The supplier primary-data myth in 2026 Scope 3 assurance-ready inventories

Here's the issue: teams building Scope 3 inventories for EU Corporate Sustainability Reporting Directive (CSRD) or California Senate Bill 253 compliance assume that collecting data directly from suppliers satisfies the primary data requirement. They budget for supplier engagement programs, design data request templates, and track response rates. The inventory looks complete, the primary data percentage is high, and the filing appears audit-ready. Then the assurance provider flags the data quality split as unsupported, reclassifies half the reported primary data as secondary, and quotes an additional €180,000 to rebuild the evidence lineage from source documents.

However, Scope 3 assurance-ready inventories consist of two things: supplier engagement completeness and data classification reproducibility. The first is a procurement workflow problem—how many suppliers responded, how quickly, and with what coverage. The second is an evidence problem—whether the data you received from suppliers qualifies as primary under European Sustainability Reporting Standards (ESRS) E1 definitions, and whether you can prove it with line-item documentation.

Supplier engagement on its own has no assurance value. Data classification reproducibility is what the auditor is actually verifying. A supplier-reported activity figure—kilowatt-hours consumed, tonnes of raw material purchased, distance traveled—paired with an industry-average emission factor is not primary data under ESRS E1. It is activity-based secondary data. Only emissions totals calculated by the supplier using their own operational data, or emissions certified through Environmental Product Declarations (EPDs) or Product Carbon Footprints (PCFs), qualify as primary. Misclassifying the split inflates your reported primary data percentage and creates an assurance gap that compounds in the transition from limited to reasonable assurance.

While supplier engagement programs have become cheaper—cloud-based platforms, automated request workflows, tiered engagement by spend category—data classification reproducibility has become more expensive. If your 2026 Scope 3 Category 1 inventory reports 65% primary data coverage, but 40 percentage points of that total is activity-based data misclassified as primary, the cost to reclassify and re-engage suppliers in 2027 might exceed the cost of building a classification-first evidence system in 2025. Anthesis Group estimates that Scope 3 reporting remains mandatory for all in-scope CSRD companies where it is material, regardless of the Omnibus I threshold changes that reduced the total population from 50,000 to approximately 5,000 large enterprises^[1]. For those companies, the primary data definition is not negotiable.

How do you solve this? I think the operators building assurance-ready Scope 3 inventories in 2026 are starting with data classification taxonomies before they design supplier engagement workflows. They define what counts as primary at the category level—Scope 3 Category 1 purchased goods, Category 4 upstream transportation, Category 11 use of sold products—then they build request templates that explicitly separate supplier-calculated emissions from activity data paired with defaults. For now, this approach doubles the procurement team's workload in year one, but it eliminates the reclassification cycle that triples audit fees in year two.

The shape of the argument, visualised below.

The Five Primary-Data Myths in Scope 3 Assurance

Myth 1: Any data received directly from a supplier is primary data

Reality: ESRS E1 classifies data as primary only when it reflects emissions calculated by the value chain partner using their own operational measurements, or when it is certified through an EPD or PCF. Activity data—such as a supplier reporting their electricity consumption in kilowatt-hours—becomes primary only if the supplier also reports the grid emission factor they used and the resulting emissions total. If you apply your own emission factor to the supplier's activity data, the result is secondary data, even though the activity figure came directly from the supplier. Normative's 2026 CSRD guidance states: "Only data obtained directly from value chain partners, like supplier-reported emissions, EPDs, and PCFs, is primary. Misclassifying the split inflates the reported primary data percentage and creates an assurance risk."^[2]

Myth 2: Spend-based estimation is safe harbor under limited assurance

Reality: Limited assurance under CSRD does not exempt Scope 3 disclosures from the requirement to report your primary versus secondary data split. Spend-based estimation—multiplying procurement spend by sector-average emission factors—is classified as secondary data with the lowest data quality score under ESRS E1. While limited assurance providers may not challenge the methodology in 2026, reasonable assurance providers will, and the methodology you lock in during your 2025 base year sets the benchmark for all future filings. A mid-sized EU chemicals manufacturer we spoke with completed its first CSRD filing in 2025 under limited assurance for €220,000. When the same auditor scoped the 2026 reasonable assurance engagement, the fee estimate increased to €680,000, with an additional €300,000 in consulting fees to build a centralized evidence repository and document internal controls over Scope 3 calculations^[3]. The incremental cost was not audit hours—it was the cost of building infrastructure that should have been built in year one.

Myth 3: Tier-1 supplier coverage satisfies Scope 3 Category 1 materiality

Reality: Scope 3 Category 1 (purchased goods and services) includes both tier-1 direct suppliers and tier-2 indirect suppliers whose emissions are embedded in the goods you purchase. If your tier-1 supplier sources raw materials from tier-2 suppliers and does not calculate the embedded emissions using primary data from those tier-2 partners, your Category 1 inventory is based on secondary data, regardless of your tier-1 engagement rate. The EU Omnibus Simplification Package I, which raised CSRD thresholds to companies with more than 1,000 employees and annual turnover exceeding €450 million, does not change the materiality assessment for Scope 3 categories^[1]. If Category 1 is material, tier-2 visibility is not optional—it is a data quality requirement that determines your primary data percentage.

Myth 4: Non-EU suppliers are exempt from CSRD data requests

Reality: The Omnibus I provisions introduce protections for small and medium-sized enterprises (SMEs) by capping the information that in-scope companies can request from suppliers with fewer than 1,000 employees. However, this protection applies only to the scope of the request, not the obligation to request data. CSRD-obligated companies must still engage non-EU suppliers to collect Scope 3 data; the cap limits the volume and granularity of the request to align with the Very Small and Micro Enterprise (VSME) simplified standard. For non-EU suppliers above the 1,000-employee threshold, no cap applies. Econos ESG's 2026 compliance guide clarifies: "For non-EU suppliers, the Omnibus introduces a key protection: in-scope companies cannot demand more information from SME suppliers than what the VSME standard covers. This is meaningful for smaller Vietnamese manufacturers who were facing open-ended data requests with no clear boundaries."^[5]

Myth 5: Activity-based data from supplier invoices qualifies as primary

Reality: An invoice line item showing quantity purchased—such as tonnes of steel, liters of diesel, or kilowatt-hours of electricity—is activity data, not emissions data. If you multiply that activity figure by a third-party emission factor (such as DEFRA, EPA eGRID, or ecoinvent), the result is secondary data. The invoice is a source document for activity data, but it does not contain the emissions calculation. To qualify as primary data, the supplier must provide the emissions total they calculated using their own operational emission factors, or you must receive an EPD or PCF that certifies the emissions at the product or batch level. Aligned Incentives' analysis of mandatory Scope 3 reporting notes that CSRD requires assurance across all topics, including Scope 3, with limited assurance expected from the date of initial reporting and an intent to move toward reasonable assurance following a feasibility assessment around 2027^[4].

Summary: The Primary-Data Classification Framework

"Misclassifying activity data as primary for CSRD purposes inflates the reported primary data percentage and creates an assurance risk. Activity-based data uses industry-average emission factors, which ESRS E1 classifies as secondary data." — Normative, Scope 3 Reporting: CSRD & SBTi Requirements (2026)^[2]

The Procurement Team's Primary-Data Checklist

For procurement and sustainability teams building Scope 3 inventories in 2026, the following checklist translates data classification rules into supplier engagement actions:

1. Define primary data at the category level. Before you send a single supplier request, document what counts as primary data for each material Scope 3 category. For Category 1 (purchased goods), primary data means supplier-calculated emissions or certified EPDs. For Category 4 (upstream transportation), primary data means carrier-reported fuel consumption and distance, not modeled logistics emissions.

2. Separate emissions requests from activity data requests. Design two-tier request templates: Tier A asks for emissions totals calculated by the supplier; Tier B asks for activity data (kWh, tonnes, liters) only if Tier A data is unavailable. Document which tier the supplier responded to, and classify the data accordingly.

3. Request emission factor documentation. When a supplier provides an emissions total, ask them to include the emission factor they used (grid factor, fuel factor, process factor) and the source of that factor (national registry, third-party database, site-specific measurement). This documentation is required to verify that the supplier's calculation is reproducible.

4. Engage tier-2 suppliers through tier-1 contracts. For high-spend or high-emissions categories, include a contractual requirement that tier-1 suppliers collect primary data from their tier-2 suppliers and pass through the embedded emissions. This is the only scalable way to achieve tier-2 visibility without engaging hundreds of indirect suppliers directly.

5. Document non-responses and use secondary data intentionally. When a supplier does not respond or cannot provide primary data, document the gap, apply a secondary emission factor, and flag the line item as secondary in your inventory. Assurance providers will verify that you classified the data correctly, not that you achieved 100% primary coverage.

6. Build evidence lineage from day one. Every emissions total in your Scope 3 inventory should trace back to a source document with a unique identifier: a supplier emissions certificate, an invoice with a carbon label, an EPD registration number. This is not required for limited assurance, but it is the only way to avoid retrofitting evidence in 2027 when you transition to reasonable assurance.

The CSRD and SB 253 Convergence on Primary Data

While CSRD and California SB 253 have different scopes—CSRD applies to large EU companies and non-EU companies with significant EU operations; SB 253 applies to U.S. companies with more than $1 billion in annual revenue doing business in California—both frameworks converge on the same Scope 3 primary data requirement. CSRD requires disclosure of the primary versus secondary data split under ESRS E1. SB 253 requires an executive officer statement attesting to the accuracy and completeness of the emissions inventory, which carries personal liability if the inventory is based on unsupported secondary data.

The regulatory convergence creates a compliance arbitrage opportunity: teams that build CSRD-compliant Scope 3 inventories with reproducible data classification can file the same inventory under SB 253 with minimal adjustments. Teams that treat the two frameworks as separate compliance exercises will duplicate supplier engagement costs and audit fees. Dynamic Carbon Credits' 2026 analysis notes: "For most Fortune 500 companies, Scope 3 emissions supply chain exposure represents between 70% and 90% of their total carbon footprint. Yet Scope 3 remains the least measured, least managed, and most legally exposed category of corporate emissions in 2026."^[7]

How Emission3 Fits

Emission3 is built for teams that need to move from supplier engagement to data classification reproducibility without rebuilding their evidence system in year two. The platform is document-first: supplier emissions certificates, invoices with carbon labels, EPDs, and PCFs are ingested as source documents, and every emissions total in your Scope 3 inventory traces back to a specific line item in a specific document. The AI layer extracts emissions data, activity data, and emission factors from unstructured supplier responses, then classifies the data as primary or secondary under ESRS E1 rules. The output is not just an emissions total—it is an evidence pack that includes the source document, the classification logic, and the calculation lineage, formatted for auditor review.

For procurement teams managing hundreds of tier-1 suppliers, Emission3's workflow tools automate the request-response-classification cycle: send tiered requests, track responses, flag missing emission factors, and generate follow-up requests for suppliers who provided activity data but not emissions. For CFOs managing the transition from limited to reasonable assurance, Emission3's audit-ready exports include the primary versus secondary data split at the category level, the evidence lineage for every line item, and the internal controls documentation that reasonable assurance providers require.

We work with compliance officers who need to file under both CSRD and SB 253 using the same inventory. The platform maps your Scope 3 data to both frameworks, generates the executive officer statement for SB 253, and exports the ESRS E1 disclosures for CSRD, with a single shared evidence repository that satisfies both auditors.

The 2027 Reasonable Assurance Timeline

The EU Omnibus Simplification Package I, provisionally agreed by the EU Parliament in December 2025 and progressing through the legislative process in 2026, delays the reasonable assurance transition by allowing limited assurance for a transitional period of three years^[5]. However, the delay does not change the methodology requirements—it only extends the timeline. Teams that file under limited assurance in 2026 with spend-based Scope 3 estimates will face the same reclassification and evidence-building costs in 2028 or 2029 when they transition to reasonable assurance. The transition delay is a planning window, not a compliance exemption.

For compliance officers managing the transition, the critical decision is whether to build the evidence infrastructure in 2026 under limited assurance, or to defer the cost and absorb the retrofit expense in 2028. The economics favor early infrastructure: the incremental cost of building primary data classification into your 2026 supplier engagement program is approximately 30% of the cost of retrofitting evidence in 2028, based on fee estimates from Big Four assurance providers we spoke with^[3].

Closing: The Primary-Data Classification Workflow

The primary-data myth persists because procurement teams are trained to think in terms of supplier coverage—how many suppliers responded, what percentage of spend is covered—not data quality classification. Assurance providers think in terms of evidence reproducibility: can you prove that the data you classified as primary meets the ESRS E1 definition, and can you trace every emissions total back to a source document? The gap between procurement metrics and assurance metrics is the gap between a complete-looking inventory and an audit-ready filing.

For teams building Scope 3 inventories in 2026, the structural question is whether you can classify supplier data as primary or secondary at the point of collection, not after the fact. If you can, your primary data percentage is a compliance metric that holds under assurance. If you cannot, your primary data percentage is a procurement metric that collapses under audit.

Emission3 customers start with a CBAM readiness call where we map your supplier base, identify high-emissions categories, and design a tiered engagement workflow that separates emissions requests from activity data requests. No anonymous self-serve onboarding—every implementation begins with a conversation about your filing timeline, your tier-1 and tier-2 visibility, and the evidence lineage you need to move from limited to reasonable assurance without retrofitting.

Book a CBAM readiness call to map your 2026 Scope 3 supplier engagement program to the primary-data classification framework that auditors will verify in 2027^[6].