How California’s Sweeping New Climate Laws May Impact Your Business

California recently enacted two sweeping and unprecedented laws that will require virtually all large companies who do any amount of business in California in any industry or sector to disclose their direct and indirect greenhouse gas (GHG) emissions (S.B. 253) and the financial risks they face as a result of climate change (S.B. 261). While there is existing precedent for more limited versions of these concepts, the breadth of California’s two new laws is much farther reaching, applying to a much wider array of businesses and requiring a broader scope of disclosures. The first reporting deadlines for these new laws is 2026—a date that is sure to sneak up fast, given the size of effort these laws will require in gathering, analyzing, and reporting data. Clients in every industry that do any amount of business in California and have more than $500 million in gross annual revenue—as well as smaller entities that may be asked to supply supporting information to directly regulated entities to whom they supply or purchase products or services— should take note and start preparing now. Here’s what we know, and don’t know, about both laws.

Greenhouse Gas Emissions Reporting (S.B. 253)

Who Must Report

S.B. 253, the Climate Corporate Data Accountability Act, applies to any U.S. company that made more than $1 billion in total annual revenue in the prior fiscal year and “does business in California,” regardless of where the company is headquartered or formed, regardless of whether it is public or private, and regardless of industry or economic sector. The bill does not define what it means to “do business in California.” If the state interprets this term as it does in other statutes, it’s likely to be far-reaching. For example, the California Revenue and Tax Code §23101 defines “Doing business” in California as “actively engaging in any transaction for the purpose of financial or pecuniary gain or profit.” (Emphasis added).

What Must be Reported

S.B. 253 requires annual public disclosure of direct and indirect greenhouse gas emissions—what’s called Scope 1, Scope 2, and Scope 3 emissions—via reports submitted to the California Air Resource Board (“CARB”).

1. Scope 1 emissions are direct emissions from owned or controlled sources, regardless of location. This can include, but is not limited to, fuel combustion activities, such as from gas or diesel power-vehicles or equipment owned by the reporting entity.
2. Scope 2 emissions are indirect emissions from the generation of purchased or acquired electricity, steam, heat, or cooling, regardless of location.
3. Scope 3 emissions are all other indirect upstream and downstream emissions from a company’s supply chain (aka, value chain emissions). Examples of Scope 3 emissions sources may include: production of goods the entity purchases and uses; end-use of goods the entity sells; the entity’s operational waste processed at different facility; business travel and employee commutes in vehicles not owned by the reporting entity; and investments and financed-emissions (emissions generated by a borrower of a bank). Because Scope 3 emissions are indirect, one entity’s Scope 1 emissions are in inherently another entity’s Scope 3 emissions.

The measuring and reporting of GHG emissions under S.B. 253 must be made in accordance with the standards and guidance of the Greenhouse Gas Protocol—a non-governmental organization that develops comprehensive global standardized frameworks to guide the voluntary measuring and reporting of GHG emissions, which standards and guidance were developed in partnership with the World Resources Institute (WRI) and World Business Council for Sustainable Development (WBCSD), and are widely utilized and referenced by corporations, non-governmental organizations, and government agencies alike, including by the U.S. Environmental Protection Agency[1] and the U.S. Securities Exchange Commission (SEC).[2] S.B. 253 specifically references the Greenhouse Gas Protocol Corporate Accounting and Reporting Standard, the Greenhouse Gas Protocol Corporate Value Chain (Scope 3) Accounting and Reporting Standard, and guidance for scope 3 emissions calculations that detail acceptable use of both primary and secondary data sources, including the use of industry average data, proxy data, and other generic data in its scope 3 emissions calculations. The state may choose different standards or guidance after 2033.

As a part of this reporting process, companies must also receive an “assurance engagement”—an audit of their emissions disclosures from an independent third-party and attestation as to accuracy. The statute requires assurance engagements for Scope 1 and 2 emissions at increasing certainty levels over time, and provides the California Air Resources Board with discretion to phase-in requirements for assurance engagements for Scope 3 emissions after evaluation of trends in third-party assurance requirements for Scope 3 emissions. The third-party assurance provider must have “significant experience in measuring, analyzing, reporting, or attesting to the emission of greenhouse gasses and sufficient competence and capabilities necessary to perform engagements in accordance with professional standards and applicable legal and regulatory requirements,” and these qualification requirements may be updated by CARB as necessary.

Reports will be submitted to CARB electronically via a to-be-created digital platform, which will then make the reports publicly available.

When Are Reports Due

Annual reporting requirements begin in 2026 for Scope 1 and 2 emissions, and in 2027 for Scope 3 emissions. Assurance engagements must be performed at a “limited assurance level” beginning in 2026, and at a “reasonable assurance level” beginning in 2030.

Fees and Penalties

Companies subject to S.B. 253 will need to pay an annual fee to be deposited into a Climate Accountability and Emissions Disclosure Fund, which is to be used to implement the law. The exact fee amount will be set by CARB and may be adjusted based on the Consumer Price Index.

A company that fails to comply with this law may be subject to civil penalties up to $500,000 per year, pursuant to regulations to be promulgated and enforced by CARB.

Regulations to be Promulgated

S.B. 253 is not self-executing— it requires CARB to promulgate regulations to iron out the details, consistent with the above-discussed framework, by January 1, 2025, as well as other regulations the agency deems “necessary and appropriate” to implement the bill.

Climate-Related Financial Risks Reporting (S.B. 261)

Who Must Report

The applicability of S.B. 261, the Climate-Related Financial Risk Act, is similar to that of S.B. 253, but S.B. 261 sets the annual revenue threshold at $500 million instead of $1 billion, and S.B. 261 exempts entities “in the business of insurance.” Thus, S.B. 261 applies to any non-insurance company that has an annual revenue of at least $500 million, regardless of where the company is headquartered or formed and regardless of whether it is public or private, so long as the company does any amount of businesses in California.

What Must be Reported

S.B. 261 requires applicable companies to disclose, via publication on their own websites, their climate-related financial risks and the measures they are taking to reduce or adapt to such risks.

The term “climate-related financial risk” is defined as any “material risk of harm to immediate and long-term financial outcomes due to physical and transitional risks, including, but not limited to, risks to corporate operations, provision of goods and services, supply chains, employee health and safety, capital and financial investments, institutional investments, financial standing of loan recipients and borrowers, shareholder value, consumer demand, and financial markets and economic health.”

These risks must be reported in accordance with the Final Report of Recommendations (and any successor report) of the Task Force on Climate-related Financial Disclosures (TCFD), an international non-governmental organization that is currently chaired by Michael Bloomberg and was created by the Financial Stability Board, another international non-governmental organization. Alternatively, the report may be prepared in accordance with a framework that is “equivalent” to that of the TCFD, such as the International Financial Reporting Standards Sustainability Disclosure Standards or a comparable framework issued by another governmental entity such as the SEC. Reports may be consolidated at the parent company level; thus, subsidiaries do not have to submit individual reports.

When Are Reports Due

Disclosures under S.B. 261 must be made by January 1, 2026, and every two years thereafter, on the company’s own website.

Fees and Penalties

Reporting companies will be required to pay an annual fee to cover the costs of implementing the law, in an amount to be set by CARB. The fees will be deposited into a new Climate-Related Financial Risk Disclosure Fund, to be used by CARB to implement the bill.

A company that fails to comply with this law may be subject to administrative penalties up to $50,000 per year, pursuant to regulations to be promulgated and enforced by CARB.

Regulations to be Promulgated

Unlike S.B. 253, S.B. 261 is self-executing in that it does not require CARB to first promulgate regulations for the reporting framework. The only regulations CARB must promulgate pursuant to S.B. 261 are those addressing fees and penalties.

How California’s New Laws Differ from the SEC’s Proposed Rules and EU Rules

In April 2022, the U.S. Securities and Exchange Commission (SEC) proposed a rule that would require the reporting of GHG emissions and climate-related financial risks, largely consistent with the GHG Protocol and TCFD guidance, respectively. The SEC’s yet-to-be-finalized proposed rule is similar to California’s two new laws, with three main differences: (1) the SEC’s proposed rules apply only to publicly traded companies; (2) the SEC’s proposed rules have no annual revenue threshold for determining which companies must report; (3) the SEC’s proposed rules, should they be approved, would apply sooner (in 2025); and (4) the SEC’s proposed rules include some safe harbor provisions related to Scope 3 emissions and only require reporting if a company has set GHG goals or targets which include Scope 3 emissions, or have otherwise determined scope 3 emissions are material.

Likewise, the EU has imposed GHG and climate risk reporting standards. However, the EU rules include a lower revenue threshold for determining whether an EU company must comply.

Risks and Recommendations

            California’s two new climate and emissions disclosure laws create several unknowns in terms of compliance requirements and subsequent risks.

• The scope of whom the laws apply to—whomever “does business in California” and whose annual revenue exceeds the set thresholds—is likely to be extremely broad, but is yet undefined.
• Because CARB will be promulgating regulations for S.B. 253 by 2025, and the first reporting deadline will be 2026, the preparation time for companies to get into compliance will be severely limited.
• The fact that the laws rely so heavily on the guidance and “standards” set by non-governmental organizations creates unknowns in terms of how companies can participate in the standard-setting process. In particular, because S.B. 261 does not require CARB to promulgate substantive regulations for climate-related financial risks and points solely to the TCFD or “equivalent” standards, the requirements for reporting entities may be subject to change at the whims of a non-governmental organization.
• It is yet unclear whether there will be sufficient availability of qualified, third-party entities to timely perform the “assurance” reports required by S.B. 253, particularly given how many organizations may be subject to this reporting law.
• The requirements in S.B. 253 to report Scope 3 emissions creates both uncertainty and is likely to require a large effort, given that a company’s Scope 3 emissions are the Scope 1 emissions of another company that may not be subject to these reporting requirements and, therefore, the availability or accuracy of such data is uncertain.
• Although S.B. 261 defines climate-related financial risks, the breadth of the definition and discretion in its interpretation creates uncertainty and compliance risks.
• While both laws aim to minimize duplication of efforts with similar reporting requirements by other laws or other government entities, companies may nevertheless be subject to overlapping, but slightly different requirements by different entities.
• How the information in both of these reports may interact with other laws, such as Federal Trade Commission truth in advertising regulations, is not yet clear.
• How the information from both of these reports may be used in future laws or regulations is unknown, but it is reasonable to expect that they may influence the creation of new laws that will require more substantive action to address emissions and climate change, rather than simply reporting information.
• Even if a company is not directly subject to these new California laws, it may get asked by its clients or customers that are directly subject to the laws for information to help the regulated entity submit its own report. Therefore, the potential reach of these laws is much broader than just the directly regulated entities.

One thing is clear, S.B. 253 and S.B. 261 will both require significant efforts by companies to gather the appropriate data, conduct the appropriate analysis, and create compliant reports, and the first 2026 deadlines for both laws is likely to sneak up fast. Accordingly, clients that do any amount of business in California and have more than $500 million in gross annual revenue—as well as smaller entities that supply or purchase from those regulated entities— should take note and start preparing now with attorneys and technical consultants.