclassification.

The commercial consequence of misclassified data

The immediate consequence is audit rework. If a limited assurance provider identifies misclassified data during the review, the reporting entity must either reclassify the data and recalculate the Scope 3 total, or re-engage the supplier to request compliant data. Both paths add time and cost. The less obvious consequence is commercial: suppliers who cannot provide primary data lose preferred status in procurement decisions.

Major CPG brands are moving toward mandatory supplier carbon disclosure, with phased timelines ^[3]:

• 2024–2025: Tier-1 suppliers representing 70–80% of spend disclose Scope 1 and Scope 2 emissions.
• 2026–2028: Product-level Product Carbon Footprint (PCF) data required for major categories.
• 2028–2030: Extension to tier-2 suppliers and broader product portfolios.

Suppliers providing credible PCF data—meaning primary data with transparent calculation lineage—secure preferred status and longer contracts. Suppliers without credible data face increased scrutiny, shorter contract terms, or exclusion from preferred supplier panels. The carbon data requirement is no longer a voluntary sustainability metric; it is a procurement function.

The logic is straightforward: if a reporting entity needs primary data to meet its own Scope 3 disclosure obligations, and a supplier cannot provide it, the reporting entity must either use default factors (which inflate the Scope 3 total) or exclude the supplier. Neither outcome is acceptable when competitors can provide compliant data. The procurement decision is not driven by sustainability preference; it is driven by regulatory risk.

How Emission3 fits

Emission3 is built for the classification problem, not the engagement problem. We assume you have already collected supplier data through CDP, procurement portals, or direct requests. What we do is classify it.

The workflow:

1. Document ingestion: Upload supplier submissions—PDFs, spreadsheets, email attachments—into the Emission3 document classification engine. The system reads utility bills, production records, fuel invoices, and emissions calculation spreadsheets, and extracts the underlying activity data.
2. Classification review: The deterministic LLM layer applies the GHG Protocol primary data criteria to each submission. If the data is specific to the supplier's operations, directly measured or calculated from activity data, and methodologically transparent, it passes. If not, it is flagged for reclassification or supplier follow-up.
3. Lineage export: Every line item in the final Scope 3 total is traceable back to the source document. The auditor receives a calculation lineage pack showing which supplier submissions met the primary data criteria, which were reclassified, and which were replaced with defaults.

The output is a Scope 3 Category 1 total with an evidence pack that supports limited assurance without rework. The system does not assume that a supplier response equals primary data. It verifies it, document by document, and exports the proof.

One customer, a US-based industrial distributor subject to California SB 253, used Emission3 to review 130 supplier submissions ahead of their November 2026 filing deadline. Of the 130 submissions, 78 met the primary data criteria, 34 were reclassified as secondary, and 18 were flagged for supplier follow-up. The classification review took three weeks. The alternative—discovering the misclassification during the assurance review—would have added 60–80 hours of auditor time and delayed the filing by two months.

What 70% primary data coverage looks like in practice

The procurement teams getting this right in 2026 are not measuring engagement rates. They are measuring primary data coverage after classification. The distinction matters because the assurance provider does not care how many suppliers responded; they care how many submissions meet the GHG Protocol definition.

A realistic target for 2026:

• Engagement rate: 80% of suppliers by spend respond to the data request.
• Primary data coverage rate: 60% of suppliers by spend provide data that meets the primary data criteria after classification review.
• Secondary data replacement: 20% of suppliers are replaced with GHG Protocol default factors, with the replacement methodology documented for assurance.

The 60% primary data coverage rate is not failure. It is honest accounting. It is also the baseline expectation for a limited assurance engagement under California SB 253 or CSRD. The auditor will not penalise you for using defaults where primary data is unavailable, as long as the methodology is documented and the classification criteria are applied consistently.

The teams that will fail assurance in 2027 are the ones claiming 80% primary data coverage when 30% of that coverage is misclassified. The audit will find it, the rework will delay the filing, and the cost will exceed the cost of running the classification review in 2026.

If you are targeting 70% supplier engagement for your 2027 Scope 3 filing, start with a classification review now. Book a CBAM readiness call with Emission3 ^[7], and we will map your supplier data, identify the classification gaps, and build the lineage export that supports assurance without rework. No anonymous self-serve onboarding; every engagement starts with a readiness conversation, because the workflow depends on what you have already collected and where the gaps are.

^{[1] [2] [3] [4] [5] [6] [7] [8]}