IBM Supplier Requirements: A Guide to Environmental Reporting

If IBM is a customer, or you are bidding to become one, your relationship with IBM comes with specific environmental obligations. IBM requires its suppliers to operate an environmental management system, track environmental performance across three defined areas, set measurable improvement targets, and publicly disclose the results rather than reporting them only to IBM. 

IBM is equally clear about the consequences of non-compliance. It reserves the right to assess a supplier's conformance at any time during the term of a purchase order and expects suppliers to provide evidence of compliance on request. Failure to meet the applicable requirements may ultimately result in IBM discontinuing the business relationship.

This guide explains IBM's environmental requirements, who they apply to and when they take effect, the environmental data suppliers must track, the public disclosure requirement, the obligation to extend these expectations to your own suppliers, and a practical self-assessment checklist to help you evaluate your compliance.

What are IBM's supplier requirements? 

IBM is one of the largest technology companies in the world, working across hardware, software, cloud, consulting and AI, with operations in more than 175 countries. Its supply base is broad: component and materials manufacturers, logistics and distribution providers, facilities and construction firms, and a long tail of professional, technical and creative services.

Since 2010, IBM has required all of its first-tier suppliers, meaning businesses with a direct commercial relationship with IBM, to maintain a management system covering their social and environmental responsibilities. In IBM's summary on its supply chain responsibility requirements page, suppliers must have a corporate responsibility and environmental management system in place, measure performance, set goals, disclose results, and communicate the same requirements to their own upstream suppliers.

One piece of terminology worth clarifying upfront. When IBM refers to a "management system", it means a documented set of policies and procedures for running an area of the business consistently, for example how you set goals, check performance against them, and make improvements. 

Who do IBM's supplier requirements apply to, and when do you have to comply?

The requirements apply to IBM's first-tier suppliers, meaning any business with a direct commercial relationship with IBM. The management system should be deployed company-wide, or at minimum at the sites where work for IBM is performed.

The key date is not a fixed annual deadline. It is a rolling one tied to your own contract:

Within 12 months of starting business with IBM, suppliers are expected to meet all eight requirements.

That differs from programmes like Apple's Supplier Code of Conduct or Walmart's Project Gigaton, which run to a set annual cycle. With IBM, the clock starts when you do. The published requirements do not specify a single annual submission portal or reporting form. The obligation is continuous rather than periodic, and what matters is being able to demonstrate conformance whenever IBM, or an IBM-directed third party, asks.

What are IBM's eight supplier requirements? 

What environmental data do IBM suppliers have to track?

Requirement 3 is the heart of the environmental component, and it is more specific than a general commitment to environmental performance. It covers three areas, and requirement 4 then asks for at least one goal in each.

Greenhouse gas emissions. IBM asks for Scope 1, where applicable, and Scope 2, using its own definitions:

• Scope 1 is direct emissions from sources you own or control, including combustion in owned or controlled boilers, furnaces and vehicles.
• Scope 2 is indirect emissions from purchased or acquired electricity, steam, heat and cooling.

IBM is explicit that greenhouse gases here means more than carbon dioxide. Its published note lists carbon dioxide, methane, nitrous oxide, and fluorinated gases including HFCs, PFCs, sulphur hexafluoride and nitrogen trifluoride. If you operate refrigeration, air conditioning, or certain industrial processes, refrigerant losses belong in your Scope 1 figure.

Energy conservation. Your energy consumption, and the measures you are taking to reduce it. In practice this means kilowatt-hours of electricity, plus fuel and any purchased heat, steam or cooling.

Waste management and recycling. Volumes generated, and how they are handled and diverted.

Notably, IBM's own eight requirements do not ask suppliers for Scope 3 emissions. That makes the direct measurement obligation lighter than Microsoft's or Apple's supplier programmes. The cascade requirement, covered below, is where your supply chain still comes into play. 

What environmental goals do IBM suppliers have to set?

Requirement 4 asks for voluntary environmental goals to improve performance, with at least one goal in each of the three areas above. IBM's original supplier communication described these as numeric goals, and the disclosure requirement only works if there is a number to report against.

This is where the choice between spend-based and activity-based data starts to matter commercially.

Spend data is a perfectly reasonable starting point, and for a first footprint it gets you moving quickly. The difficulty comes at goal-setting. Spend-based estimates can move with changes in purchasing and business activity, which can make operational improvements harder to demonstrate. Grow the business and your reported emissions rise, whatever you have done operationally. Activity data (kilowatt-hours, litres of fuel, tonnes of waste diverted) can make operational improvements easier to measure and explain. 

Given the goals are published and revisited year after year, it is worth getting the measurement basis right before you set the first target rather than after.

What do IBM suppliers have to disclose publicly?

Requirement 5 covers what suppliers have to make public, and it goes beyond simply reporting to IBM. It asks suppliers to publicly disclose:

1. Results against your voluntary environmental goals, plus other environmental aspects of your management system.
2. Any regulatory fines or penalties incurred in the previous year.

This point deserves careful attention because it differs from most other supplier climate programmes, which focus primarily on collecting data. You submit data into a customer portal, a questionnaire or a platform like CDP Supply Chain, and it stays between you and that customer. IBM's requirement is a publication model instead. The output is a public record, and IBM then checks that record when it assesses you.

The fines and penalties clause carries real weight, since it asks a business to publish its own regulatory breaches, not just its climate goals. If you have had an environmental permit issue, a discharge penalty or a waste enforcement notice in the previous year, that is in scope.

Two points of precision worth holding on to:

• The requirement is disclosure of results against goals, not publication of a complete greenhouse gas inventory. Publishing the footprint is one way to evidence the goals, but it is not the literal ask.
• IBM does not prescribe a format, channel or frequency for public disclosure. A sustainability page on your own website is a common route.

If you already publish emissions data for B Corp certification, SECR, or a client-facing sustainability page, some of this work may already exist.

What is IBM's supplier cascade requirement?

Requirement 8 asks suppliers to cascade similar sustainable procurement requirements onto their own suppliers who perform work material to the products, parts or services supplied to IBM.

This is how IBM reaches down the chain without mandating Scope 3 reporting at every tier. You pass comparable requirements to the suppliers who matter to your IBM work, and they are expected to do the same.

In practice, two pieces of work:

• Identify which of your suppliers are material to what you provide IBM. Not your whole supplier list, just the ones whose work feeds into it.
• Communicate comparable requirements to them, and keep evidence that you have.

Once you are already asking those suppliers for environmental commitments, collecting emissions data in the same conversation is usually the efficient move. It is one request rather than two, and it means you already have the data if another client asks for Scope 3. Our guide to Scope 3 supplier engagement covers how that works.

Why does IBM ask suppliers for emissions data?

IBM's own 2025 disclosure explains the commercial logic behind all of this.

Purchased goods and services account for roughly 70% of IBM's reported Scope 3, and around 33 times its entire operational footprint. IBM currently reports 5 of the 15 Scope 3 categories, which IBM says collectively capture 95% or more of its total Scope 3 emissions. 

IBM has cut operational emissions by 83.4% against a 2010 base year, holds a Net Zero goal for 2030, and reached 84.5% renewable electricity against a 90% target by 2030. With purchased goods and services accounting for such a large share of IBM's reported Scope 3 emissions, supplier engagement is an important part of its wider emissions strategy. 

What happens if you fail to meet IBM's supplier requirements?

IBM states the consequences plainly, and they are commercial rather than administrative.

The immediate consequence is a failed assessment. IBM reserves the right to assess a supplier's conformance to the requirements at any point during the term of the purchase order, and expects suppliers to be able to demonstrate that conformance when asked, whether the assessment comes from IBM directly or an IBM-directed third party. There is no notice period specified. Falling short here means the gap between what you can evidence and what's expected becomes visible at that point, not a fixed date you can prepare for in advance.

The ultimate consequence is loss of business. IBM states that failure to meet all applicable requirements can ultimately result in discontinued business. This is the sharpest line in the published requirements, and it applies to the environmental obligations the same as the rest.

A regulatory breach carries its own separate consequence. This is worth being precise about, because it's easily misread. IBM does not fine suppliers. The fines referenced in requirement 5 are penalties imposed on you by regulators, which IBM then requires you to disclose publicly as part of your environmental reporting. So falling short on environmental compliance elsewhere (a permit breach, a discharge penalty, a waste enforcement notice) doesn't just carry a regulatory cost. It carries a second cost: having to publish that breach where your clients, competitors and prospects can see it.

The realistic reading is not that a missed waste target ends the relationship tomorrow. It's that conformance is a live condition of the contract, checked without warning, and the evidence needs to exist before someone asks for it.

IBM supplier requirements: a self-assessment checklist

Work through this against your own business. Anything unticked is a gap worth closing before an assessment. .

How Seedling helps IBM suppliers

Most of the work behind meeting IBM's environmental requirements is carbon accounting: a defensible footprint, credible goals, data clean enough to publish, and records that stand up to an audit. That is what we do.

Seedling pairs carbon accounting software with one-to-one support from a dedicated carbon expert. For IBM suppliers, we can:

• Measure your footprint across Scopes 1, 2 and 3, in line with the GHG Protocol. That gives you the Scope 1 and 2 data and energy figures IBM asks for, and the Scope 3 coverage that RBA C6 and your other clients look for.
• Capture all relevant greenhouse gases, including refrigerants and other fluorinated gases named in IBM's definition, rather than carbon dioxide alone.
• Set credible reduction goals, including SBTi-aligned Net Zero targets, and model the impact of planned changes so the goals you publish are backed by data rather than optimism.
• Collect data from your own suppliers using our supplier engagement tool, which sends a straightforward request form and feeds responses directly into your footprint. Useful once you start cascading requirements down your own chain.
• Produce reports and a public impact page, so the disclosure requirement becomes a link you share rather than a project you dread.
• Support third-party verification where you want your inventory independently checked ahead of an assessment.
• Keep your data reusable, so one footprint serves IBM, your other clients and investors, and your own reporting.

We work with mid-market businesses across the UK, US and beyond, including manufacturers, IT and managed services firms and technology companies supplying large corporates.

To talk it through, book a demo or get in touch. We would love to hear from you.

Frequently Asked Questions