AI for ESG Risk and Reporting: What Changed in 2025-2026 and Where AI Helps

ESG reporting rules changed more between 2025 and 2026 than in the five years before. The EU cut the scope of its flagship reporting law by an estimated 80%. The US federal climate disclosure rule died before taking effect. California's state laws went ahead, one of them now held up in court. And EU rules on green marketing claims that tighten what companies can say about their products apply from 27 September 2026.

For sustainability and finance teams, this means sorting out which obligations actually apply before investing in tools. Where they do apply, AI is useful for the unglamorous parts of the work: classifying spend, reading supplier documents, and checking claims against evidence. This guide covers both.

Where the rules stand in September 2026

Many companies that spent 2024 preparing for CSRD now fall outside it. Some still face it indirectly because large customers subject to CSRD or SB 253 need Scope 3 data from their suppliers, and that request arrives regardless of the supplier's own obligations.

Scope 3: where most of the work and most of the AI value is

For most companies, Scope 3 (emissions in the value chain, across the 15 categories of the GHG Protocol's Scope 3 Standard) is the largest part of the footprint and the hardest to measure. There are two broad methods:

• Spend-based. Purchase amounts multiplied by an emission factor per dollar for each category, often from environmentally extended input-output data such as the US EPA's supply chain emission factors. Fast and complete, but crude.
• Activity-based or supplier-specific. Actual quantities (tonnes of steel, kilometres shipped, kWh used) multiplied by specific factors, or emissions data reported by suppliers directly. More accurate and more work.

A worked example

A manufacturer spends $2 million a year on packaging. With a spend-based factor of 0.35 kg CO2e per dollar (illustrative; real factors vary widely by category and dataset), that is:

$2,000,000 × 0.35 kg = 700,000 kg, or 700 tonnes CO2e

Now the company gets supplier-specific data from its two largest packaging suppliers, which account for $1.4 million of the spend. One uses high recycled content and reports 0.20 kg per dollar; the other reports 0.40 kg.

• Supplier A: $800,000 × 0.20 = 160 tonnes
• Supplier B: $600,000 × 0.40 = 240 tonnes
• Remaining $600,000 at the spend-based 0.35 = 210 tonnes
• Total: 610 tonnes, 13% lower than the spend-based estimate

The difference matters less than what it shows: the company can now reduce emissions by shifting volume toward Supplier A, a choice the spend-based number could never reveal. A spend-based estimate only moves when spending changes, so it cannot reflect better suppliers or materials.

Where AI helps here

• Classifying spend. Mapping tens of thousands of purchase lines and invoice descriptions to emission factor categories is tedious and error-prone. Language models do it well, with a person reviewing the high-spend and low-confidence lines.
• Reading supplier documents. Extracting quantities, product types, and reported emissions from PDFs, certificates, and supplier questionnaires.
• Prioritizing supplier engagement. Ranking suppliers by estimated emissions to show where requesting primary data would change the total most. Usually a small share of suppliers accounts for most of the footprint.
• Checking consistency. Flagging year-on-year jumps, unit errors (kWh versus MWh is a classic), and factors applied to the wrong category.

What AI should not do is produce the emission factors themselves. Factors need a documented, recognized source, and auditors will ask for it.

Greenwashing: the rules just got specific

The EU's Empowering Consumers for the Green Transition Directive applies from 27 September 2026. Among other things it:

• Bans generic environmental claims such as "eco-friendly," "green," or "climate friendly" unless the company can show recognized excellent environmental performance relevant to the claim
• Bans claims that a product has a neutral, reduced, or positive climate impact based on carbon offsetting
• Bans sustainability labels that are not based on a certification scheme or set by public authorities
• Restricts claims about the whole product when the benefit applies only to part of it

In the UK, the Digital Markets, Competition and Consumers Act gave the Competition and Markets Authority power from April 2025 to fine companies up to 10% of global turnover for consumer law breaches, which include misleading green claims.

AI is useful here as a first-pass reviewer: scanning product pages, packaging copy, ads, and reports for environmental claims, then matching each to the evidence file behind it. Claims without evidence, or with evidence that only supports a narrower statement, go to legal review. This is a checking job, with a person making the final call.

Supplier and site risk monitoring

Screening news, sanctions lists, enforcement databases, and NGO reports for issues at suppliers (labor violations, spills, permit breaches) is another good use. The volume is too large to read manually, and language models handle many languages. Two cautions: news-based signals produce false positives, so they should trigger a review, not an automatic supplier decision; and for companies that will fall under CSDDD in 2029, the process needs documentation that shows how risks were identified and acted on. Our guide to AI in supply chain finance covers supplier data in more depth.

Physical climate risk

Models that estimate flood, heat, water stress, and wildfire exposure for specific sites are now widely available from commercial providers. They are useful for insurance, capital planning, and site selection. Treat outputs as scenarios with wide uncertainty, and check which emissions pathway and time horizon each model assumes before comparing results from different vendors.

Keeping it auditable

SB 253's text calls for limited assurance on Scope 1 and 2 beginning in 2026, though CARB has said it will not require it for the first report, and CSRD reports are assured. Anything AI touches in the reporting chain needs:

• A link from every reported number back to a source document or meter reading
• A record of which factor, from which dataset and version, was applied
• Human review of AI classifications above a materiality threshold
• Version control on calculation logic, so last year's numbers can be reproduced

Generative AI data governance and cloud data governance cover the data controls behind this.

Where to start

1. Confirm your obligations under the post-Omnibus CSRD scope, SB 253 and SB 261, and customer contracts that require emissions data.
2. Get Scope 1 and 2 right first, from utility bills and fuel records, with document links.
3. Build a spend-based Scope 3 baseline, using AI to classify spend and a person to review the largest categories.
4. Request primary data from the suppliers that dominate the total.
5. Audit your environmental claims against the EU rules that apply from 27 September 2026.

For ESG from the investor's side, see ESG investing. For how compliance automation fits with other regulatory work, see AI regulatory compliance.

This guide is for informational purposes only and is not legal advice. ESG rules and litigation are changing quickly; confirm current requirements with qualified advisors.