This page is for
Are you still running CBAM, EUDR, and DPP (Digital Product Passport) compliance on Excel sheets and supplier-submitted PDFs? Does verifying multi-tier supply chains still come down to self-declaration?
At audit, the regulator is not asking for the data itself — they're asking for verifiable grounds that the data arrived from the supplier of record, untampered. Does your organization have a cryptographic path that answers that?
- ESG, sustainability, and export-compliance leads at manufacturers, forestry, and consumer goods companies
- Procurement and supply chain teams aligning to CBAM (Carbon Border Adjustment Mechanism), EUDR (EU Deforestation Regulation), and DPP (under ESPR)
- Teams trying to lift multi-tier supply chain evidence (Tier-1 through Tier-5+) off paper and spreadsheets
- Functions preserving data residency and trade secrets (cost, contract terms) while still demonstrating regulatory compliance
- Teams rolling out autonomous procurement agents who need pre-order ESG-compliance verification
How Lemma approaches it
Lemma lets each tier of the supply chain issue ESG attributes (emissions, origin, labor conditions) as issuer-signed attestations, with cryptographic links to upstream tiers — a chain that survives across the full multi-tier structure. Raw materials data, supplier identities, and contract terms stay under the issuer's control. What crosses to the verifier is only the ZK proof: "below the CBAM threshold," "EUDR-compliant," "all DPP-required attributes present."
Double counting is structurally detected by the per-material cryptographic links. An autonomous procurement agent can verify the proof before placing an order — this is the path that lets the agent economy and supply chain regulation coexist.
Which of CBAM, EUDR, or DPP is creating the most immediate load — and how this attestation chain rides on top — is what we map out in a first conversation.
Lemma Discovery Call — Start with a 30-minute conversation
Tell us where compliance work concentrates today — across CBAM, EUDR, and DPP — and where the risk sits in your supply chain structure. We'll explore together whether Lemma's attestation chain could fit. No supplier contracts or cost information required.
If we see a fit, we move to NDA and then into per-regulation response mapping (CBAM calculation, EUDR DDS, DPP required attributes), reference architecture, and PoC design.
A real-world example: CBAM audit and multi-tier spreadsheets
An automotive parts manufacturer exports steel body panels to the EU. Once CBAM is fully in force, importers must pay a carbon price on embedded emissions and submit the calculation basis. Procurement runs five tiers deep — Tier-1: steel / Tier-2: mill / Tier-3: import trader / Tier-4: mining operator / Tier-5: power mix — and each tier reports emissions data up the chain via Excel and PDF.
At audit, the regulator is not asking for the aggregated data itself — they're asking for verifiable grounds that the data arrived from the supplier of record, untampered. There is no way to prove the provenance of a spreadsheet inside Excel. Worse, an autonomous procurement agent introduced to verify CBAM compliance pre-order finds no verifiable structure in the electronic data — and ends up waiting on a human final check.
With Lemma, each tier issues issuer-signed emissions attestations that pass up the chain, with per-material cryptographic links that structurally rule out double counting. The EU importer can verify via ZK proof that the embedded emissions sit below the CBAM threshold — without seeing supplier names or contract terms. At audit, the regulator verifies a cryptographic provenance chain instead of a stack of Excel files.
Sector-specific regulatory mapping (CBAM formula, EUDR DDS, DPP required attributes) and integration patterns with existing supplier-management systems (SAP Ariba, Coupa, etc.) are shared in the sector-specific kit we send after the consultation call.
Architecture in concept
Lemma does not replace your procurement system, ERP, or PLM. We add one layer in which each tier's supplier issues attestations carrying both a signature and a cryptographic link to the upstream tier, and the top-tier exporter presents the chain as a ZK proof to the regulator.
Each attestation carries the issuer's signature and a cryptographic link to the upstream tier, forming a per-material chain. When the same raw-material lot is allocated across multiple final products, double counting is structurally detected by those cryptographic links. Supplier trade secrets (cost, contract terms) stay protected, and the regulatory compliance lives in the ZK proof.
CBAM formula embedding, EUDR DDS integration, DPP required-attribute schema, and patterns for plugging into SAP Ariba, Coupa, and similar are detailed in the whitepaper and the post-call technical kit.
What Lemma cryptographically guarantees
- The issuer, issuance time, and applied methodology (GHG Protocol Scope 1-3, EUDR compliance criteria) at every tier
- Per-material cryptographic links to upstream tiers, ruling out double counting by construction
- Conformance with CBAM thresholds, EUDR criteria, and DPP required attributes
- No disclosure of supplier identity, contract terms, or cost — and pre-order verification by autonomous procurement agents
Ready to prove?
Talk to us about your use case. We respond within one business day.