Enterprise AI Compute Sits Where Corporate Carbon Sat Before Custody Registries

Four days ago, on November 10, 2026, corporate sustainability governance crossed a hard procedural threshold when the inaugural Scope 1 and Scope 2 reporting gate closed under California’s Climate Corporate Data Accountability Act (SB 253, Cal. Health and Safety Code § 38532) and the California Air Resources Board (CARB) implementing regulations at 17 CCR §§ 96070–96077, approved by the California Office of Administrative Law effective October 12, 2026. For decades prior, large enterprises treated greenhouse gas totals as voluntary estimates assembled from monthly utility spend. Once counterparty questionnaires, anti-greenwashing statutes, and third-party assurance arrived, raw utility invoices stopped passing scrutiny. Controllers had to prove chain of custody.

Enterprise artificial intelligence compute now sits in that exact pre-registry posture. Across corporate networks audited between September 15 and November 14, 2026, Non-Human Identities (NHIs) and OAuth tokens outnumber human employees by 45:1 to 144:1, while autonomous threat campaigns such as ARTEX harvest exposed bearer API keys to fund external cybercrime on the victim’s cloud invoice. Finance teams see a rapidly compounding line item for inference tokens, yet neither the CFO, the CISO, nor the audit committee holds an attestation-grade sub-ledger proving which authorized internal workflow consumed which token.

Keeping the legal boundary exact is essential for board oversight: no legislature, securities regulator, or sustainability standards body currently requires companies to track or disclose the provenance of AI inference tokens, and no vendor sells certified, spend-once compute today. Examining AI compute through BC ESG’s carbon-accounting framework—strictly as governance inference—shows how unattributed bearer tokens create silent internal-control leakage today, and sketches the custody architecture audit committees and procurement desks may eventually press for.

1. Statutory Baseline: What Climate and ESG Law Covers Today—and What It Does Not

Compliance teams closing fourth-quarter sustainability filings do not need imaginary mandates added to their register. As of November 14, 2026, zero U.S. federal, state, or international sustainability reporting statutes cover AI compute provenance, token serialization, or inference chain of custody. Where artificial intelligence intersects statutory ESG reporting today, it appears indirectly as electricity load inside data-center emissions inventories or operationally under risk-based model rules—a boundary we mapped in Responsible AI Meets ESG Reporting and across our institutional compliance frameworks guide.

BC ESG’s newly completed 116-row U.S. climate disclosure and building-performance census—spanning all 50 states, Washington, D.C., and 42 active municipal and county jurisdictions—shows how concentrated formal corporate disclosure statutes remain even for carbon. California is the sole U.S. state with enacted cross-sector private corporate greenhouse gas and carbon-claim laws: SB 253 (for U.S. entities above $1 billion in revenue doing business in California, whose first Scope 1 and Scope 2 filing gate closed November 10, 2026 ahead of 2027 Scope 3 reporting, as detailed in Three Doors Into November 10), AB 1305 (Cal. Health and Safety Code §§ 44475–44475.3, live since January 1, 2024 for voluntary carbon offsets and net-zero claims), and SB 261 (Cal. Health and Safety Code § 38533, whose statutory January 1, 2026 climate-risk deadline remains preliminarily enjoined by the Ninth Circuit pending appeal in Chamber of Commerce of the U.S. v. Sanchez). Across the other 49 states and D.C., no cross-sector corporate climate statute is enacted—though three $1 billion corporate bills sit pending in New York (S9072A), New Jersey (S679), and Illinois (HB 3673), alongside 29 NAIC insurer survey jurisdictions, eight states plus D.C. enforcing state- or district-wide private building performance or benchmarking rules, and 43 active local city and county ordinances across those 42 local jurisdictions.

2. How Voluntary Corporate Carbon Collapsed Into Custody Registries and Attestation

To understand why aggregate AI API invoices face growing scrutiny under board-level oversight, recall why aggregate electricity bills stopped satisfying sustainability auditors. Early voluntary ESG reports routinely converted annual utility spend into rough grid-average estimates without instrument proof. That informal era ended across three accounting reforms—each closing a specific custody gap.

First came instrument serialization and single-retirement rules. Under the GHG Protocol Corporate Accounting and Reporting Standard, the GHG Protocol Scope 2 Guidance, and U.S. EPA Scopes 1 and 2 Emissions Inventorying Guidance, accounting standards separated physical location-based grid factors from contractual market-based instruments. A company claiming low-carbon electricity under the market-based method must hold serialized Energy Attribute Certificates (EACs), such as Renewable Energy Certificates (RECs), tracked on a registry and permanently retired once on the reporting entity’s behalf. Without single-use retirement, two buyers could claim the same megawatt-hour—the core integrity issue examined in BC ESG’s analysis of Scope 2 market-based methodology reforms.

Second came value-chain boundary discipline and anti-greenwashing substantiation. Under GHG Protocol Scope 3 Calculation Guidance, enterprises replaced rough spend multipliers with primary supplier activity records—a shift covered in our field guide to Scope 3 supplier data across specialty trades. California then enacted AB 1305, requiring companies marketing or using voluntary carbon offsets or net-zero claims to publish registry names, project identification numbers, and verification protocols online under civil penalties up to $2,500 per day ($500,000 cap), as mapped in our California SB 253, SB 261, and AB 1305 compliance pack.

Third came independent third-party assurance. Under SB 253 and professional attestation standards maintained by AICPA audit and assurance frameworks, assurance practitioners test completeness, cutoff, organizational boundaries, meter-to-ledger reconciliation, and registry retirement statements. Carbon moved from voluntary narrative to custody accounting because unserialized claims invite double-counting and undetected leakage.

3. Scope 3 Compute Leakage: Where Enterprise AI Token Spend Sits Today

Measured against those core assurance assertions—completeness, authorization, cutoff, and custody—enterprise AI compute in late 2026 runs without a registry. Public breach disclosures, federal advisories, and engineering post-mortems recorded between September 15 and November 14, 2026 demonstrate why monthly API spend totals fail basic internal-control tests.

• 45:1 to 144:1 Non-Human Identity Ratios: Data published in the NHIMG State of NHI and AI Agent Breaches Report shows corporate service accounts, OAuth grants, and machine tokens outnumbering human staff by 45:1 to 144:1; across 239 examined AI incidents, 44% were driven by credential compromise and roughly 30% (71 of 239) entered through third-party SaaS and OAuth supply chains outside application prompt controls.
• External Cybercrime Subsidized via Corporate Keys (FLASH-20261113-001): Telemetry gathered by Amazon Threat Intelligence across MadPot decoys (October 3–November 5, 2026) and formalized in FBI IC3 Flash Alert FLASH-20261113-001 (November 13, 2026) documented autonomous ARTEX agents executing sub-three-hour intrusions and harvesting credentials from exposed LiteLLM and One API gateways so victim accounts paid for the attackers’ subsequent model runs.
• Sub-Processor Custody Compromise (LLMJacking): Sub-processor exposure surfaced twice at inference vendor Fireworks AI during October 2026 (October 6 and October 23–24, 2026), where Unit 42-investigated LLMJacking compute theft and internal R&D lateral movement reached downstream SaaS integrations, including access to fewer than 1% of customer chat transcripts at Notion.
• Mathematical and Checkpoint Control Limits: Neither input rules nor pre-release model checks establish runtime custody: a June 2026 NIST formal proof grounded in Gödel’s incompleteness theorems established that static rule sets inevitably leave gaps across unbounded natural language, and November 2026 Microsoft Defender and AI Red Team research on Lazarus backdoors demonstrated that surgical edits to under 10 dormant neurons allow open-weight checkpoints to clear pre-deployment reviews while firing hidden coding-agent payloads in 84.1%–94.8% of trials (and up to 98.8% on Nemotron-Terminal-8B).

Rigorous board reporting must likewise distinguish unauthorized token leakage from non-malicious infrastructure halts in the same quarter. Primary post-mortems verify that the November 12–14 Microsoft 365 disruption (MO1550821) exceeding 24 hours across 74+ countries (stemmed from a capacity rollout and health-probe configuration error), the November 13 U.S. FAA nationwide flight halt (4 hours, 20 minutes between 3:54 and 8:15 p.m. EST, attributed at a joint DHS and DOT briefing to scheduled fiber cutover work on legacy 1980s analog copper circuits overloading regional switches), and the October 20 Google Cloud London europe-west2-b outage (Xs2XTHzAVC9YnafnPyzj) (6 hours, 8 minutes after October 14 Feeder B maintenance isolation combined with upstream PLC voltage-sensor wiring left standby diesels unstarted and depleted UPS batteries in roughly 7 minutes) reflected physical and common-mode operational risk rather than transmissible AI threats.

Routing static bearer API keys across up to 144:1 machine identities and third-party gateways creates “Scope 3 compute leakage”—external threat actors burning corporate inference budgets with zero chain of custody on the victim’s general ledger.

We use Scope 3 compute leakage strictly as a governance parallel, not a statutory greenhouse gas category. Because standard API keys operate as anonymous bearer strings, any human, SaaS sub-processor, or ARTEX agent holding the key can draw down enterprise credits—leaving internal audit unable to prove at quarter-end that billed inference actually served authorized corporate operations.

4. What Attestation-Grade Compute Custody Would Require (Governance Proposal)

If boards, enterprise buyers, or assurance practitioners eventually press AI labs for the chain-of-custody rigor that GHG Protocol Scope 2 registries brought to clean power, what would that instrument require? Framed strictly as a conceptual governance proposal—since no such product or standard exists today—attestation-grade certified compute would combine four controls.

1. Named-Issuer Serialization and Signer Non-Repudiation: Instead of static bearer strings shared across SaaS connectors, a named frontier lab or clearinghouse would mint serialized compute tranches bound to a verified enterprise workload identity under NIST CSRC signer non-repudiation principles, establishing cryptographic origin for every inference request.
2. Spend-Once Token Retirement and Replay Prevention: Just as a REC serial number is retired upon redemption to prevent double-counting, certified compute units would be spendable once. Pairing cryptographic nonces with Zero Standing Privilege (ZSP) brokers issuing roughly 30-second single-use tokens—plus hardware-backed Inalienable Human-in-the-Loop (arXiv:2610.35835) sign-off for high-impact actions—would neutralize stolen-key replay and ARTEX self-funding.
3. Execution-Time Provenance With Honest Red-Team Boundaries: At execution, the runtime ledger would bind input-output hashes, weight digests, and policy state—drawing conceptually on C2PA v2.4 Content Credentials, hardware enclave attestation (Proof-of-Guardrail, arXiv:2603.05786), formal runtime verification (arXiv:2610.09793), and NIST AI Risk Management Framework governance. Primary 2026 red-team evidence shows why none of those tools suffice alone today: C2PA metadata is stripped by screenshots and faces first-mile capture limits, statistical watermarks degrade under paraphrasing, and TEE enclaves prove code integrity without semantic immunity against prompt injection. Assurance-grade custody would therefore need to anchor on an immutable server-side spend ledger rather than client-side file tags.
4. Certifier Risk Absorption and Reconcilable Sub-Ledgers: Under this proposed model, serialized compute attestation would carry assurance weight only if the issuer stood behind its registry—absorbing counterfeit or replayed token losses that cleared its settlement rail while exporting signed sub-ledgers reconcilable to corporate cost centers.

5. Carbon Attestation vs. Compute Custody Governance Matrix

For audit committees, general counsel, and sustainability controllers operating post-November 10 SB 253 controls, the matrix below maps established corporate carbon custody rules against observed 2026 AI bearer-token exposure and the proposed certified-compute model.

6. Board and Audit Committee Readiness Checklist

Boards and audit committees do not need to wait for a certified-compute market or future legislation to close internal-control gaps over AI spend and machine credentials. Governance committees setting fourth-quarter 2026 and fiscal-year 2027 audit plans can execute seven controls immediately.

1. Commission a Non-Human Identity and OAuth Proxy Census: Direct the CISO and CIO to measure the live machine-to-human identity ratio against the 45:1–144:1 benchmark, cataloging every internal gateway (LiteLLM, One API) and SaaS OAuth integration holding model credentials.
2. Enforce Sub-Ledger Cost Attribution and Spend Circuit-Breakers: Segment AI API accounts by single application and environment rather than pooled enterprise keys, pairing sub-accounts with automated spend caps that trip within minutes of an ARTEX-style anomaly.
3. Migrate From Static Bearer Keys to Ephemeral ZSP Brokers: Replace long-lived bearer strings in production agent workflows with Zero Standing Privilege brokers issuing short-lived (~30s) scoped tokens and hardware cryptographic sign-off for high-impact database or treasury actions.
4. Separate Common-Mode Outages From Parasitic Breaches in Board Packs: Distinguish non-malicious monoculture and physical maintenance outages (Microsoft MO1550821, the November 13 FAA copper-to-fiber ground stop, and Google Cloud europe-west2-b PLC faults) from verified credential-theft pathogens (ARTEX, Fireworks AI LLMJacking).
5. Audit Open-Weight Checkpoints and SaaS Sub-Processors: Screen open-weight models for post-training weight tampering (such as Lazarus fewer-than-10-neuron coding-agent backdoors) and require SaaS vendors to disclose downstream inference routing, key isolation, and breach notification SLAs.
6. Substantiate Any AI Clean-Energy Claims Under Existing Carbon Law: Verify that any public claim of “carbon-neutral” or “100% renewable” AI operations satisfies live GHG Protocol Scope 2 certificate retirement rules and California AB 1305 website substantiation mandates.
7. Negotiate Custody-Readiness Clauses in 2027 Model Agreements: Request per-workload cryptographic request signing, exportable inference audit logs, and explicit billing relief for vendor-side credential exposure during enterprise contract renewals.

Frequently Asked Questions: AI Compute Provenance and Corporate Governance

Does California SB 253, SB 261, or AB 1305 require companies to report AI compute provenance or token custody?

No. Neither California SB 253, enjoined SB 261, nor AB 1305—nor any current U.S. federal, state, or international sustainability statute—mandates AI token provenance or compute chain-of-custody reporting. Under SB 253 (Cal. Health and Safety Code § 38532 and CARB rules 17 CCR §§ 96070–96077, whose inaugural Scope 1 and Scope 2 deadline closed November 10, 2026), covered entities over $1 billion in revenue report greenhouse gas emissions in metric tons of CO2e, where AI data-center power appears only indirectly inside Scope 2 or Scope 3 energy totals. AB 1305 applies only when an enterprise markets or uses voluntary carbon offsets or makes public net-zero or low-carbon claims.

Does certified, spend-once compute exist today as a commercial cloud product or AICPA assurance standard?

No. Certified compute—defined here as inference tokens issued by a named lab, watermarked at execution, spendable once via cryptographic replay prevention, and backed by certifier risk absorption—does not exist as a commercial product, technical standard, or AICPA attestation framework today. Individual building blocks exist separately, including C2PA v2.4 Content Credentials, hardware enclave attestation (arXiv:2603.05786), and ephemeral Zero Standing Privilege brokers, but no model provider currently bundles serialized spend-once compute with issuer registry backing.

What is Scope 3 compute leakage, and why should corporate audit committees monitor it?

Scope 3 compute leakage is BC ESG’s governance term (an analytical parallel, not a statutory GHG Protocol category) for unauthorized external AI inference paid for by a company’s compromised bearer API credentials. As documented in FBI IC3 Flash Alert FLASH-20261113-001 and the October 2026 Fireworks AI LLMJacking bulletins, autonomous agents such as ARTEX harvest keys from exposed LiteLLM and One API gateways to self-fund external cyberattacks, blending stolen compute into legitimate cloud expenses.

Why do static prompt guardrails and output watermarks fail to establish an auditable chain of custody?

Primary 2026 security receipts identify structural limits in both layers. NIST’s June 2026 Gödel incompleteness proof established that static prompt filters cannot cover an infinite natural-language attack space, while roughly 30% (71/239) of AI breaches bypass prompts completely via SaaS/OAuth credentials. Meanwhile, client-side C2PA metadata can be stripped by screenshots or intermediaries, statistical watermarks degrade under paraphrasing, and hardware TEE enclaves verify code integrity without preventing semantic prompt injection.

How does BC ESG’s 116-row U.S. climate law census inform where AI compute oversight may travel next?

BC ESG’s November 2026 census across all 50 states, D.C., and 42 local jurisdictions shows that U.S. corporate accountability rarely begins with a uniform federal statute; instead, it consolidates through anchor-state rules (California SB 253 and AB 1305), sectoral insurance surveys (29 NAIC jurisdictions), local building ordinances (43 municipal rows), and enterprise procurement riders. By governance inference, AI compute custody pressure is likely to emerge first inside enterprise vendor questionnaires, cyber-insurance underwriting, and internal audit controls over 45:1–144:1 machine identities long before statutory mandates exist.

Primary Receipts & Official Authorities

• California Air Resources Board (CARB) — Corporate Greenhouse Gas Reporting Program (SB 253 / 17 CCR §§ 96070–96077)
• California Office of Administrative Law (OAL) — Rulemaking Approval Registry
• GHG Protocol — Corporate Accounting and Reporting Standard
• GHG Protocol — Scope 2 Guidance (Market-Based vs. Location-Based Contractual Instruments)
• GHG Protocol — Scope 3 Calculation Guidance
• U.S. EPA — Scopes 1 and 2 Emissions Inventorying and Guidance
• AICPA & CIMA — Audit and Assurance Standards
• FBI IC3 — Flash Alert FLASH-20261113-001 on Autonomous ARTEX Campaigns (Nov 13, 2026)
• NHIMG — State of Non-Human Identity (NHI) & AI Agent Breaches Report
• Fireworks AI — October 2026 Security Incident Update Bulletin
• NIST — Mathematical Proof on Static Guardrail Incompleteness (June 2026)
• NIST — AI Risk Management Framework (AI RMF)
• NIST CSRC — Signer Non-Repudiation Definition
• NIST CSRC — Cryptographic Nonce & Replay Prevention Definition
• DHS & DOT — Joint Briefing on Nationwide FAA Ground Stop (Nov 13, 2026)
• Google Cloud — europe-west2 Official Power Incident Xs2XTHzAVC9YnafnPyzj
• C2PA — Content Credentials Specification v2.4 Guidance

Informational Legal, Accounting, and Governance Disclaimer: This BC ESG brief is published solely for institutional regulatory intelligence, corporate governance, and internal-control analysis. Nothing in this publication constitutes legal advice, statutory compliance counsel, financial accounting guidance, or CPA audit or attestation services. As stated explicitly throughout, no current U.S. federal, state (including California SB 253, SB 261, or AB 1305), or international sustainability disclosure statute mandates AI compute provenance or token-custody reporting today, and “certified compute” is analyzed strictly as a conceptual governance proposal rather than an existing commercial product or assurance standard. Organizations should consult qualified legal counsel and independent assurance practitioners regarding statutory filings under 17 CCR §§ 96070–96077 and internal controls over enterprise AI infrastructure.