The tier-2 supplier data gap in California SB 253 Scope 3 filings

Here's the issue: California Senate Bill 253, the Climate Corporate Data Accountability Act, requires in-scope companies to report Scope 1 and Scope 2 emissions with limited assurance by 2026, then add Scope 3 emissions with limited assurance by 2027. The first reports covering fiscal year 2026 are due in 2027, with exact submission deadlines still pending final guidance from the California Air Resources Board.^[1] Most procurement and sustainability leaders are treating this as a pure emissions accounting exercise: collect spend data, multiply by emission factors, and file. That approach worked for voluntary CDP disclosures. It will not work for SB 253 assurance engagements that carry executive officer liability.

However, an SB 253 Scope 3 filing consists of two things: the emissions total, and the data lineage that supports it.

The emissions total on its own has no assurance value. The data lineage is what the limited assurance auditor is actually verifying—and what determines whether the executive officer statement meets the statutory standard. Under SB 253, the statement must be signed by the company's highest-ranking executive officer and highest-ranking financial officer, asserting that the disclosed information is true and correct to the best of their knowledge.^[2] That signature creates personal liability. If the underlying Scope 3 calculation sits on spend-based estimates derived from industry averages, the auditor cannot verify supplier-specific activity. The data lineage breaks at tier 1, and the assurance engagement stalls.

While spend-based Scope 3 estimation has become faster through carbon accounting platforms, primary supplier data collection has become more expensive. If 70 percent of your Scope 3 footprint sits with suppliers who cannot provide primary emissions data, the cost of filling that gap might outpace the savings of automated spend-based calculation. One customer engagement program documented that switching from spend-based to supplier activity data for Category 1 (Purchased Goods and Services) increased reported emissions from 41,496 to 65,734 tonnes of CO2e—not because performance worsened, but because industry averages had understated actual emissions by 58 percent.^[3] That delta is what sits between a compliant 2027 filing and an assurance qualification.

How do you solve this? I think the companies that will meet the 2027 deadline are the ones treating supplier data collection as a multi-year procurement function, not a 2026 sustainability sprint. The operators we work with are running three-phase engagement programs: identifying material suppliers by spend and emissions contribution in 2025, rolling out primary data requests with standardized templates in early 2026, and building tier-2 visibility through contractual flow-down clauses by late 2026. For now, that sequencing is the only path to a Scope 3 inventory that an auditor can verify without qualifying the opinion.

The shape of the argument, visualised below.

The SB 253 Scope 3 timeline: what starts when

The California Air Resources Board has published the core deadlines, but the exact submission dates for 2027 Scope 3 reports remain under development. Here is the statutory timeline as it stands today:

The 2027 Scope 3 deadline is 18 months away. If you are starting supplier engagement today, you are already behind the curve set by the companies that began in Q1 2025.

What tier-2 visibility actually means

Tier-2 visibility is not an accounting nicety. It is the difference between a Scope 3 inventory that an auditor can verify and one that gets qualified. Here is what the gap looks like in practice:

Without tier-2 visibility: Your direct supplier (tier 1) provides an emissions total for the aluminum they sold you. That total sits on their own spend-based estimate, because they do not have primary data from their smelter (tier 2). The auditor traces your Category 1 calculation back to the supplier's invoice, but cannot verify the emission factor the supplier used. The data lineage breaks. The assurance engagement flags a scope limitation.

With tier-2 visibility: Your direct supplier provides an emissions total derived from the smelter's actual electricity consumption and production volume. The smelter has submitted a verified energy audit to your supplier. Your supplier forwards that documentation to you. The auditor traces your Category 1 calculation back to the invoice, then to the supplier's calculation, then to the smelter's meter data. The data lineage holds. The assurance engagement proceeds.

The difference is not theoretical. EcoVadis and Stanford Graduate School of Business surveyed global corporate buyers in 2025 and found that more than 50 percent increased spending with sustainable suppliers, and nearly the same percentage plan to end relationships with unsustainable vendors within two years.^[4] Tier-2 visibility is becoming a procurement filter, not a sustainability ask.

The three-phase supplier engagement model

The companies reaching 70 percent primary data coverage by late 2026 are following a consistent sequence. The phases overlap, but the sequence matters:

Phase 1: Identify material suppliers (Q1-Q2 2025)

Run a spend analysis to rank suppliers by total procurement dollars. Cross-reference with emission factor intensity: a €500,000 steel supplier likely contributes more to your Scope 3 footprint than a €2 million software vendor. Prioritize the top 30 to 50 suppliers that represent 70 to 80 percent of your Category 1 emissions. This is a finance and procurement exercise, not a sustainability side project.

Phase 2: Roll out primary data requests (Q1-Q2 2026)

Send standardized data request templates to your prioritized suppliers. The template should specify: the metrics you need (Scope 1+2 emissions per unit of product, activity data such as production volume and energy consumption), the reporting boundary (operational control or equity share, depending on your own inventory approach), the timeline for response (60 to 90 days is realistic for suppliers with basic carbon accounting infrastructure), and how data privacy is ensured (confidentiality agreements, secure portal access).

One multinational disclosed that initial outreach to suppliers yielded no PCF data in year 1, spend-based estimates in year 2, and higher-quality primary data by year 3.^[5] That lag is why starting in 2026 for a 2027 deadline is already late.

Phase 3: Build tier-2 visibility through contractual flow-down (Q3-Q4 2026)

For suppliers that cannot provide primary data because they lack it from their own suppliers, contractual flow-down clauses make data collection a procurement obligation, not a voluntary disclosure. The clause specifies that the supplier must obtain and forward verified emissions data from their material sub-suppliers (tier 2) as a condition of the contract. This is not punitive; it is a shared recognition that SB 253 assurance requirements flow upstream. A 2026 EcoVadis report noted that supplier willingness to share emissions data remains a roadblock, particularly among smaller vendors lacking measurement capabilities.^[6] Flow-down clauses convert willingness into obligation.

Why spend-based estimates fail assurance

Spend-based Scope 3 estimation multiplies procurement spend by an emission factor derived from industry averages (dollars spent × emission factor per dollar = tonnes CO2e). It is fast. It is also unverifiable at the supplier level. Here is why:

Emission factors are not supplier-specific. The factor for "steel products" might average 2.5 tonnes CO2e per tonne across the industry, but your Norwegian supplier operates at 1.8 tonnes per tonne, and your UAE supplier operates at 11 tonnes per tonne. The spend-based estimate flattens that variance. The auditor cannot verify which supplier's actual emissions contributed to your reported total.

Spend data does not resolve to activity data. The auditor needs a calculation chain from your reported emissions back to the supplier's production activity (energy consumed, materials processed, transport distance). Spend data stops at the invoice amount. There is no linkage to the physical activity that generated the emissions.

Industry averages inflate error as coverage increases. The Normative case study cited earlier showed a 58 percent increase in reported emissions when one customer replaced spend-based estimates with supplier activity data.^[3] That delta compounds across categories. If your Scope 3 inventory is 90 percent spend-based, the assurance auditor cannot conclude that your reported total is materially accurate.

"Scope 3 represents 70 to 90 percent of corporate carbon footprints but requires supplier collaboration. US companies face limited supplier willingness to share emissions data, small suppliers lacking measurement capabilities, and spend-based estimates providing only rough approximations."^[6]

The quote is from a 2026 ESG compliance guide. It describes the problem. It does not offer a solution. The solution is treating primary data collection as a procurement function with contractual teeth.

The assurance cost crossover in 2027

Limited assurance for Scope 1 and Scope 2 emissions sits in a well-understood cost range: €15,000 to €50,000 for mid-market companies, depending on the number of facilities and data sources. Scope 3 assurance introduces a new cost variable: the cost of verifying supplier data that does not yet exist. If your supplier cannot provide primary emissions data, the auditor has three options: issue a scope limitation (the assurance opinion states that certain data could not be verified), accept spend-based estimates with a qualified opinion (the assurance opinion includes a paragraph noting that the Scope 3 inventory is based on unverifiable industry averages), or require you to obtain the missing data before completing the engagement (the assurance process stalls until you deliver verified supplier documentation).

None of those options are free. A scope limitation exposes the executive officers who signed the SB 253 statement to liability risk, because the statute requires the statement to be true and correct to the best of their knowledge. If the auditor has identified data gaps, the executive officers' knowledge now includes the existence of those gaps. A qualified opinion signals to investors and regulators that the disclosed emissions total is materially uncertain. Delaying the engagement to obtain missing data pushes the filing deadline, which triggers late fees and reputational risk.

The companies avoiding that crossover are the ones building supplier data pipelines in 2025 and 2026, before the 2027 deadline forces a choice between incomplete data and delayed filing.

The CARB guidance gap: what we still do not know

The California Air Resources Board has confirmed the core SB 253 deadlines, but several implementation details remain under development as of early 2026:

• Exact submission deadlines for 2027 Scope 3 reports. The statute requires reports covering the prior fiscal year, but the day-specific deadline for submitting to CARB is still pending final guidance.
• Scope 3 assurance requirements for 2027. The statute mandates limited assurance for Scope 1 and Scope 2 by 2026. Whether Scope 3 requires assurance in 2027 or starts with unassured disclosure is still under CARB review. The board has stated it will monitor evolving best practices and standards for GHG emissions data collection and reporting as we get closer to the longer-term deadlines in 2030.^[1]
• Materiality thresholds for Scope 3 categories. The statute does not specify whether all 15 Scope 3 categories must be reported or whether companies can exclude immaterial categories. CDP and CSRD allow materiality-based exclusions; SB 253 guidance has not yet addressed this.
• Data quality standards for primary supplier data. What level of documentation is sufficient for an auditor to verify supplier-provided emissions data? Must the supplier's data itself be assured, or is an unassured supplier calculation acceptable? CARB has not yet published detailed technical guidance.

These gaps mean that companies preparing for 2027 are building to a moving target. The safe approach is over-preparing: assume all 15 categories, assume Scope 3 assurance is required, and assume supplier data must be verifiable to the same standard as your own Scope 1 and Scope 2 data.

How Emission3 fits

Emission3 is built for the tier-2 visibility problem. We turn supplier invoices, bills of material, and utility bills into line-level emissions evidence, with full calculation lineage from source document to filing. For SB 253 Scope 3 preparation, that means:

• Document classification that resolves to supplier activity data. Our classification engine extracts production volumes, energy consumption, and transport distances from supplier invoices and forwards documentation. That activity data replaces spend-based estimates with verifiable supplier-specific calculations.
• Calculation lineage that survives assurance review. Every emissions number in the Emission3 output includes a traceable path from the source document (invoice, bill of material, meter reading) to the emission factor applied to the final reported total. The auditor can verify each step without requesting additional documentation.
• Evidence packs formatted for executive officer review. The SB 253 statement must be signed by the CEO and CFO. Emission3 exports include a summary evidence pack that shows: the total Scope 3 emissions by category, the percentage of each category covered by primary supplier data versus spend-based estimates, and the documentation supporting the primary data (supplier letters, energy audits, transport receipts). That pack gives the executive officers the visibility they need to sign the statement with confidence.

If you are facing the 2027 deadline and do not yet have a supplier engagement program in motion, the conversation to have this week is a CBAM readiness call. The same tier-2 visibility infrastructure that supports SB 253 Scope 3 assurance also supports CBAM actual emissions reporting for embedded emissions in imported goods. The compliance infrastructure is shared.

What to start this week

The 2027 SB 253 Scope 3 deadline is 18 months out. If you are starting supplier engagement today, here is the week-one checklist:

1. Run a spend analysis by emission intensity. Rank your top 50 suppliers by procurement spend, then cross-reference with emission factors for their product categories. Steel, aluminum, chemicals, and cement typically sit at the top of the emissions-per-dollar ranking. That ranking is your prioritization list.
2. Draft a primary data request template. Specify the metrics you need (Scope 1+2 emissions per unit of product, activity data such as energy consumption and production volume), the reporting boundary (operational control or equity share), and the timeline for response (60 to 90 days). Send the template to your top 10 suppliers as a pilot.
3. Map your Category 1 exposure with finance. Purchased Goods and Services (Category 1) typically represents 50 to 70 percent of total Scope 3 emissions for product companies. Finance needs to see the dollar-weighted emissions ranking, because the suppliers with the largest emissions footprints are not always the largest by spend.
4. Book a CBAM readiness call with Emission3. The same supplier data pipeline that supports SB 253 Scope 3 assurance also supports CBAM actual emissions reporting. If you are an EU importer or a non-EU exporter selling into the EU, the compliance infrastructure is shared. We can map your supplier gaps and implementation timeline in a single call.^[7]
5. Document your baseline primary data share. Even if your current primary data coverage is zero percent, write that number down. The 2027 assurance auditor will ask for year-on-year improvement documentation. Starting with a documented baseline gives you a defensible trajectory.

The companies that will file clean SB 253 Scope 3 reports in 2027 are the ones treating this as a procurement transformation, not a sustainability compliance project. The executive officer liability under SB 253 makes this a CFO and CEO priority, not a sustainability director side task. If you are waiting for final CARB guidance before starting supplier engagement, you are planning to miss the deadline.