Scope 3 cloud emissions: what CSRD, SECR and CDP ask for and how to report them

Summary

Why cloud greenhouse gas emissions sit in Scope 3 for customers

The GHG Protocol splits a company's emissions by who owns and controls the source. Scope 1 covers direct emissions from sources you own. Scope 2 covers the electricity, heat and cooling you buy. Scope 3 covers all other indirect emissions in your value chain.

A cloud provider owns the data centres and buys the electricity, so those emissions are its Scope 1 and Scope 2. A cloud customer buys a service, so its share of the same emissions lands in its own Scope 3, under Category 1, purchased goods and services. The same tonne appears in two inventories, in different scopes. That is how the GHG Protocol is designed to work, and it is why the provider's Scope 2 total is no use to you as a customer until it is split down to your usage.

Scope 2 and Scope 3 cloud emissions side by side

Where the rest of your IT emissions go

Cloud is usually the largest piece of CSRD IT emissions, but it is not the only one. For organisations that still run their own data centre, electricity for those servers is Scope 2. Laptops, monitors and servers you buy are capital goods, Category 2. SaaS subscriptions and AI model APIs are bought services, so they also sit in Category 1. Greenpixie's data covers public cloud and AI usage, not devices or on-premise hardware.

Cloud is one of 15 Scope 3 categories in a full emissions inventory. Upstream emissions also include business travel and upstream transportation and distribution. Downstream activities cover what happens after you sell, such as the transport and use of sold products (GHG Protocol). ESRS asks you to screen all 15 categories, so the cloud line sits inside a wider Scope 3 exercise.

What CSRD requires on Scope 3 cloud emissions

Who is in scope now

CSRD scope changed through the EU's Omnibus I simplification package. As of 3 November 2026:

• The Omnibus I Directive was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026. Member States have until 19 March 2027 to put the CSRD changes into national law (Directive (EU) 2026/470, Articles 5 and 6).
• CSRD now applies to EU companies and groups with an average of more than 1,000 employees and net turnover above €450 million. Non-EU groups are in scope with more than €450 million EU net turnover in each of the last two consecutive financial years and an EU subsidiary or branch with net turnover above €200 million (Directive (EU) 2026/470, Article 2).
• Wave one companies, the first to report under CSRD for financial year 2024, stay on the original scope only for financial years starting between 1 January 2024 and 31 December 2026. The new thresholds apply to them from financial years starting on or after 1 January 2027, and Member States may exempt those below the new thresholds for financial years 2025 and 2026 (Directive (EU) 2026/470, Article 3).
• Other in-scope companies start with financial years beginning on or after 1 January 2027, after the 2025 “stop-the-clock” directive postponed later waves (Directive (EU) 2026/470, Article 3(1); European Commission). Their first reports cover financial year 2027 and are published in 2028.
• Assurance stays at limited assurance. The requirement to adopt reasonable assurance standards was removed, and limited assurance standards are due to be adopted by 1 July 2027 (Directive (EU) 2026/470, recital 5 and Article 1(3)).

National transposition is still under way, so the reporting requirements in your country may not be final yet. At the end of October 2026, France and Italy had transposed the original CSRD, while Germany, the Netherlands and Spain had not. Only three of the 24 countries tracked had transposed the Omnibus I changes, which are due by 19 March 2027 (Linklaters transposition tracker). More on the directive in our CSRD glossary entry.

What ESRS E1 asks for

Companies report against the European Sustainability Reporting Standards (ESRS). The revised ESRS were adopted on 3 July 2026 with over 60% fewer mandatory datapoints (European Commission, July 2026). They were published as Delegated Regulation (EU) 2026/1563 on 21 September 2026, enter into force on 10 November 2026, and are mandatory for financial years from 1 January 2027. For 2026, companies can choose the old or new version (PwC, September 2026).

The climate standard, ESRS E1, still asks for gross Scope 1, Scope 2 and Scope 3 GHG emissions (EFRAG ESRS Knowledge Hub). For CSRD Scope 3 cloud reporting, the parts that matter are:

• Scope 2 is reported both location-based and market-based (paragraph 30(a)(ii)).
• Scope 3 is reported for each significant category, as total emissions and per category (paragraph 30(a)(iii)), after screening all 15 categories with estimates (AR 24(b)).
• Significance is judged on the size of the estimated emissions, and can also take in spend, influence, transition risks and stakeholder views.
• Where relevant, GHG emissions from purchased cloud computing and data centre services are disclosed as a subset of Category 1 (AR 24(g)). The optional Scope 3 table in AR 26 has a sub-line for cloud computing and data centre services.
• Inputs are prioritised by data quality, with data from specific activities in the value chain preferred.

Estimates are allowed for value chain data. For the first three years, a company that cannot get all the value chain data it needs must explain its efforts, why the data is missing and its plan to get it (PwC). The value chain cap that protects suppliers with up to 1,000 employees does not cover the E1 Scope 1, 2 and 3 metrics (Cooley, July 2026).

For a company with a large cloud bill, CSRD Scope 3 Category 1 will often be significant, and cloud is the line within it that engineers can change month to month.

UK SECR, UK SRS and CDP

SECR cloud computing emissions

Under UK SECR, quoted companies report global Scope 1 and 2 emissions, energy use and an intensity ratio. Large unquoted companies and LLPs report UK energy use and emissions from gas, electricity and transport fuel. Most Scope 3 disclosure is voluntary (DESNZ, October 2023). Public cloud is a bought service, so SECR does not require you to report it. Many UK businesses include it voluntarily. SECR already asks for the methodology behind reported figures, so state how the cloud number was produced.

SECR may change. The government's corporate reporting consultation, open until 30 November 2026, says the Department for Energy Security and Net Zero (DESNZ) will consult later in 2026 on longer-term options to reform SECR (Department for Business and Trade, September 2026). The UK Sustainability Reporting Standards, UK SRS S1 and S2, were finalised in February 2026 and are voluntary for now (GOV.UK). UK SRS S2 asks for Scope 3 across all 15 GHG Protocol categories, but the standard itself lets companies leave Scope 3 out, subject to any rules set by the FCA or in law (UK SRS S2, paragraphs B32 and C4). For listed companies, the FCA's final rules require UK SRS reporting on a comply or explain basis for accounting periods starting on or after 1 January 2027, with first reports in 2028 and one year of relief for Scope 3 (FCA PS26/19, September 2026).

CDP cloud emissions disclosure

CDP is voluntary, but for many suppliers it is the request that arrives first. Through CDP's supply chain programme, more than 45,000 suppliers were asked to disclose in 2025 by over 200 member organisations (CDP). CDP's climate questionnaire asks for gross global Scope 3 emissions in question 7.8 (CDP, 2026). For each of the 15 categories, you give an evaluation status, the emissions, the calculation method and the share calculated from supplier data (CDP Module 7 guidance). There is no separate line for cloud, so it is reported within Category 1, and a cloud figure built for CSRD can be reused for CDP cloud emissions disclosure.

How to calculate Scope 3 cloud emissions

Spend data or usage data

Many organisations start on Scope 3 purchased services in the cloud by multiplying the cloud bill by a spend-based emission factor, a figure of CO2e per euro spent on computer services. It is quick, but the result follows price. A committed-use discount cuts spend without cutting energy, so the estimate falls while your carbon emissions stay the same. Two regions at the same price can run on very different grids, and a spend-based figure cannot tell them apart. Rightsizing an instance cuts both, but by different amounts.

Usage-based (activity-based) methods start from the cloud services you actually ran: instance hours, storage, data transfer, region and time. That is the data auditors can trace back to your billing records, and it moves when engineers change something. The GHG Protocol's draft Scope 3 revisions propose reporting spend-based figures separately from activity-based ones, to make the difference visible (GHG Protocol, March 2026).

Working out your cloud carbon footprint for Scope 3

A usage-based cloud carbon footprint is built in layers. First comes energy usage: the electricity drawn by the servers, storage and networking behind each unit of usage. That is multiplied by the power usage effectiveness (PUE) of the data centre, which adds the overhead of cooling and power distribution across the infrastructure. Grid emissions factors for that region then turn energy consumption into carbon emissions. Together these are the operational emissions. Embodied emissions from making the hardware sit on top: at minimum the cradle-to-gate emissions of manufacturing, spread over the hardware's working life. Greenpixie's calculation methodology follows these steps and adds allowances for transport and end-of-life (Greenpixie Cloud methodology, section 7). Whichever data source you use, keep the emissions calculations consistent year to year so the trend means something.

Which Scope 2 method sits behind the number

ESRS E1 asks for both bases for your own Scope 2, but it does not prescribe a basis for the cloud subset of Category 1, so state which basis your figure uses. Provider dashboards often show market-based figures, which can fall when the provider buys renewable energy certificates even if the grid behind your workloads is unchanged. A location-based figure moves only when usage, region or timing changes. Greenpixie reports usage emissions on a location-based basis, by region and hour, and its methodology states those factors should not be combined with certificates to make a market-based figure. The GHG Protocol is revising its Scope 2 rules, with a consolidated public consultation planned for Q2 2027 (GHG Protocol, October 2026).

What the GHG Protocol says about cloud computing

The GHG Protocol Scope 3 Standard, released in 2011, is still the reference for Scope 3 and the one ESRS E1 points to (GHG Protocol). For product carbon footprints of ICT services, the GHG Protocol ICT Sector Guidance, written by the Carbon Trust and GeSI in 2017, has a chapter on cloud and data centre services (GHG Protocol). Neither sets per-service factors, so GHG Protocol Scope 3 cloud computing figures still depend on the data source you choose.

What auditors will look for

Limited assurance is lighter than a financial audit, but the reviewer will still want to follow the number from source to disclosure. For cloud emissions data for ESG reporting, expect questions on:

• Boundary: which cloud providers (AWS, Azure, Google Cloud), accounts, regions and AI services are included, and what is left out.
• Method: whether the figure is spend-based or usage-based, which factors were used, and whether the method is published.
• Data lineage: whether the figure reconciles to billing records for the same period.
• Consistency: whether the method and boundary match last year, and how any change is explained.
• Estimates: where figures are modelled, how uncertainty is described, and what is being done to improve coverage.
• Third-party checks: whether the data provider's method has been independently verified.

Customer carbon data requests to SaaS suppliers

If you sell software, your cloud bill is likely your largest emissions source, and your customers' Category 1 includes a share of it. Customer carbon data requests to SaaS suppliers now arrive through CDP, procurement questionnaires and contract clauses, as buyers build out their supply chain carbon reporting. A good answer gives each customer their share of your cloud emissions, the allocation key you used (users, seats, transactions or compute), the method behind it and the reporting period.

Under the Omnibus value chain cap, a supplier with an average of up to 1,000 employees can decline to provide information beyond the EU voluntary standard for SMEs, known as the VSME (Commission Recommendation (EU) 2025/1710). The reporting company can rely on the supplier's own declaration of its size, and must tell these suppliers which requested information goes beyond the voluntary standard and that they can decline it (Directive (EU) 2026/470, Article 2(4)). Smaller SaaS firms can decline requests beyond the VSME, but most will still want to answer their customers to win and keep enterprise deals.

How Greenpixie's data fits

GPX Cloud adds environmental impact data (energy, carbon and water) to billing data from the major cloud providers, AWS, Azure and Google Cloud, line by line. It works from your Cost and Usage Report or FOCUS export, maps each SKU to the hardware behind it and estimates electricity, location-based usage emissions, embodied emissions and water consumption for each unit of usage (Greenpixie Cloud methodology, section 11). Because it sits next to your cost data, the same dataset can feed your CSRD Category 1 cloud line, your CDP response and the per-customer figures your own customers ask for. AI usage can be reported alongside it with GPX AI.

The figures are usage-based estimates, not meter readings. The methodology has been independently verified in accordance with ISO 14064-3, prepared with reference to ISO 14064-1, and designed to be in line with the GHG Protocol Corporate Standard. That verification covers the cloud methodology; GPX AI's per-token layer builds on these verified factors and is validated against independent research and metered energy data.

The same data helps cut cost. At Mastercard, Greenpixie data enabled $2M in cloud cost reductions, and Mastercard exceeded its cloud carbon reduction target. More on running that kind of programme in our GreenOps guide.

Where a workload runs changes its footprint more than most teams expect. In Greenpixie's data (November 2026), the same AWS m5.12xlarge instance running all year produces about 620 kg CO2e in Hong Kong (ap-east-1) and 284 kg in Spain (eu-south-2), 54% less. A spend-based estimate can't see that difference, because it works from what you paid, not where the workload ran.

Frequently asked questions

Are cloud emissions scope 2 or scope 3?

For the cloud provider, data centre electricity is Scope 2. For the customer buying the service, the same emissions are Scope 3, usually Category 1, purchased goods and services. Only electricity for servers you run yourself is your Scope 2.

Does CSRD require scope 3 cloud emissions reporting?

If you are in scope and Category 1 is significant, yes. Revised ESRS E1 asks for each significant Scope 3 category and, where it applies, for purchased cloud computing and data centre services shown as a subset of Category 1.

What scope 3 category is cloud computing?

Category 1, purchased goods and services. Upstream fuel and grid losses linked to that electricity can be reported under Category 3, fuel and energy-related activities.

How do data centers affect scope 3 cloud emissions?

Through the grid they draw on and how efficiently they run. The same cloud services carry much lower emissions in a region with a low-carbon grid than in one that relies on fossil fuels, and a data centre with a lower PUE spends less energy on cooling and power distribution. Usage-based data picks up both effects. Spend-based data picks up neither.

Do I need to report cloud computing emissions under SECR?

No. SECR covers Scope 1 and 2 and energy use, and most Scope 3 is voluntary. You can include cloud voluntarily, with a note on the method.

How should a SaaS company answer customer carbon data requests?

Give each customer their share of your cloud emissions, the allocation key, the method and the period. Usage-based data makes the share easier to defend than a split of your total spend.

Can I use my cloud provider's carbon dashboard for CSRD?

You can, whether it comes from AWS, Azure or Google Cloud, but check how it builds your carbon footprint: its granularity, its Scope 2 basis and how it treats embodied emissions, and disclose those choices.

Sources

1. European Commission: Corporate sustainability reporting (updated 3 July 2026)
2. European Commission: Commission adopts revised sustainability reporting standards (3 July 2026)
3. EFRAG ESRS Knowledge Hub: ESRS E1 Climate Change, delegated act version (accessed 3 November 2026)
4. PwC: ESRS (2026), a deep dive into the revised standards (9 July 2026, updated 24 September 2026)
5. Cooley: European Commission adopts revised EU CSRD reporting standards (21 July 2026)
6. Directive (EU) 2026/470, Official Journal, 26 February 2026
7. GHG Protocol: Corporate Value Chain (Scope 3) Standard (2011)
8. GHG Protocol: ICT Sector Guidance, Carbon Trust and GeSI (July 2017)
9. GHG Protocol: Scope 3 Standard revisions, Phase 1 progress update (31 March 2026)
10. GHG Protocol: Scope 2 market-based method update (16 October 2026)
11. DESNZ: Scope 3 emissions in the UK reporting landscape, call for evidence (October 2023)
12. Department for Business and Trade: Modernising corporate reporting consultation (7 September 2026)
13. GOV.UK: UK Sustainability Reporting Standards (updated 25 February 2026)
14. GOV.UK: UK SRS S2 Climate-related Disclosures (25 February 2026)
15. FCA: PS26/19, Aligning listed issuers' sustainability disclosures with international standards (30 September 2026)
16. Linklaters: EU CSRD and Omnibus I transposition tracker (latest entry 22 October 2026, accessed 3 November 2026)
17. CDP: Supply chain (accessed 3 November 2026)
18. CDP: Disclosure 2026, bite-sized questionnaire guidance (2026)
19. CDP: Full Corporate Questionnaire, Module 7 reporting guidance (April 2025)
20. Greenpixie Cloud methodology: 11. Outputs and Interpretation
21. Greenpixie Cloud methodology: Assessment and calculation (section 7)