Your AI Vendor’s Data Centre Lands in Your Scope 3, Not Theirs

TLDR: AI bought from a vendor lands in the buyer’s emissions inventory as a purchased service, its data centre figures are sealed by law, and a contract clause signed now is how the buyer obtains them.

The data centre figures exist, and the law routes them away from the buyer

Every data centre in the European Union with at least 500 kilowatts (kW) of installed information technology power reports its energy use, water use and renewable share each year. Then the law seals the rows. Article 5 of Delegated Regulation (EU) 2024/1364¹ obliges the Commission and the member states to keep confidential all information and key performance indicators for individual data centres, and to publish national and EU aggregates. The company whose Scope 3 inventory depends on those rows has one channel to them: its contract with the vendor.

The reporting machinery is real and annual. Operators filed first by 15 September 2024 and by 15 May every year since 2025², across 24 performance indicators covering energy, water, waste heat and renewable energy. The confidentiality clause has a documented origin. Investigate Europe, working with The Guardian and Tech Policy Press, reported in April 2026 that Microsoft and the trade body DigitalEurope submitted an identical article classifying individual data centre information as confidential³, and that the final text adopted it almost word for word. The Commission’s position is that confidentiality was part of its proposal throughout.

Whatever the history, the effect for a buyer is settled. The facility-level energy and renewable figures behind a hyperscaler’s Frankfurt or Dublin region sit in a European database the buyer has no route into. The vendor holds them, files them and can share them with a customer under a non-disclosure agreement (NDA). Article 5 binds public authorities. A bilateral contract sits outside it.

Model energy goes to the regulator, and the customer receives the architecture

The AI Act repeats the pattern one layer up. Article 53 of Regulation (EU) 2024/1689⁴ requires providers of general-purpose AI models to keep technical documentation under Annex XI. Point 2(d) of that annex asks for the computational resources used to train the model, such as floating-point operations, and training time⁵, and point 2(e) for the “known or estimated energy consumption of the model.” That documentation serves the European AI Office and national authorities on request. Downstream providers receive a separate package under Annex XII, which covers tasks, licences, architecture, parameter count and training data, and carries no energy or compute item⁶. The energy figure a buyer needs to allocate training emissions exists in law and travels to Brussels. The contract brings it to the buyer.

AI bought as a service files in Category 1 of the buyer’s inventory

The accounting placement is clear. Chapter 5 of the Greenhouse Gas Protocol Corporate Value Chain (Scope 3) Standard⁷ puts the cradle-to-gate emissions of purchased goods and services in Category 1. Compute bought through an application programming interface (API), or embedded in software sold with AI features, is a purchased service. The European Sustainability Reporting Standards (ESRS) carry that into law for companies in scope: ESRS E1-6 requires gross Scope 3 emissions by significant category in paragraph 51⁸, and Application Requirement 46(a) points the undertaking to the Scope 3 Standard.

Some guidance places employees’ use of AI tools in Category 11. The Scope 3 Standard defines that category as the use of goods and services the reporting company sells⁷, so it belongs to the vendor’s inventory. For the buyer, the service is purchased, and Category 1 is where an assurance provider will look for it.

Who runs the hardware decides the category

Control over the hardware and the power contract moves the same workload between categories. Category 8 covers the operation of assets the reporting company leases, which describes a colocation cage where the company buys its own electricity. A managed inference endpoint leaves the hardware and the power contract with the provider, so the workload files in Category 1. Two companies with identical AI budgets can therefore report in different categories from different evidence, and the one calling a model over an API holds the least of it.

Exhibit 1

The less of the stack a buyer runs, the less evidence it holds without a clause

How AI is bought	Where it files	Evidence the buyer holds without a clause
Managed model API, or software with AI features	Scope 3, Category 1	The vendor’s published averages. Facility rows are confidential (Article 5); model energy goes to the AI Office (Annex XI).
Dedicated cloud capacity, run by the provider	Scope 3, Category 1	Whatever account-level reporting the provider chooses to offer. Facility rows are confidential.
Colocation cage, own hardware and power contract	Scope 2 for power; Category 8 for the rest	Its own meter readings and utility invoices.
Owned on-premises cluster	Scope 2; Scope 1 for on-site generation	Its own meter readings and fuel records.

The counting rules arrive after the first mandatory reports

The Omnibus directive, Directive (EU) 2026/470⁹, entered into force on 18 March 2026 and narrows the Corporate Sustainability Reporting Directive (CSRD) to companies with more than 1,000 employees and more than €450 million of net turnover¹⁰, reporting on financial years from 2027, a scope cut sharply from the original thresholds¹¹. Those companies file their first statements under the 2011 Scope 3 Standard.

The standard that replaces it is two years behind. On 29 July 2026 the Greenhouse Gas Protocol and ISO announced they will combine the Corporate Standard, the Scope 2 Guidance, the Scope 3 Standard and ISO 14064-1 into one corporate standard¹², with public consultation in the second quarter of 2027 and publication in the fourth quarter of 2028. The Scope 2 consultation that closed in January 2026 proposed an hourly matching and deliverability requirement for market-based reporting¹³, which would tie a clean-power claim to when and where the electricity was used. A vendor’s market-based figure built on annual certificates may therefore read differently in 2029 from how it reads in 2028.

The draft Scope 3 revision points away from the vendor’s corporate average

The direction of travel is already published. The Scope 3 revision’s Phase 1 progress update of March 2026¹⁴ is labelled working draft and subject to change, and three of its proposals bear directly on AI purchasing. Revision A8 would permit allocation of a supplier’s corporate-level emissions only for homogeneous suppliers; a hyperscaler averaging regions with very different generation mixes into one corporate figure is diversified by any reading. Revision B1 would require at least 95 per cent of required Scope 3 emissions to be reported. Revision A2 would ask companies that verify their Scope 3 to label it fully verified, partially verified or not verified. A buyer who builds to those three proposals now loses nothing if they soften, and avoids a restatement if they hold.

Supplier-specific data is the destination, and what vendors publish today shows why the method matters. Google’s measurement of a median Gemini Apps text prompt gives 0.24 watt-hours and 0.03 grams of carbon dioxide equivalent¹⁵. The same page reports 0.10 watt-hours on a narrower boundary counting only active accelerators, calls that boundary an optimistic scenario, and states that the data and claims have not been verified by an independent third party. Ten million prompts a year at the comprehensive figure come to 2.4 megawatt-hours and 300 kilograms of carbon dioxide equivalent. The material exposure sits elsewhere: in dedicated capacity, in agent workloads that chain many model calls per task, and in the gap between a market-based figure and the location-based figure the serving grid produced. An assurance provider reads the boundary and the verification status before the number¹⁶.

Swiss data centres are measured; the compute Swiss companies import is the open line

Domestic consumption is documented and moderate. The Swiss Federal Council reported in May 2026 that data centres used 2.1 terawatt-hours in 2024, about 3.6 per cent of national electricity¹⁷, against 1.77 terawatt-hours and 3.1 per cent in 2019. The base scenario reaches 2.5 to 3.2 terawatt-hours by 2030, and the remaining efficiency potential is put at around 0.8 terawatt-hours.

The AI a Swiss company actually buys often runs in regions far outside that perimeter, and Swiss disclosure law is moving towards it. The Ordinance on Climate Disclosures¹⁸ has applied since 1 January 2024. On 1 April 2026 the Federal Council opened consultation on a Federal Act on sustainable corporate governance that would require the ESRS or an equivalent standard from about 100 companies¹⁹ above 1,000 full-time employees and CHF 450 million of turnover. Swiss groups meet the question sooner wherever an EU subsidiary crosses the CSRD thresholds itself, or an EU customer in scope sends a value-chain data request. An AI contract signed this quarter on a three-year term will still be running when it arrives.

Ten clauses that turn an AI contract into a reportable Category 1 figure

Each clause below asks for data the vendor already files, already measures or already documents for a regulator. That is what makes it negotiable. Together they produce a location-based Category 1 figure that holds through the 2028 standard in either direction, with the market-based figure carried alongside and labelled.

Exhibit 2

The AI supplier-data checklist: ten clauses and what each one delivers

#	Clause	What it delivers, and its basis
1	Execution region, named, with notice before a workload moves	The grid the emissions come from. Every other clause depends on it.
2	Facility indicators per region, as filed each May, shared under NDA	Energy, power usage effectiveness and renewable share. Rows the vendor already files under Regulation 2024/1364.
3	Location-based grid intensity, hourly where held, dataset named	The figure that survives the 2028 standard. Naming the dataset answers the auditor’s first question.
4	Market-based claims itemised: instrument, vintage, deliverability, hourly match	Lets the buyer restate if hourly matching becomes the rule.
5	Customer usage and allocation method: tokens or compute hours per period	Supplier-specific data in place of a corporate average, in line with draft Revision A8.
6	Training compute and energy per model version	The Annex XI points 2(d) and 2(e) figures, which Annex XII leaves out of the downstream package.
7	Verification status on every figure supplied	Fully, partially or not verified, matching draft Revision A2.
8	Delivery date and format tied to the buyer’s reporting calendar	Machine-readable data in time for the inventory close, in place of a sustainability report published months later.
9	Method-change notice with a restated prior year	A comparable baseline through the switch to the consolidated standard in 2028.
10	Flow-down to the cloud operator beneath the model vendor	Reaches the facility that holds the meter when the model vendor rents its compute.

Size the ask to the vendor

The Omnibus directive protects smaller suppliers. Value-chain companies with up to 1,000 employees may refuse requests that exceed the voluntary standard for small and medium-sized enterprises¹⁰. Hyperscalers and the major model providers sit far above that line, so the full checklist applies to the relationships that carry most of the spend. For a forty-person model vendor in Lausanne or Zug, ask for the voluntary-standard data points and estimate the remainder from usage against a published emission factor, with the method documented.

Allocate training energy on the buyer’s own volume

Category 1’s cradle-to-gate boundary places the energy spent training a model upstream of every call sold from it. Clause 6 supplies the numerator. The buyer’s share follows from its own token volume as a fraction of the model’s served volume, where the vendor discloses it, or from a documented proxy where it does not. An assurance provider accepts an allocation it can trace, and the clause makes it traceable.

What to do Monday

• List every AI contract that renews in the next twelve months, including software whose AI features are billed inside a licence. Each renewal is the cheapest moment to add the clauses.
• Open a Category 1 sub-ledger for AI services and move the spend out of general IT, so the inventory for financial year 2027 starts with the boundary already drawn.
• Send Exhibit 2 to the three largest AI vendors as a data request, and record which items each one supplies today.
• Adopt the location-based method as the primary figure, with the market-based figure alongside it and labelled.
• Record a verification status for every input from the first entry, so the trail exists before an assurance provider asks for it.

The contracts a company signs this quarter decide what it can report in 2028. Mezyan reviews AI and cloud contracts against this checklist and maps the result into a Category 1 inventory an assurance provider can follow. Book a Mezyan Scope 3 and supplier-data review to see which of your AI relationships already deliver the data, and which need the clause.

This article has been reviewed by Haider Alleg, Managing Partner at Mezyan Foundation.

References

1. European Union. Commission Delegated Regulation (EU) 2024/1364 on the first phase of the establishment of a common Union rating scheme for data centres. https://eur-lex.europa.eu/eli/reg_del/2024/1364/oj/eng
2. DLA Piper. New data centre sustainability reporting obligations introduced through EU 2024/1364 regulation, September 2024. https://www.dlapiper.com/en/insights/publications/2024/09/new-data-centre-sustainability-reporting-obligations-introduced-through-eu-20241364-regulation
3. Tech Policy Press and Investigate Europe. How Big Tech lobbied the EU to hide data centers’ environmental toll, 17 April 2026. https://techpolicy.press/how-big-tech-lobbied-the-eu-to-hide-data-centers-environmental-toll
4. European Union. Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence. https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng
5. EU Artificial Intelligence Act. Annex XI: Technical documentation for providers of general-purpose AI models. https://artificialintelligenceact.eu/annex/11/
6. EU Artificial Intelligence Act. Annex XII: Transparency information for downstream providers. https://artificialintelligenceact.eu/annex/12/
7. Greenhouse Gas Protocol. Corporate Value Chain (Scope 3) Accounting and Reporting Standard, 2011. https://ghgprotocol.org/sites/default/files/standards/Corporate-Value-Chain-Accounting-Reporing-Standard_041613_2.pdf
8. EFRAG. ESRS E1 Climate change, Commission Delegated Regulation (EU) 2023/2772, Annex I. https://www.efrag.org/sites/default/files/media/document/2024-08/ESRS%20E1%20Delegated-act-2023-5303-annex-1_en.pdf
9. European Union. Directive (EU) 2026/470 amending certain corporate sustainability reporting and due diligence requirements. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202600470
10. PLMJ. CSRD and CS3D reviewed: what changes for businesses under the Omnibus I directive. https://www.plmj.com/en/knowledge/informative-notes/CSRD-and-CS3D-reviewed-what-changes-for-businesses-under-the-Omnibus-I-directive/34396/
11. Mezyan. Sustainability Reporting Just Went Optional for 80% of Companies, and the Winners Are Reinvesting. https://mezyan.ch/sustainability-reporting-optional-innovation-advantage/
12. Greenhouse Gas Protocol. GHG Protocol announces key standard development updates, FAQ resource, 29 July 2026. https://ghgprotocol.org/blog/ghg-protocol-announces-key-standard-development-updates-faq-resource
13. Greenhouse Gas Protocol. GHG Protocol opens public consultations on Scope 2 and electricity-sector consequential accounting, 20 October 2025. https://ghgprotocol.org/blog/release-ghg-protocol-opens-public-consultations-scope-2-and-electricity-sector-consequential
14. Greenhouse Gas Protocol. Scope 3 Standard Revisions: Phase 1 Progress Update, March 2026. https://ghgprotocol.org/sites/default/files/2026-03/S3-Phase1ProgressUpdate-20260331.pdf
15. Google Cloud. Measuring the environmental impact of AI inference. https://cloud.google.com/blog/products/infrastructure/measuring-the-environmental-impact-of-ai-inference
16. Mezyan. Five Questions That Pressure-Test Carbon Data Before a Buyer, Bank, or Auditor Does. https://mezyan.ch/verify-carbon-data-five-questions/
17. Swiss Federal Council. Media release on data centre electricity consumption, 7 May 2026. https://www.admin.ch/de/newnsb/GV-_d7OgIlqjfQDGZqbkN
18. Swiss Confederation. Ordinance on Climate Disclosures, RS 221.434. https://www.fedlex.admin.ch/eli/cc/2022/747/fr
19. LALIVE. The Swiss Corporate Sustainability Act: Federal Council proposes milestone Swiss sustainability legislation, April 2026. https://www.lalive.law/the-swiss-corporate-sustainability-act-federal-council-proposes-milestone-swiss-sustainability-legislation/