MICKAI®ArticlesCSRD Still Applies to Pharma in 2…
Article · 28 July 2026

CSRD Still Applies to Pharma in 2026: Compile Scope 3 Emissions Without Cloud Consultants

Compile the footprint and draft the disclosure on your own hardware, with supplier data kept out of third party cloud.

Author
Micky Irons
Published
28 July 2026
Follow Micky Irons
LinkedInX
csrdscope-3-emissionspharmaesg-reportingon-premise-ai
CSRD Still Applies to Pharma in 2026: Compile Scope 3 Emissions Without Cloud Consultants

Pharma groups still in the first CSRD wave can compile Scope 1, 2 and 3 emissions and draft the disclosure on their own hardware, with no ESG software subscription and no consultant retainer running underneath. The footprint is computed against curated factor packs and the evidence trail is sealed on premise, so supplier data never leaves the building, and the meters you pay per user, per supplier and per consultant hour simply stop.

Pharma CSRD Scope 3 reporting did not disappear in 2026

The Omnibus package raised the size thresholds and, by industry reporting, cut the population of companies inside CSRD by around eighty per cent. That is a real change, and it moved many mid sized suppliers out of direct scope. It did not switch the regime off for large pharma. Groups caught in the first reporting wave that still sit above the revised thresholds, broadly more than 1,000 employees and turnover above the new revenue floor, keep reporting, and the 2026 filing still covers the prior financial year. Limited assurance is retained from the first year of application, so the numbers still have to stand up to an auditor.

For a pharmaceutical company the hard part was never Scope 1 and 2. It is Scope 3: purchased goods and services, upstream logistics, active ingredient and excipient supply, contract manufacturing at CDMOs, business travel, and the use and end of life of sold product. Most of that data sits with suppliers, not with you, and much of it is commercially sensitive.

What Scope 3 costs a pharma group today

Today the same compile is usually assembled from three overlapping spends. First, an ESG reporting platform on subscription, priced per user and per reporting entity. Second, a carbon accounting engine that holds the emission factors and does the calculation, often metered on data volume or supplier count. Third, a consultancy that reconciles the two, chases the supplier questionnaires and writes the narrative, billed by the hour or on an annual retainer.

Industry reporting puts the cost of a first full CSRD cycle for a large group well into six and seven figures once software, assurance readiness and external advisory are added together. Beyond the invoice there is a quieter cost: every one of those tools ingests your supplier list, your procurement spend and your site energy data into a third party cloud. For a group that treats its supply chain and formulation footprint as confidential, that is the part that does not sit well.

How Gaia compiles the footprint on your own hardware

Gaia is our sustainability studio, a ready made application for the sustainability and ESG function that runs inside the same on device system as the rest of the business, on the customer's own hardware, offline. It computes Scope 1, 2 and 3 against curated factor packs, rolls up the ESG metrics, drafts the CSRD and disclosure narrative, and seals the working to a signed audit record as it goes.

The compile runs where your data already lives. Procurement spend, site meter readings, fleet and travel records and supplier returns are read locally. Gaia maps each line to an activity, applies the matching factor from a versioned factor pack, and shows its working: which factor, which version and which method, for every figure. The Assistant that drafts the narrative runs on the company's own brain, built on the company's own data, so it can reference the actual numbers rather than a generic template. Nothing about the supply chain is uploaded to produce the answer.

  • Read procurement spend, site energy meters, fleet and travel data and supplier returns from local systems, with no upload.
  • Map each activity line to the correct Scope 1, 2 or 3 category and apply the matching factor from a versioned, curated factor pack.
  • Compute each category and the total footprint, showing the factor, its version and the method behind every number.
  • Draft the CSRD and ESRS aligned narrative with the Assistant running on the company's own brain, citing the figures it just computed.
  • Seal each calculation and drafting step to the Open Audit Record so an assurer can trace it back to source.

The evidence trail a limited assurance auditor can follow

Limited assurance means an auditor samples your figures and expects to trace each one back to a source and a method. Gaia is built for that trace. Every calculation, every factor version and every drafting step is sealed under post quantum cryptography into the Open Audit Record, a signed, tamper evident log of what was computed, from what input, using which factor and when. When the assurer asks how a Scope 3 category was derived, the answer is a record, not a spreadsheet rebuilt after the fact.

Two honesty points matter here. Gaia produces a reported footprint with shown factors and method, not an assured figure: the assurance opinion is the auditor's to give, and the studio's job is to make that opinion faster to grant. And the same evidence trail supports the external limited assurance the directive requires, it does not stand in for it.

What you replace, and what you save

What you run todayWhat it costs youWith Mickai
Workiva ESG for disclosure managementSubscription per user and per reporting entityDisclosure drafted and versioned inside Gaia, on your hardware
Watershed or Persefoni carbon accountingMetered on data volume and supplier countScope 1, 2 and 3 computed locally against curated factor packs
SAP Sustainability for footprint dataLicence per module and per seatSame footprint rolled up inside the sovereign system, no new licence
ESG consultancy retainerBilled by the hour or on an annual retainerFactor mapping and narrative drafted in house, consultant hours cut to review
Supplier data sent to a vendor cloudYour supply chain data leaves your controlSupplier and formulation data stays on premise, nothing uploaded

Frequently asked questions

Does CSRD still apply to our pharma group after the 2026 Omnibus changes?

If your group was in the first reporting wave and still sits above the revised thresholds, yes. The Omnibus raised the size thresholds and moved many smaller companies out of direct scope, but wave one groups that remain in scope keep reporting prior year data in 2026, and limited assurance is retained from the first year. Gaia is built to compile that report whether you are directly in scope or answering a customer's Scope 3 request as a supplier.

Can we compile Scope 3 without sending supplier data to a cloud vendor?

Yes. Gaia runs offline on your own hardware. Procurement, energy and supplier data are read locally, the factors sit in curated packs on the same machine, and the compute happens on premise. Nothing about your supply chain is uploaded to produce the footprint.

Does Gaia give us an assured, audit ready number?

Gaia produces a reported footprint with shown factors and method, and a sealed evidence trail that an assurer can trace. It does not issue the assurance opinion itself, that remains the external auditor's job. What the studio does is make limited assurance quicker to grant by showing its working for every figure.

What exactly stops costing us money?

The subscription meters stop: per user ESG platform seats, per supplier carbon accounting volume, per module sustainability licences, and the consultant hours spent assembling and reconciling the data. You keep the review, drop the assembly, and the recurring software spend moves in house.

Subscribe
Get every new Mickai article by email.

Long-form essays on sovereign AI from Micky Irons. One email per article. No tracking, no marketing, no third parties. Every email includes a one-click unsubscribe link.

Prefer RSS? Subscribe at /articles/feed.xml.

Originally published at https://mickai.co.uk/articles/pharma-csrd-scope-3-sustainability-onprem. If you operate in a regulated sector or want sovereign AI on your own hardware, the audit form on mickai.co.uk is the entry point.
More articles
14 Aug 2026
How to Meet NIS2 Without Splunk Scale SIEM Bills: A Sovereign Security Operations Studio
You can meet NIS2 on hardware you own and stop paying a per gigabyte SIEM bill at the same time. Phylax runs the security operations centre on premise with no data volume charge, moving the NIS2 compliance cost from a rising subscription into one owned system.
14 Aug 2026
Only 15 Percent of Companies Can Run Agentic AI: Close the Readiness Gap Without a Consultancy Bill
Only about 15 percent of companies can run agentic AI in production. You can close the AI readiness gap 2026 on your own hardware, with Forge and Vault running the readiness pass and Omni standing the Assistant up on your own data, so the budget buys a system you keep rather than a consultancy slide deck.
13 Aug 2026
The Average Company Runs 275 SaaS Apps and Wastes Half the Licences: Consolidate to One Owned System
SaaS sprawl consolidation in 2026 means moving the business functions you rent as separate subscriptions onto one system you own, running offline on your own hardware with no per seat meter, so recurring licence spend becomes a single owned cost.
13 Aug 2026
CSRD After the 2026 Omnibus: Fewer Datapoints Still Need an Assured Evidence Trail
The CSRD Omnibus 2026 cut mandatory datapoints by roughly 61 percent, yet the figures that remain still need a limited assurance evidence trail. Gaia computes Scope 1, 2 and 3 and seals that trail on your own hardware, so the work moves in house instead of into annual ESG platform fees.