Sustainability and Carbon Footprint for Technology Companies: What You Can Measure, and What You Can Say

Technology companies now face two separate problems that are easy to conflate. The first is measurement — software has a real and rapidly growing energy footprint, mostly in infrastructure you do not own. The second is communication — what you are permitted to say about it, which has become one of the most tightly policed areas of business claims in the UK and EU.

Getting the first right and the second wrong is a common and expensive combination. This article covers what is actually measurable for a software business, what ISO 14001 does and does not certify, and where the current claims boundaries sit.

---

---

Why this became a technology problem

For most of the industry’s history, software was treated as environmentally weightless. That assumption is no longer defensible, and the numbers explain why.

The International Energy Agency reports that global data centre electricity demand grew by 17% in 2025, with electricity consumption from AI-focused data centres surging 50% in the same year. Its central projection sees data centre consumption roughly doubling from 485 TWh in 2025 to around 950 TWh by 2030 — approximately 3% of total global electricity demand, and slightly more than Japan’s entire current consumption.

The growth rate is the striking part. The IEA calculates data centre electricity consumption growing around 15% per year to 2030, more than four times faster than electricity consumption growth across all other sectors combined. In the United States, it projects data centres accounting for nearly half of all electricity demand growth between now and 2030.

The efficiency trap

Writers often overlook this nuance, but it matters when they prepare a sustainability statement.

The IEA notes that power consumption per AI task has been declining rapidly — by at least an order of magnitude annually in recent years, a rate it describes as unprecedented in energy history. That is a genuine engineering achievement.

It is also not a reduction in footprint. Demand has grown faster than efficiency has improved, so carbon intensity per unit of compute is falling while absolute emissions rise.

The practical consequence for claims: “our platform is more efficient per transaction” and “our platform’s emissions are falling” are different statements, and only one of them is likely to be true. Regulators assess the impression created, not the literal wording.

---

What ISO 14001 actually certifies

This is the most common misconception in technology sustainability messaging, and correcting it is worth more than any claim you could make.

ISO 14001 certifies an environmental management system — a framework for identifying, managing and improving environmental impacts. It does not certify environmental performance.

Certification bodies state this plainly. BM Certification describes the standard as one that “does not set specific environmental performance requirements and can therefore be used at any stage of an organization’s environmental management.” ASQ describes it as providing “a framework that an organization can follow, rather than establishing environmental performance requirements.”

On carbon specifically, Greenly notes that ISO 14001 “does not specifically require carbon footprint measurement,” although it does require organisations to identify and manage significant environmental aspects — which for many organisations includes greenhouse gas emissions.

So an ISO 14001 certificate tells a buyer that you have a system, that it was independently audited, and that you are committed to continual improvement. It does not tell them your emissions are low, falling, measured, or offset.

Why this matters commercially. Presenting ISO 14001 as evidence of carbon credentials creates an implied claim that the certificate does not support. Implied claims are within scope of UK and EU rules exactly as express ones are, and a buyer’s technical team will spot the gap. Stating what the certificate covers, accurately, is both safer and more credible than letting it imply more.

ISO 14001:2026 — what changed

ISO published ISO 14001:2026 on 15 April 2026, replacing the 2015 edition and incorporating the climate change amendment issued in 2024. The stated aim was to clarify existing requirements while limiting new ones, and to align with ISO’s Harmonized Structure.

The main changes reported by certification bodies:

• Broader environmental context. Climate change is now in the standard itself rather than as an amendment, and the context analysis extends to other environmental conditions including pollution levels, biodiversity and availability of natural resources.
• Restructured risk and opportunity requirements.
• Strengthened life cycle perspective in the environmental aspect process.
• A new change management clause — reported as clause 6.3, and described as the most significant addition.
• Wider operational control scope, extending from “outsourced processes” to “externally provided processes, products and services.”
• Substantially extended guidance across several clauses.

Transition: three years. Certificates issued against ISO 14001:2015 must transition to the 2026 edition before approximately May 2029 to remain valid. Confirm exact arrangements with your certification body, as the International Accreditation Forum sets the formal timeline.

The revision is widely described as evolutionary rather than structural. Organisations with a functioning 2015 system are refining it rather than rebuilding.

---

What you are permitted to say

This is where technology companies most often create exposure, and the enforcement position has changed materially in the past eighteen months.

The UK

The Digital Markets, Competition and Consumers Act 2024 came into force on 6 April 2025. Under it, the Competition and Markets Authority can investigate a business, determine that consumer protection law has been breached, and impose a financial penalty of up to 10% of global annual turnover — without court proceedings.

The CMA has been explicit that environmental claims are a priority for those powers, and that its Green Claims Code, published in 2021, sets the yardstick. The Code is guidance rather than law, but the CMA’s stated position is that its long availability means there is no longer an excuse for not knowing the rules.

On 22 January 2026 the CMA published further guidance on environmental claims across supply chains. White & Case’s analysis notes two points that matter for any company reselling or integrating third-party technology: any company that repeats, relies on or disseminates a misleading claim may face enforcement, and businesses cannot rely blindly on supplier assurances but are expected to take reasonable steps to verify.

That second point is directly relevant to software companies, because most of your footprint claims will rest on your cloud provider’s data rather than your own measurements.

The EU

The Empowering Consumers Directive applies in member states from 27 September 2026. Among its provisions is a ban on claiming a product or service is “climate neutral” or “climate positive” where the claim rests on carbon offsetting.

Organisation-level carbon neutrality claims remain possible under strict conditions, but the product-level offset route closes.

What follows practically

Three rules cover most of the risk for a technology business.

Be specific about scope. “We measured our Scope 1 and 2 emissions for the 2025 financial year using the GHG Protocol” is verifiable. “We are a sustainable company” is not, and unqualified claims of that kind are among the highest-risk category.

Separate measurement from offsetting. These are different activities supporting different claims. Measuring a footprint is a factual exercise. Purchasing credits against it is a transaction. Conflating them — or implying that the second cancels the first — is where most enforcement risk sits.

State what a certificate covers. If you hold ISO 14001, say it certifies your environmental management system. Do not place it where a reader will infer it certifies your emissions.

---

What is actually measurable for a software business

Most technology companies find their footprint concentrated in a place they do not control.

Scope 1 — direct emissions from owned sources. For a software business, usually minimal: company vehicles if any, on-site fuel combustion.

Scope 2 — purchased electricity. Offices, and any infrastructure you run yourself.

Scope 3 — everything else in the value chain. For most software companies this is the largest category by a wide margin: cloud infrastructure, employee devices, business travel, commuting, purchased software and services, and the emissions embodied in hardware you buy.

The practical difficulty is that the largest component sits with your cloud provider, and provider-reported figures vary in methodology and completeness. One analysis of hyperscaler disclosures notes that most buy renewable energy certificates against operational electricity while disclosed Scope 2 emissions continue rising, because growth outpaces clean energy procurement.

That is not a reason to avoid measuring. It is a reason to state your methodology and its limits when you publish a number, and to avoid claims that depend on a supplier’s figure being more precise than it is — which is also what the CMA’s supply chain guidance expects.

---

Where KastHunt stands

We are applying the above to ourselves, and it is worth being precise about what we can and cannot say.

Our board-approved Carbon Reduction Plan 2025–2040, signed in June 2026, establishes a baseline of 4.22 tCO₂e for our first operational year, October 2025 to September 2026, calculated in accordance with the GHG Protocol Corporate Accounting and Reporting Standard using Central Electricity Authority of India and UK Government DESNZ conversion factors.

The composition is unusual for a technology firm, and mostly for reasons of geography rather than virtue. Scope 1 is zero — no vehicles, no fuel combustion, no refrigerants. Scope 2 is 2.31 tCO₂e, roughly 55% of the total, from 2,820 kWh of office electricity. Scope 3 is 1.91 tCO₂e, of which employee commuting is 0.90, devices 0.58, cloud computing 0.30, purchased services 0.08 and waste 0.05. Business travel was zero for the period.

We have not purchased carbon offsets, and we do not describe our operations or services as carbon neutral. The plan commits to Net Zero by 2040, defined as reducing absolute emissions by at least 90% against the 2025–26 baseline, with any residual emissions addressed only through certified, independently verified removals. No offsetting exists yet because no residual emissions requiring it exist yet.

How we are reducing it

The honest starting point is that our baseline is low for reasons we did not engineer. Shimla sits at over 2,200 metres, so the office needs no air conditioning and little heating. The team commutes by bus or on foot because that is how the city works. Those two facts account for most of the difference between our footprint and that of a comparable firm in a warmer, more car-dependent location.

What we are doing about the part we control falls into three groups.

Energy is the largest single line at 55% of the total, so it is the first target: a renewable tariff from the state electricity board, and a rooftop solar feasibility study, which together address most of Scope 2.

Compute is the fastest-growing line for any AI-native firm. The work there is migrating workloads to lower-carbon cloud regions and introducing carbon-aware scheduling, so that jobs which can wait run when the grid is cleanest.

Devices are addressed by extending lifecycles to a minimum of five years. That matters more than it sounds, because the embodied emissions in a laptop dwarf its operational energy — the greenest machine is usually the one you already own.

Alongside that, a bio-enzyme and composting programme processes organic waste on site, with finished compost returned to surrounding forest areas and surplus offered to local farming families. It is a small line in the emissions table and a larger one in what it does locally.

The plan sets intensity targets to 2030 — emissions per employee — precisely because absolute emissions will rise as headcount grows, and we would rather state that plainly than report a number that looks better than the underlying trend. That is a plan and a measurement, not a completed outcome, and we are describing it that way deliberately.

---

A practical sequence

Six steps, ordered so nothing blocks anything after it.

• Measure before you claim. A footprint calculation with a stated boundary and methodology is the foundation for everything else. Without it, every claim is unsubstantiated by definition.
• Define the boundary explicitly. Which entity, which scopes, which period, which sites. Most disputes about environmental claims are disputes about scope.
• Document your methodology and its limitations, including where you have relied on supplier-reported figures and how confident you are in them.
• Reduce before you offset. Both the EU rules and the CMA’s guidance treat reduction as the primary claim and offsetting as secondary at best.
• Have someone outside marketing review every environmental claim before publication, against the actual evidence rather than the intention.
• Re-check claims when the underlying data changes. A statement that was accurate for last year’s footprint is not automatically accurate for this year’s.

---

Where this leaves technology companies

The uncomfortable position for the industry is that its footprint is growing quickly while its ability to talk about that footprint is being constrained quickly. Those two trends are not in tension — the constraint exists because the growth made vague claims valuable.

For an individual software company, the useful response is narrower than a sustainability strategy. Measure what you can, state the boundary, describe what your certifications actually certify, and resist the adjective. The companies that get into difficulty are rarely the ones with the largest footprints. They are the ones whose claims outran their evidence.

A certificate proves you have a system. A measurement proves you looked. Neither proves you are sustainable, and saying so plainly is more persuasive than the alternative.

---

Building technology where sustainability questions will come up?

Clear measurement and defensible claims start with the right operating and delivery controls.

---

Frequently asked questions

Does ISO 14001 certification mean a company is carbon neutral?

No. Certification bodies describe ISO 14001 as a standard that does not set specific environmental performance requirements, and note that it does not specifically require carbon footprint measurement. It certifies that an organisation operates an audited environmental management system, not that its emissions are low, reduced or offset.

What is the current edition of ISO 14001?

 ISO 14001:2026, published on 15 April 2026. It replaces ISO 14001:2015 and incorporates the climate change amendment issued in 2024. Certificates issued to the 2015 edition must transition within a three-year period, reported as running to approximately May 2029.

What changed in ISO 14001:2026?

Certification bodies report climate change being brought into the standard itself alongside broader environmental conditions such as pollution, biodiversity and natural resource use; restructured risk and opportunity requirements; a strengthened life cycle perspective; a new change management clause; and operational controls extended from outsourced processes to externally provided processes, products and services. It is described as evolutionary rather than a structural overhaul.

Can the CMA fine a company for a misleading environmental claim?

Under the Digital Markets, Competition and Consumers Act 2024, in force since 6 April 2025, the CMA can investigate, find a breach of consumer protection law and impose penalties of up to 10% of global annual turnover without court proceedings. Analysts note the CMA has identified environmental claims as a priority area for these powers.

Are we responsible for environmental claims made by our suppliers?

The CMA’s January 2026 supply chain guidance indicates that a company repeating, relying on or disseminating a misleading claim may face enforcement, and that businesses are expected to take reasonable steps to verify rather than relying blindly on supplier assurances. What is reasonable is described as depending on the significance of the statement, the availability of evidence and the resources of the business.

Can we say our service is carbon neutral if we buy offsets?

In the EU, product-level claims that a product or service is climate neutral or climate positive based on offsetting are banned from 27 September 2026 under the Empowering Consumers Directive. Organisation-level neutrality claims remain possible under strict conditions. In the UK, such claims are assessed against consumer protection law and the CMA’s Green Claims Code. This is an area where specific legal advice before publication is warranted.

If AI is getting more efficient, is its footprint falling?

Not in absolute terms. The IEA notes power consumption per AI task has been declining rapidly, but total data centre consumption continues rising because demand growth outpaces efficiency gains. Per-unit efficiency and total emissions are different measures, and only the second describes a footprint.

Which emissions scope matters most for a software company?

Usually Scope 3 — the value chain category covering cloud infrastructure, employee devices, purchased services, business travel and embodied emissions in hardware. Scope 1 is typically minimal for a software business, and Scope 2 covers offices and self-operated infrastructure.

What is the safest way to describe environmental credentials?

Specifically. State what was measured, over what period, using what methodology, and what any certificate actually covers. Unqualified descriptions such as “sustainable” or “eco-friendly” without substantiation are among the highest-risk claim types identified by UK regulators.

---

About the author

Prashant Sithta is COO and Co-founder of KastHunt Consulting LLP, an AI-native healthcare technology firm serving clinics, healthtech founders and health systems across the UK, US and Australia.

As Chief Operating Officer, he focuses on operations and delivery governance, helping structure how healthcare AI and software projects move from requirements through implementation, review and delivery.

He writes about operational discipline, delivery systems, process governance and the practical controls required to build and scale healthcare technology responsibly.

Questions or corrections: info@kasthunt.com

---

Related reading

• ISO 9001 and ISO 27001: Why They Matter for Software Development Firms
• What Healthcare Architecture and Database Diagrams Need to Show

---