California has enacted two mandatory climate disclosure laws that together represent the most far-reaching state-level sustainability reporting requirements in US history. The Climate Corporate Data Accountability Act, commonly known as SB 253, requires large companies doing business in California to publicly disclose their greenhouse gas emissions on an annual basis. The Climate-Related Financial Risk Act, known as SB 261, requires companies above a lower revenue threshold to publish biennial reports on their climate-related financial risks and the measures they are taking to address them. Both laws apply to public and private companies alike and are triggered by doing business in California — not by where a company is incorporated or headquartered. For many large US businesses, California’s climate disclosure laws represent the most immediately pressing mandatory climate reporting obligation they face, filling the gap left by the collapse of the SEC’s federal climate disclosure rules.
The two laws are not without controversy. Both have been challenged in federal court on First Amendment and other constitutional grounds. As of April 2026, SB 253 is fully in effect and proceeding on its compliance schedule — with the first reporting deadline of August 10, 2026 now imminent for a large number of US companies. SB 261, by contrast, was enjoined by the Ninth Circuit in November 2025 pending appeal, and its enforcement timeline remains uncertain. Understanding the current legal status of each law, and the compliance obligations that are actively in force, is essential for any large US business with California operations, customers, or employees.
The Statutory Background
California Governor Gavin Newsom signed both SB 253 and SB 261 into law in October 2023. The two bills were the product of a multi-year effort by California legislators and climate advocates to fill the void left by the absence of mandatory federal climate disclosure requirements. California has a long history of pioneering environmental regulation that later influences federal policy and other states — its vehicle emissions standards, renewable energy mandates, and cap-and-trade program all preceded comparable federal action. The 2023 climate disclosure laws fit squarely in that tradition, adopting mandatory GHG reporting and climate risk disclosure requirements that in several respects go further than what the SEC’s own 2024 climate disclosure rules would have required before those rules were abandoned.
The California Air Resources Board (CARB) was designated as the implementing agency for both laws. CARB spent 2024 and 2025 conducting workshops, developing regulations, and soliciting public comment on the detailed reporting requirements. In February 2026, CARB formally approved initial regulations under SB 253, establishing the scope of required disclosures, the reporting portal, the fee structure, and the August 10, 2026 deadline for the first round of Scope 1 and Scope 2 emissions reports. The SB 261 regulatory process has been delayed by the ongoing litigation.
SB 253: The Climate Corporate Data Accountability Act
Who Is Covered
SB 253 applies to any partnership, corporation, limited liability company, or other business entity — whether formed under California law, the laws of any other state, or federal law — that (1) has total annual revenues exceeding $1 billion, and (2) does business in California. The revenue threshold is assessed based on the lesser of the entity’s two most recent fiscal years of total annual revenues, providing some protection against companies that exceeded the threshold in one anomalous year. The law applies to both publicly traded and privately held companies.
The “doing business in California” standard is defined by reference to California Revenue and Taxation Code section 23101, but applied on a sales-only basis. Under CARB’s regulations, a company is doing business in California for purposes of SB 253 if its California sales exceed the inflation-adjusted threshold under that statute — approximately $735,019 as of 2024. Importantly, the property holdings and payroll tests that are part of the standard RTC section 23101 analysis do not apply for SB 253 purposes; only the California sales test is used. This means that a company can have no physical presence in California — no offices, no employees, no facilities — and still be covered if its California revenues exceed the threshold. E-commerce companies, software vendors, and other businesses that sell into California but operate elsewhere are not exempt simply because they lack a physical California footprint.
Five categories of entity are expressly exempt from SB 253: nonprofit and charitable organizations that are tax-exempt under the Internal Revenue Code; government entities, including companies more than fifty percent owned by a federal, state, or local government body; entities regulated as insurance companies by the California Department of Insurance or doing business as insurers in any other state (CARB’s February 2026 regulations extended this insurance exemption to SB 253, which had not explicitly included it in the original statute); and certain other entities specified by CARB. Subsidiaries of in-scope parent companies are assessed for coverage on an individual basis — a parent company is not automatically in scope simply because a subsidiary qualifies. However, in-scope entities may elect to report at a consolidated parent level, which in practice means that many large corporate groups will file a single consolidated emissions report covering their US operations.
What Must Be Reported: Scope 1, 2, and 3 Emissions
SB 253 requires in-scope companies to publicly disclose their greenhouse gas emissions across all three scopes defined by the GHG Protocol Corporate Accounting and Reporting Standard, which is the dominant global framework for corporate GHG measurement. Scope 1 emissions are direct emissions from sources owned or controlled by the reporting entity — including combustion in company-owned or leased facilities, company-owned vehicle fleets, and any industrial processes. Scope 2 emissions are indirect emissions from the generation of purchased electricity, steam, heat, or cooling consumed by the entity’s operations. Together, Scope 1 and Scope 2 represent the emissions that the company most directly controls, and they are typically the most straightforward to measure.
Scope 3 emissions are all other indirect greenhouse gas emissions that occur in a company’s value chain, both upstream and downstream. Upstream Scope 3 categories include emissions associated with purchased goods and services, capital goods, fuel and energy-related activities not covered by Scopes 1 and 2, transportation and distribution of inputs, waste generated in operations, and business travel and employee commuting. Downstream Scope 3 categories include emissions from the use of sold products, end-of-life treatment of products, transportation and distribution of outputs, and the operations of franchises and investments. For most companies, Scope 3 emissions represent by far the largest portion of their total GHG footprint — often comprising seventy percent or more of total emissions — and they are by far the most difficult to measure accurately, because they require gathering data from entities across the supply chain and customer base that are outside the company’s direct control.
It is this Scope 3 requirement that most distinguishes SB 253 from other US climate disclosure frameworks. The SEC’s 2024 climate disclosure rules eliminated Scope 3 from their final requirements before being abandoned altogether. SB 253 retains it, making California’s law more demanding than the federal rules would have been. The law provides a safe harbor for Scope 3 disclosures from the time Scope 3 reporting first becomes required through 2030: companies that disclose Scope 3 emissions with a reasonable basis and in good faith are protected from penalties for inaccurate Scope 3 figures during that period. Penalties may only be assessed for the failure to file Scope 3 disclosures, not for inaccuracies in the figures, provided the good faith and reasonable basis standards are met. This safe harbor reflects a legislative acknowledgment that Scope 3 measurement is an immature discipline and that penalizing companies for imprecision in their early Scope 3 reports would be counterproductive.
The 2026 Reporting Deadline and Phased Timeline
The first reporting deadline under SB 253 is August 10, 2026. For this inaugural reporting cycle, in-scope companies are required to disclose only their Scope 1 and Scope 2 emissions. CARB has exercised enforcement discretion to allow companies to report emissions data from the fiscal year immediately preceding the 2026 deadline that the company can determine from information it already possesses or is already collecting — a practical concession that reduces the burden on first-time filers by not requiring companies to retroactively build reporting infrastructure for data they did not collect.
The fiscal year data to be reported depends on when a company’s fiscal year ends. Entities whose fiscal year ended on or before February 1, 2026 are required to report data from fiscal year 2025–2026. Entities whose fiscal year ended after February 1, 2026 are required to report fiscal year 2024–2025 data. Companies must report through CARB’s designated emissions reporting organization and pay an annual reporting fee that CARB established as part of its February 2026 rulemaking.
Scope 3 emissions reporting begins in 2027. Starting in that year and annually thereafter, in-scope companies must publicly disclose their Scope 3 emissions no later than 180 days after their Scope 1 and Scope 2 emissions for the prior fiscal year are publicly disclosed. This gives companies with complex Scope 3 footprints additional time in each reporting cycle to gather supply chain and value chain data before their Scope 3 report is due. The safe harbor for good-faith Scope 3 disclosures runs through 2030, after which the full penalty framework applies to Scope 3 accuracy.
Third-Party Assurance Requirements
SB 253 requires companies to obtain independent third-party assurance of their emissions disclosures, phased in over time. Scope 1 and Scope 2 emissions must be subject to limited assurance — a review-level engagement in which the assurance provider evaluates whether the emissions figures are materially misstated without conducting a full audit — beginning with the first reports filed in 2026. The requirement escalates to reasonable assurance — a more rigorous standard comparable to a financial statement audit — on a timeline that CARB is still finalizing in its regulations. Scope 3 emissions will be subject to assurance requirements beginning in 2030, consistent with the expiration of the good-faith safe harbor.
The assurance requirement is one of the most significant compliance infrastructure demands of SB 253. Most companies that have not previously undergone third-party GHG assurance will need to build the internal data collection systems, documentation processes, and control frameworks that are prerequisites for any assurance engagement. Assurance providers — which may include both accounting firms and specialized sustainability assurance firms — will need to be engaged in advance of the reporting deadline, and the assurance process itself takes weeks or months. Companies that have been voluntarily reporting GHG emissions under frameworks such as CDP or the GHG Protocol, or that have already undergone TCFD-aligned assurance, will have a significant head start on meeting this requirement. Companies starting from scratch face a steep ramp.
Penalties for Non-Compliance
CARB is authorized to impose administrative penalties of up to $500,000 per reporting entity per year for non-filing, late filing, or other compliance failures under SB 253. This is a meaningful penalty for smaller in-scope companies but a relatively modest one for multinational corporations with billions in annual revenues. The California legislature has the authority to increase penalty levels through subsequent legislation, and advocates for the law have noted that the current cap may need to be revisited as the program matures. For the first reporting cycle in 2026, CARB has signaled that it will exercise enforcement discretion — focusing on getting companies into the reporting system rather than immediately penalizing good-faith compliance failures — but this discretion is not guaranteed to continue in subsequent years.
SB 261: The Climate-Related Financial Risk Act
Who Is Covered and What Must Be Reported
SB 261 casts a wider net than SB 253 in terms of who is covered but requires a different kind of disclosure. The law applies to US companies with total annual revenues exceeding $500 million that do business in California, using the same sales-based “doing business in California” standard that applies to SB 253. The lower revenue threshold means that SB 261 covers a substantially larger universe of companies than SB 253, reaching mid-sized businesses that fall below the $1 billion threshold for GHG emissions reporting.
Rather than requiring GHG emissions quantification, SB 261 requires in-scope companies to prepare and publicly disclose a biennial climate-related financial risk report. The report must disclose the company’s material climate-related financial risks and the measures it is taking to reduce and adapt to those risks. The law explicitly references the disclosure framework developed by the Task Force on Climate-Related Financial Disclosures (TCFD) as the applicable standard, aligning California’s requirements with the framework that has become the dominant global standard for climate financial risk disclosure. The TCFD framework organizes climate-related financial disclosures around four pillars: governance (how the board and management oversee climate risk), strategy (how climate risks affect the business), risk management (the processes used to identify, assess, and manage climate risks), and metrics and targets (the data used to measure and track climate-related performance).
Companies that already produce TCFD-aligned sustainability reports — either voluntarily or in response to investor requests — will find that the SB 261 framework maps closely to their existing disclosure practice. Companies that have not previously engaged with TCFD-style analysis will need to conduct a systematic assessment of their physical and transition risk exposure, evaluate how those risks affect their business model and financial condition, and document the governance structures and risk management processes through which they oversee those risks. This is analytically demanding work, particularly for companies in industries with significant climate exposure that have not previously thought rigorously about climate as a financial risk category.
Current Status: The Ninth Circuit Injunction
SB 261 is currently enjoined. On November 18, 2025, the Ninth Circuit Court of Appeals granted a preliminary injunction blocking enforcement of SB 261 pending the appeal of a district court ruling that had declined to enjoin the law. The injunction prohibits CARB from enforcing SB 261 against in-scope entities, which means that the January 1, 2026 statutory deadline for the first biennial report passed without any enforcement obligation for covered companies. CARB has stated that it will provide an alternate reporting deadline once the appeal is resolved.
The litigation was brought by the US Chamber of Commerce and allied business groups, who argue that SB 261 violates the First Amendment’s prohibition on compelled speech by forcing companies to publicly endorse a particular scientific and policy viewpoint about climate change. The plaintiffs also assert federal preemption arguments, contending that California’s climate disclosure requirements are preempted by federal securities law. The Ninth Circuit heard oral argument on January 9, 2026, but as of April 2026 has not issued a final decision on the appeal. A separate challenge to SB 261 filed by ExxonMobil, raising similar First Amendment and federal preemption arguments, has been placed on hold pending the Ninth Circuit’s ruling in the Chamber of Commerce case.
Critically, the Ninth Circuit’s November 2025 injunction applies only to SB 261. The court declined to enjoin SB 253, finding that the plaintiffs had not demonstrated a sufficient likelihood of success on the merits of their SB 253 challenge to warrant preliminary injunctive relief. SB 253 remains fully in force and its compliance timeline is proceeding on schedule. Companies should not assume that the legal uncertainty surrounding SB 261 provides any basis for deferring compliance with SB 253.
Key Differences Between SB 253 and SB 261
Although SB 253 and SB 261 are often discussed together as California’s “climate disclosure laws,” they impose distinct obligations and cover different, though overlapping, populations of companies. SB 253 is fundamentally a GHG emissions quantification and reporting law — it requires companies to measure their carbon footprint and disclose the numbers publicly. SB 261 is a climate financial risk disclosure law — it requires companies to analyze how climate change affects their business and describe their risk management response. A company with $800 million in annual California-qualifying revenues is subject to SB 261 but not SB 253. A company with $2 billion in annual revenues doing business in California is subject to both.
The two laws also operate on different reporting cadences. SB 253 requires annual GHG emissions disclosure. SB 261 requires biennial (every two years) climate risk reporting. And they involve different types of expertise: SB 253 compliance is primarily a data and measurement exercise requiring GHG accounting expertise, emissions factor databases, and supply chain data collection capability. SB 261 compliance is primarily an analytical and disclosure exercise requiring climate scenario analysis, financial risk assessment, and governance documentation. Large companies subject to both laws will need both capabilities, and building them together as an integrated climate disclosure program is more efficient than treating them as separate compliance workstreams.
The Litigation Landscape and What It Means for Compliance Planning
The constitutional challenges to California’s climate disclosure laws raise genuine legal questions that the courts have not yet definitively resolved. The First Amendment compelled speech doctrine, while most frequently applied in the context of political speech, has been extended to commercial speech contexts, and the argument that requiring companies to publicly disclose and implicitly endorse particular characterizations of climate risk crosses a constitutional line is not frivolous. The federal preemption arguments, grounded in the supremacy of federal securities regulation over state disclosure requirements, also have legal substance, though courts have historically given California significant latitude to regulate in the environmental space.
Despite the genuine legal uncertainty, companies should not treat ongoing litigation as a reason to defer compliance planning for SB 253, for three reasons. First, SB 253 was not enjoined. The Ninth Circuit specifically declined to extend the preliminary injunction to SB 253, meaning the law’s constitutional challenges have not found judicial receptivity at the preliminary stage. Second, the August 10, 2026 deadline for the first SB 253 report is imminent. Companies that begin compliance planning only after the litigation resolves — which could take years — will almost certainly miss the deadline and face penalty exposure. Third, building a GHG reporting program involves infrastructure investments — data systems, supplier engagement, methodology documentation, assurance provider relationships — that cannot be assembled on short notice. The companies that will be best positioned when the litigation dust settles are those that have used the intervening time to build.
Building a Compliance Program: Key Steps
The first step in any SB 253 compliance program is a scoping analysis to determine whether and to what extent the company is covered. This requires assessing total annual revenues against the $1 billion threshold, analyzing California sales to determine whether the doing-business standard is met, and identifying which legal entities within a corporate group are covered. Companies that operate through complex corporate structures — with multiple subsidiaries, joint ventures, and affiliated entities — may face genuinely difficult questions about how to assess coverage and whether consolidated reporting is available and appropriate.
Once coverage is confirmed, the next step is an emissions inventory gap assessment. Most large companies have some existing GHG data — from CDP disclosures, sustainability reports, or internal tracking — but the data may not be complete, consistent, or documented to the standard required for third-party assurance. A gap assessment identifies where data exists, where it is missing, and what methodology is being used to calculate emissions in each Scope 1 and Scope 2 category. For companies with significant owned facilities, manufacturing operations, or vehicle fleets, Scope 1 data collection typically involves direct measurement or metered utility data. For Scope 2, the primary input is purchased electricity consumption, which most companies can obtain from utility bills, though the choice of market-based versus location-based accounting methodology can significantly affect the reported figure.
For the 2026 first-year report, companies should focus on getting Scope 1 and Scope 2 data right, engaging an assurance provider early, and establishing the documentation and internal controls that will be needed for the limited assurance engagement. The assurance provider should be engaged before the reporting methodology is finalized — providers will have views on which methodologies meet their professional standards, and reconciling methodology choices with assurance requirements after the fact is inefficient and risky.
Scope 3 preparation should begin now even though first-year Scope 3 reporting is not due until 2027. The reason is simple: building a Scope 3 inventory requires supplier engagement, procurement data analysis, and methodology decisions that take considerable time. A company that waits until mid-2026 to begin its Scope 3 program will struggle to have reliable, documented, assurance-ready figures by 2027. The most resource-intensive Scope 3 categories for most companies are Category 1 (purchased goods and services), Category 11 (use of sold products), and Category 12 (end-of-life treatment of sold products) — all of which require data from entities outside the company’s direct control.
Governance is the third pillar of a compliance program. SB 261 — to the extent it becomes enforceable — will require companies to describe how their board and management oversee climate-related financial risks. Even absent SB 261 enforcement, building the governance infrastructure to identify, assess, and manage climate risk is necessary to support accurate disclosure. This means assigning clear ownership of climate disclosure at the management level, establishing a board-level oversight mechanism (whether a dedicated committee or periodic full-board reporting), and creating documentation of how climate risk is integrated into the company’s risk management processes.
Interaction with Other Disclosure Frameworks
California’s climate disclosure laws do not exist in isolation. Companies subject to SB 253 may also be subject to the EU’s Corporate Sustainability Reporting Directive (CSRD) if they have significant EU revenues or operations. The CSRD requires detailed climate-related disclosures under the European Sustainability Reporting Standards, including both physical and transition risk analysis, governance descriptions, and GHG emissions data across all three scopes. A company that builds a comprehensive GHG reporting program in response to SB 253 will have the core emissions data infrastructure needed to support a significant portion of its CSRD climate-related disclosures as well. Treating California compliance and EU compliance as a single integrated program rather than two separate exercises reduces duplication and ensures consistency across the company’s climate disclosures.
Public companies should also ensure that their SB 253 and SB 261 (if and when enforceable) disclosures are consistent with the climate-related information they include in their SEC filings. The SEC’s existing materiality framework — which predates the 2024 climate rules and remains fully in force — requires public companies to disclose material climate-related risks in their annual reports and other public filings. A public company that discloses significant physical or transition risks in its California climate-related financial risk report but omits those same risks from its 10-K faces potential securities law liability for inconsistent and incomplete disclosure.
What Companies Should Do Now
For any company with total annual revenues exceeding $1 billion and California sales above approximately $735,000, the August 10, 2026 SB 253 deadline is immediate. Companies that have not already begun their compliance programs should treat this as an urgent priority. At a minimum, the following actions should be taken before the end of the second quarter of 2026: confirm corporate group coverage and determine whether consolidated reporting is available; compile available Scope 1 and Scope 2 data and identify gaps; select a reporting methodology consistent with CARB’s regulations and the GHG Protocol; engage a third-party assurance provider; and register with CARB’s emissions reporting organization. Companies in this situation should consider engaging outside legal counsel with climate disclosure expertise to manage the regulatory risk and coordinate the compliance process.
For companies in the $500 million to $1 billion revenue range, SB 261 compliance preparation is warranted even given the current injunction. The Ninth Circuit may uphold the law, modify it, or strike it down — but the outcome is not known and the preparation timeline for TCFD-style climate risk disclosure is not short. Companies that use the period of SB 261 uncertainty to conduct climate scenario analysis, assess physical and transition risks, and document their board-level governance structures will be well positioned regardless of how the litigation resolves. They will also have a more defensible record if their SEC filings or investor disclosures are ever scrutinized for completeness on climate risk matters.
California’s climate disclosure laws are, in one important sense, the successor to the federal regulatory ambition that collapsed with the SEC’s retreat from its 2024 climate rules. For US businesses, they represent a new compliance reality — one driven by state law rather than federal regulation, by the world’s fifth-largest economy asserting its authority to require transparency from the large companies that do business within its borders. The companies that will manage this transition most effectively are those that treat climate disclosure not as a regulatory burden to be minimized, but as an enterprise risk management capability to be built.