Published 08/17/2026
Originally publishedby Schellman. Written by
Danny Manimbo & Ben Montalbano
.
In 2020, Microsoft made a sweeping commitment to be carbon negative by 2030 and remove all the carbon it had ever emitted since 1975. It was ambitious, inspiring, and, as of 2025, slipping further out of reach. Microsoft leaders originally referred to their sustainability goals as a “moonshot,” and in their own words from their 2025 Environmental Sustainability Report, the moon has gotten further away.
The culprit making their ambitions seem less attainable is none other than artificial intelligence. The same technology that promises to supercharge productivity is quietly dismantling the sustainability goals companies spent years building.
At RMISC 2026, Schellman’s AI and sustainability experts, Danny Manimbo and Ben Montalbano, explored what this means for organizations navigating the intersection of AI governance, environmental compliance, and emerging regulation, and what you can actually do about it.
How Much Energy Does AI Use? #
AI-specific servers consumed between 53 and 76 terawatt-hours in 2024 alone, which is enough to power 7.2 million U.S. homes for a year. Training GPT-4 alone consumed roughly 50 gigawatt-hours, equivalent to powering San Francisco for three days. And this is just the beginning.
Data center growth has added 73 million metric tons of CO₂ equivalent since 2020, a sector that is already 48% more carbon intensive than the U.S. average and accounts for approximately 1.3% of total U.S. greenhouse gas emissions.
The community impacts of AI’s energy use are tangible too. Bloomberg has reported wholesale electricity costs up to 267% higher near major data center clusters. Local controversies over electricity prices, water use, and economic disruption are becoming commonplace. AI data centers also consume significant quantities of fresh water for cooling, a resource increasingly constrained by drought in many regions.
Different AI use cases have different environmental footprints. Agentic AI implementations can use 1,000 times more tokens than standard chat interactions. Models consuming gigawatt-hours to train become obsolete months later. The efficiency curve is improving as newer models deliver more capability per watt, but the pace of innovation means that efficiency gains are often outrun by expanding demand and frequent iteration.
The Sustainability Regulatory Environment is Growing Faster Than Most Realize #
Organizations may be watching sustainability regulation at the federal level and assume the pressure has eased, but that would be a mistake. International and state-led climate regulations continue to take effect, including:
California SB 253
The Climate Corporate Data Accountability Act applies to any entity doing business in California with annual revenues of $1 billion or more. That threshold is more accessible than it sounds: as little as $735,000 in California sales can qualify as "doing business" in the state. Scope 1 and 2 reporting is due in November 2026. Scope 3 reporting begins in 2027. Limited assurance by a third party becomes mandatory that same year for Scope 1 and 2.
The EU's Corporate Sustainability Reporting Directive (CSRD)
CSRD applies to non-EU companies with over €450 million in EU turnover. It requires double-materiality ESG disclosures, meaning organizations must assess both the financial impact of sustainability risks on the business and the business's impact on society and the environment. First reports cover FY2028 data, due in 2029. Critically for AI-intensive organizations, AI's energy and emissions footprint will often be reportable under Scope 3, and accurate reporting will require emissions data from cloud providers and AI SaaS vendors.
Statutory sustainability reporting requirements are advancing, with various GHG reporting frameworks already in place in the UK, Spain, and Australia.
The key nuance is that these regulations currently focus on GHG measurement and reporting, not mandated reductions yet. But you cannot manage what you don't measure, and the systems you build now will satisfy the more demanding requirements that will follow.
Responsible AI: Corporate Policy and Governance #
The responsible AI space is full of frameworks, policies, and pledges, and most are aspirational. Principles without measurement, accountability, or auditability are not governance, and they will not satisfy auditors, regulators, or investors when disclosure obligations come due.
At the user level, managing AI-related emissions is harder than it looks. Cost is the best available proxy for limiting consumption, but token pricing is subsidized, opaque, and constantly shifting. Provider-level emissions disclosure is too limited for accurate Scope 3 reporting (to the limited extent they exist at all). And while organizations can ask employees to use smaller models, as Open AI’s Sam Altman himself has noted, “model anxiety is real.”
At the organization level, the gap between ambition and accountability typically comes down to three things: the absence of energy measurement systems, no defined targets or indicators, and no audit-ready documentation to support third-party assurance.
The ISO Standards That Turn Aspiration into Governance #
The following three ISO standards, when used together, provide the structure that responsible AI guidance currently lacks otherwise:
ISO 42001: AI Management Systems
Published in December 2023, ISO 42001 is the world’s first international standard for AI management. It provides a structured framework for developing, deploying, monitoring, and continuously improving AI responsibly, proactively embedding governance into operations.
Key ISO 42001 requirements relative to sustainability compliance include:
- AI
[risk management](https://www.schellman.com/blog/iso-certifications/how-to-assess-and-treat-ai-risks-and-impacts-with-iso42001) - Defined AI policy,
[roles](https://www.schellman.com/blog/ai-governance/iso-42001-roles-and-responsibilities), & accountability - Continual improvement & performance monitoring
-
Ethical AI principles embedded in operations
-
Audit ready documentation
-
Supplier & third-party AI oversight (Scope 3 foundation) Critically, AI risk assessments under 42001 can and should be extended to include environmental impact, and the audit-ready documentation it requires directly supports the evidence SB 253 and CSRD assessors will need.
ISO 14001: Environmental Management Systems
ISO 14001, the globally recognized standard for environmental management, was first published in 1996 and is now in its fourth edition (2026). It helps organizations identify, manage, and continuously improve their environmental impacts using a Plan-Do-Check-Act framework from energy use and emissions to waste, water, and materials.
For AI-intensive organizations, it scopes AI procurement, data center selection, and cloud provider emissions into the organizational boundary. It creates the internal controls and audit trail that SB 253 and CSRD’s limited assurance requirements demand. ISO 14002 key requirements and benefits include:
- Environmental aspect & impact identification
- Legal & regulatory compliance obligations
- GHG emissions tracking & reduction targets
- Continual improvement of environmental performance
- Life cycle thinking for products & services
- Stakeholder engagement & transparent reporting
ISO 50001: Energy Management Systems
ISO 50001, first published in 2011 and updated in 2018, is the international standard for Energy Management Systems (EnMS). It helps organizations systematically improve energy performance through data-driven management, setting energy baselines, performance indicators, and measurable reduction targets. It is directly applicable to AI workload management and model selection. Third-party accreditation provides regulators and stakeholders with independently verified evidence that Scope 3 disclosures require.
ISO 50001 key requirements and benefits include:
- Energy baseline & performance indicator (EnPI) setting
- Significant energy use (SEU) identification & monitoring
- Action plans & measurable energy reduction targets
- Energy-efficient design & procurement criteria
- Metering, measurement, & data verification
- Top management commitment & resource allocation
Why ISO 42001, ISO 14001, and ISO 50001 Work So Well Together
What makes these three standards particularly compelling together is that they share the same high-level structure: Context, Leadership, Planning, Support, Operation, Evaluation, and Improvement, making integration so natural. A single unified management system with a shared policy framework, integrated internal audit program, and consolidated management review is achievable, allowing you to report once and govern everything.
| | | | | AI Risk → Environmental Impact | AI Governance → Energy Performance | Integrated Triple Standard Program | | Extend AI impact assessments to include environmental risk. Map AI workload emissions as an environmental aspect. Use 14001’s legal compliance framework to capture SB 253 & CSRD obligations. | Incorporate EnPIs for AI model training and inference directly into the AIMS. Set measurable energy reduction targets aligned to AI optimization goals — algorithmic efficiency, hardware, data center sourcing. | Run a single, unified management system with a shared policy framework, integrated internal audit program, and consolidated management review. Report once, govern everything. |
Integrating AI Governance and Sustainability Compliance #
AI’s environmental footprint is a current problem, and it’s landing on the balance sheet, in regulatory filings, and in community headlines right now. The organizations that threat this as an IT issue or a sustainability team side project will find themselves scrambling when SB 253’s August 2026 deadline arrives or when CSRD assessors ask for Scope 3 evidence they can’t produce.
The good news is that ISO 42001, 14001, and 50001 are proven frameworks designed to work together. They provide a documented, auditable, continuously improving management system to validate that your organization takes responsible AI seriously. They give boards a governance structure, give compliance teams the audit trail regulators will require, and give sustainability leaders the measurement infrastructure they need to actually make a difference.
Reducing AI energy consumption lowers operating costs, cuts emissions, and builds the evidentiary record that tomorrow’s mandatory disclosures will demand. Principles without accountability aren’t governance, but organizations that build these systems now will be ahead of the curve, with independently verified proof that their AI practices are responsible, measurable, and improving.
Discover additional relevant insights in these helpful resources:
About the Author
Danny Manimbo is a Principal at Schellman based in Denver, Colorado, where he leads the firm’s Artificial Intelligence (AI) and ISO services and serves as one of Schellman’s CPA principals. In this role, he oversees the strategy, delivery, and quality of Schellman’s AI, ISO, and broader attestation services. Since joining the firm in 2013, Danny has built more than 15 years of expertise in information security, data privacy, AI governance, and compliance, helping organizations navigate evolving regulatory landscapes and emerging technologies. He is also a recognized thought leader and frequent speaker at industry conferences, where he shares insights on AI governance, security best practices, and the future of compliance. Ben Montalbano is an accomplished energy economist and data scientist with over 15 years of experience in sustainability reporting, energy industry research, and data analytics. He leverages his deep expertise at the intersection of energy systems and sustainability, along with a robust technical skillset, to deliver scalable and impactful sustainability solutions. Ben has co-authored several publications for the Oxford Institute for Energy Studies and been published in several other energy industry journals. He has presented his work at numerous internationally recognized venues, including the Center for Strategic and International Studies (CSIS) and the Clingendael Institute.
Unlock Cloud Security Insights
Subscribe to our newsletter for the latest expert trends and updates
Related Articles:
Non-Human Identity Security Starts With This Simple Question Published: 08/14/2026
MAESTRO Analysis of OpenAI and Anthropic Agent Hacking Incidents Published: 08/13/2026
New Chaos Malware Variant Exploiting Misconfigurations in the Cloud Published: 08/12/2026
7 Claude Tag Security Risks: The Agent Identity Gap Published: 08/11/2026