The Carbon in the Contract: Auditing SaaS Emissions Claims Before They Reach Your Scope 3 Ledger

UK procurement teams are now routinely asked to supply emissions data for the software they buy. As supply-chain reporting expectations tighten in 2026, vendors have responded with carbon dashboards, net-zero badges and glossy sustainability annexes. The risk is that a polished interface is mistaken for evidence. A dashboard is a presentation layer. The useful procurement question is not whether a vendor has one, but whether the number behind it can survive scrutiny when it enters your Scope 3 ledger.

Begin with the boundary, not the badge

Before comparing suppliers, establish what is being measured. Ask whether the disclosure covers the vendor as a whole, a specific legal entity, a named product or a single data centre region. Check whether it includes offices, data centres, hardware embodied emissions, business travel, purchased cloud services and downstream use. A vendor that reports group-level emissions may be unable to allocate them meaningfully to the service you are buying.

For cloud and software, the boundary question is especially important. Your purchased service may sit in Scope 3 Category 1, while the vendor’s own energy use may be reported under its Scope 1 and 2, and its supply chain under its Scope 3. Without a clear boundary statement, double counting and gaps become difficult to detect. Request the methodology document, not just the summary table.

Test the methodology against recognised standards

A credible vendor should be able to explain whether it follows the GHG Protocol Corporate Standard, the GHG Protocol Product Standard or both. Ask which version is in use, when it was last reviewed and who approved it. For data centre emissions, ask whether figures are location-based or market-based. The distinction matters: market-based accounting can show zero emissions where renewable certificates are purchased, while location-based accounting reflects the actual grid mix.

Request the emission factors used, including their source and vintage. UK buyers should expect references to recognised factors such as those published for UK reporting, or equivalent international datasets where services are delivered abroad. Ask how grid carbon intensity is handled across regions and whether hourly matching is used or annual averages. A vendor claiming a low-carbon service in one region may be relying on a different energy mix from the one serving your contract.

Request the data behind the dial

The minimum evidence pack should include an annual greenhouse gas inventory, a description of data sources, energy consumption by site or service, power usage effectiveness for data centres, hardware refresh assumptions and the allocation formula used for multi-tenant services. If the vendor uses a hyperscaler, ask how provider-level data is translated into service-level figures. The cloud provider’s customer carbon tool is a starting point, not a final answer.

Ask for the raw export, not only the dashboard view. A CSV or API feed with a change log is more useful than a screenshot. Check whether the vendor can provide absolute emissions and intensity metrics, such as kilograms of carbon dioxide equivalent per tenant, per 1,000 transactions or per active user. Intensity metrics are helpful for comparison, but they can flatter low-usage services. Use them alongside absolute figures and a clear denominator.

Challenge normalisation and reduction claims

A common weakness is the reduction claim without a baseline. Ask what changed: workload, region, hardware, renewable procurement or the calculation method itself. A vendor that has moved from annual to hourly renewable matching may report a very different figure without any operational change. That is not necessarily dishonest, but it must be explained.

Be cautious with avoided emissions and customer savings claims. They can be relevant to a business case, but they should not be netted against the vendor’s own footprint. Keep reported emissions, avoided emissions and offsets in separate columns. Otherwise a procurement scorecard starts comparing accounting techniques rather than environmental performance.

Treat offsets and renewable claims as supplementary

Carbon offsets should be disclosed separately and never used to turn a positive emissions figure into zero without a clear audit trail. Ask about the standard used, the vintage of credits, retirement evidence and whether the vendor’s net-zero claim depends on offsets or on actual reductions. For renewable electricity, ask whether certificates are bundled with the energy, how they are matched and whether they are purchased in the same market as the consumption.

A net-zero target date is not evidence of progress. Request interim targets, Board ownership, capital allocation and the vendor’s own assurance status. A credible supplier will be comfortable saying that some data is estimated, provided the estimation method is disclosed and the uncertainty is managed.

Put assurance and contract terms to work

Where a vendor presents emissions data as decision-grade, ask whether it has been assured. Limited or reasonable assurance under recognised standards such as ISAE 3410 or ISO 14064-3 is a stronger signal than an internal review. Check the assurance scope: group-level only, or product-level? A clean opinion on the corporate inventory may say little about the SaaS service you are buying.

Contract terms should require annual data in a usable format, notice of methodology changes, a named contact for sustainability queries and audit rights where the data is material to your reporting. Include carbon data quality in the RFP scoring rather than treating it as a pass-fail annex. If the vendor cannot provide service-level figures, record that as a known limitation in your risk register.

A practical comparison framework

Score vendors across boundary clarity, methodology, data provenance, intensity metrics, renewable treatment, offset disclosure, assurance and contractual commitments. Do not reward the most attractive dashboard. Reward the supplier that can trace a number from meter to ledger.

The greenwash filter is not cynicism. It is the same discipline procurement already applies to financial or security claims. Software carries carbon, and UK buyers should ask for the evidence in the contract, not just the colour scheme.