Solutions
Industries
Regulations
Resources
Company
Key Takeaways
In the previous blog, I wrote about environmental information becoming part of the economic identity of a product. If a tonne of material is worth more because it is recycled, renewable, lower-carbon or made from a particular feedstock, the market needs some way of knowing that the claim is true. Otherwise we have created a wonderful market for whoever is best at making claims rather than whoever is actually producing the environmental outcome we wanted.
So evidence is necessary. Someone needs to establish where the material came from, how it was produced, how its carbon footprint was calculated, whether the sustainability characteristic survived a conversion process and whether the same characteristic has already been claimed somewhere else. Certification, audits, chain of custody, product carbon footprints, mass balance systems and increasingly elaborate data requirements have grown around this fairly sensible need.
The problem is that evidence itself is not free. It consumes employee time, auditor time, consultant time, software budgets and management attention. It requires suppliers to answer questions, companies to maintain records and someone somewhere to reconcile the numbers when two systems inevitably disagree. Once we recognise that, sustainability compliance starts having an economics of its own.
I think we spend considerably less time discussing that economics than we should.
Suppose a regulation requires a company to replace a high-carbon material with a lower-carbon one. The lower-carbon material costs €1 million more per year. That is a substantive cost of the environmental transition. Society has decided that reducing the environmental damage is worth changing what the company buys or produces, and the company bears some portion of that cost.
Now imagine that proving the material is lower-carbon requires another €300,000 in certification, audits, consultants, software and employee time. That is a different kind of cost. The €300,000 does not reduce another tonne of carbon by itself. It creates confidence that the €1 million environmental action actually happened and satisfies the rules.
We tend to bundle both together under the vague heading of “cost of compliance,” but economically they deserve to be separated. The first is the cost of changing the underlying activity. The second is the cost of establishing enough information and trust for the regulatory system to recognise that change.
That second category can be entirely justified. If nobody verifies the claim, a company spending nothing on decarbonisation can potentially receive the same regulatory benefit as the company spending €1 million. The market then rewards dishonesty and the environmental mechanism stops working.
But the fact that some evidence is necessary doesn’t mean that every additional piece of evidence is worth its cost. If proving a €1 million environmental outcome eventually requires €900,000 of administrative machinery, something has gone rather wrong even if every individual requirement sounded sensible when it was introduced.
Imagine a regulator introduces a requirement that a particular product must meet a sustainability threshold. Companies begin submitting evidence. Eventually somebody finds a loophole, makes an incorrect claim or discovers that suppliers are calculating the same number in incompatible ways. The reasonable response is to add another control.
Then an auditor discovers that the new control itself relies on information that cannot easily be verified, so another document is required. Companies interpret the document differently, which leads to guidance. The guidance creates additional fields. Those fields need records. Records need retention periods, approval processes and audit trails. Software is eventually purchased to manage all of it.
There is no villain in this story. Every addition can be perfectly rational in isolation.
The problem is cumulative. Regulatory systems tend to be very good at asking what new control would prevent a particular failure and much less disciplined about asking what the entire control architecture now costs relative to the problem it is solving.
This isn’t unique to sustainability. Financial regulation, aviation, pharmaceuticals and food safety all have versions of the same problem. Once the consequence of getting something wrong becomes serious, organisations accumulate procedures designed to make error progressively less likely. Eventually the procedure itself becomes a substantial industry.
Sustainability is now building its own version of that industry.
I want to be careful here because “compliance burden” can become lazy shorthand for work we would simply prefer not to do.
If a biofuel receives a premium because it was produced from used cooking oil, somebody needs to establish that the feedstock was actually UCO. If a manufacturer sells a product with a lower carbon footprint, the methodology and underlying data need enough integrity for the comparison to mean something. If recycled content creates regulatory or commercial value, the system needs to prevent companies from claiming more recycled material than actually entered the supply chain.
Without those controls, environmental characteristics become very easy to manufacture on paper. That would be especially damaging precisely because, as I argued in the previous blogs, regulation is increasingly giving these characteristics real economic value.
The useful question therefore isn’t “can we get rid of compliance?” We cannot, unless we are also comfortable getting rid of credible environmental claims. The useful question is which compliance activities create necessary confidence and which have simply become historical sediment inside the system.
That distinction becomes much clearer if we stop treating all compliance work as one thing.
The first bucket is judgement. Someone needs to interpret a new regulation, understand how it applies to the business, decide whether a feedstock or production pathway qualifies, evaluate unusual transactions and make decisions when the rules meet the messiness of the real world. These tasks are difficult partly because they are not repetitive. They involve context, uncertainty, commercial consequences and sometimes genuine disagreement about what the correct answer is.
The second bucket is evidence production. Once the business knows what it needs to prove, somebody has to collect supplier certificates, maintain quantities, calculate balances, create sustainability declarations, reconcile transactions, maintain audit trails and produce the records an auditor needs. This work is necessary because the regulatory claim needs evidence, but a very large portion of it should not require sophisticated human judgment every time it happens.
The third bucket is administration created by the evidence system itself. Copying a number from one spreadsheet into another, renaming documents, chasing information that already exists somewhere else in the organisation, manually generating repetitive declarations, rebuilding an audit package every year and reconciling two databases because nobody connected them are examples of work that can become normal simply because “this is how we do compliance.”
I don’t think the objective of compliance technology should be to make all three buckets more efficient. The objective should be to preserve and improve the first, automate as much of the second as possible and be fairly ruthless about eliminating the third.
That is a much harder standard for technology than digitising an existing workflow.
This is an uncomfortable point for an industry that sells software, including the one I work in. It is relatively easy to take a spreadsheet-based compliance process, reproduce every field inside a web application, add dashboards and call the problem solved. The company may indeed have a better interface, but the underlying process can remain just as absurd.
If an employee previously copied twenty fields manually into Excel and now copies the same twenty fields manually into a browser, we have not transformed compliance. We have given data entry better typography.
The more interesting question is why the employee is entering those fields at all. Does the information already exist in the ERP? Did it arrive with the supplier’s transaction? Can the conversion factor be applied automatically? Can the sustainability declaration be generated from information already captured during the commercial process? Can the system identify the five unusual transactions that require human attention rather than asking somebody to inspect five thousand normal ones?
This is where I think AI also needs to be treated with a little less magic. Reading a certificate, extracting information from a sustainability declaration or identifying an anomaly in thousands of transactions can be extremely useful applications. Asking an AI model to make an unsupported regulatory judgment simply because humans find the question annoying is a different proposition.
The point of technology should not be to remove humans from compliance indiscriminately. It should be to make sure humans are spending their time on the parts where being human is actually useful.
This is perhaps the question I find most interesting because it changes how we think about the return on investment from compliance technology.
Imagine a sustainability or compliance team currently spends 100 hours every month maintaining evidence. Fifty of those hours disappear because transactions reconcile automatically, documents are read by software, repetitive declarations are generated from underlying data and auditors can retrieve much of what they need without somebody manually assembling it.
What should happen to those fifty hours?
The least interesting answer is that the team can now process twice as many compliance records. Sometimes that will genuinely be useful, but it cannot be the entire ambition.
A person who understands a regulation deeply can do something much more valuable than populate its evidence fields. They can ask whether a different feedstock would improve the company’s compliance position, whether a supplier’s lower-carbon product justifies a premium, whether an upcoming rule will change customer demand, whether a new production pathway qualifies for a market that the commercial team has not considered or whether the company is spending enormous amounts of money satisfying a requirement in the least efficient possible way.
In other words, the same employee can move from proving yesterday’s transactions to thinking about tomorrow’s decisions.
That is a very different return on automation.
What if some compliance work should not be automated because it should not exist?
Technology companies naturally prefer the assumption that every regulatory workflow is permanent. If a process requires ten people today, that creates an obvious opportunity to sell software that lets five people do it tomorrow. There is considerably less commercial incentive to ask whether the process should require anyone at all.
But regulators should be asking exactly that.
The relevant metric cannot simply be how much fraud or error an additional control prevents. It should include what the control costs every compliant participant in the market. If an extra verification step prevents €10 million of incorrect claims but costs the industry €100 million every year to perform, we need a more serious economic conversation about whether that is a good control.
This is why recent European debates around regulatory simplification are more important than the usual political framing of “green ambition versus deregulation.” Administrative burden is itself an economic variable. Money and employee time spent proving compliance are resources that cannot simultaneously be spent on engineering, procurement, investment, product development or actually reducing emissions.
Simplification is therefore not automatically a retreat from environmental ambition. A well-designed system should be able to preserve the environmental outcome while continuously trying to reduce the cost of proving it.
The difficult part, of course, is knowing which requirements are protecting the integrity of the system and which ones are simply making everyone feel protected.
If sustainability regulation costs a company €1 million to implement, I would like to know how that million is divided.
How much went towards cleaner energy, lower-carbon materials, new equipment, better suppliers or other changes in the physical economy? How much went towards understanding what the company should do? How much went towards proving that it did it? And how much went towards moving information between systems because the compliance architecture was badly designed?
I don’t think there is a universally correct ratio. A market vulnerable to fraud may legitimately require more verification than one where the relevant information is easy to observe. A new regulation may initially require more human interpretation than a mature one. High-value claims deserve stronger controls than trivial ones.
But simply measuring the ratio would force a useful question. If the cost of evidence keeps rising while the environmental outcome remains unchanged, at what point are we improving confidence and at what point are we merely improving bureaucracy?
For companies, the same question should influence where they put technology. Automate the evidence that genuinely has to exist. Connect systems so the same information is not recreated repeatedly. Use humans for exceptions, interpretation and commercial decisions. And when a workflow appears to have no purpose beyond satisfying another workflow, be willing to question why it exists.
This is ultimately why I don’t think the future of sustainability technology is about helping companies produce more sustainability data. The interesting problem is making necessary evidence almost invisible, while giving people better information for the decisions where sustainability actually changes the economics of the business.
That distinction becomes particularly important when regulation itself changes after companies have already spent millions preparing for it. If the EU later decides that some of the reporting architecture it created was too expensive, were the companies that invested early foolish to have done so? Or were they making perfectly sensible decisions with the information they had at the time?
That brings me to CSRD, the Omnibus package and the economics of regulatory regret.
