What is covered?

SB 253: Climate Corporate Data Accountability Act (the CCDAA)

The CCDAA requires annual GHG emissions reporting requirements for covered entities, beginning with Scope 1 and Scope 2 emissions in 2026 and adding Scope 3 emissions in 2027:

• • Scope 1: Direct emissions from sources an entity owns or directly controls, including emissions from fuel combustion.
  • Scope 2: Indirect emissions associated with purchased or acquired electricity, steam, heating, and cooling.
  • Scope 3: Other indirect upstream and downstream value-chain emissions from sources the entity does not own or directly control. Examples may include purchased goods and services, business travel, employee commuting, transportation, investments, and the processing and use of sold products.

The law requires that entities should measure and report emissions in conformance with the Greenhouse Gas Protocol standards and guidance developed by the World Resources Institute and the World Business Council for Sustainable Development. Starting in 2027, entities will be required to obtain independent third-party limited assurance covering Scope 1 and Scope 2 emissions. By 2030, assurance requirements are expected to scale in both coverage (e.g., including Scope 3 emissions) and rigor (e.g., increasing to reasonable assurance for Scope 1 and 2 emissions).

SB 261: Climate-Related Financial Risk Act (the CRFRA)

The CRFRA establishes a biennial requirement for covered entities to disclose their climate-related financial risks and the measures they’ve adopted to reduce and adapt to those risks. Reports may align with the Task Force on Climate-related Financial Disclosures (TCFD) framework or an equivalent reporting framework such as the IFRS Sustainability Disclosure Standards issued by the International Sustainability Standards Board (ISSB).

Climate-related financial risks generally fall into two categories:

• • Physical risks: Risks resulting from the physical effects of climate change. These may include acute events, such as hurricanes and wildfires, and chronic changes, such as rising sea levels or long-term shifts in temperature and precipitation.
  • Transition risks: Risks associated with the transition to a lower-carbon economy, including policy, legal, market, technology, and reputational risks.  

Climate-related financial risk reports generally address four disclosure areas:

• • Governance: How the organization oversees and manages climate-related risks.
  • Strategy: How climate-related risks and opportunities could affect the organization’s business model, strategy, and financial planning, including under different climate scenarios.
  • Risk management: How the organization identifies, assesses, and manages climate-related risks and integrates them into broader risk-management processes.
  • Metrics and targets: The metrics and targets used to monitor climate-related risks and opportunities, which may include Scope 1, Scope 2, and Scope 3 emissions.

Entities that do not complete all recommended disclosures are instructed to report to the best of their ability, explain any disclosure gaps, and describe the steps they will take to prepare more complete disclosures. Although enforcement of SB 261 is currently paused, the law has not been repealed. Companies should continue monitoring the litigation and CARB guidance, and may choose to voluntarily publish and submit a climate-related financial risk report.

What are the potential penalties for noncompliance?

SB 253 allows for a maximum penalty of $500,000 per year for non-filing, late filing, and other violations. Companies found in violation of SB 261 could be fined up to $50,000 per reporting year. Penalty exposure is only one consideration. Because submitted reports and statements may be made publicly available, companies should also evaluate the consistency, supportability, and stakeholder implications of the information they disclose.

How do companies report?

Organizations entering California climate disclosure compliance are approaching the first reporting cycle from different levels of maturity. Some entities already maintain greenhouse gas inventories through voluntary reporting programs such as CDP, customer requests, or sustainability reports and may be able to leverage existing disclosures to satisfy SB 253 requirements. Others may still be establishing foundational data collection processes and may elect to use CARB's first-year reporting flexibility.  

Before submitting a report, companies should:

1. 1. Confirm legal applicability and the entities included with the reporting boundary
   2. Determine the applicable reporting period (i.e., fiscal year)
   3. Identify the reporting pathway available to the entity, such as reporting emissions data or submitting a statement of non-reporting
   4. Assign accountability for data collection, calculation, review, approval, and submission
   5. Evaluate whether existing emissions information is sufficiently documented and supportable

The guidance below focuses primarily on SB 253 compliance because enforcement of SB 261 remains paused pursuant to ongoing litigation. However, companies may still choose to voluntarily submit climate-related financial risk reports through CARB’s public docket while monitoring future regulatory developments.

2026: Complete the first reporting cycle

By Nov. 10, 2026, reporting entities may use one of two pathways:

Submit Scope 1 and Scope 2 emissions data

Depending on an entity’s fiscal year end, it may report fiscal year 2025 or fiscal year 2026 Scope 1 and Scope 2 emissions data through:

• • • An existing annual report that includes Scope 1 and 2 emissions data
    • Scope 1 and 2 emissions data already reporting to another program or voluntary initiative
    • CARB’s Draft Scope 1 and Scope 2 Reporting Template (XLS)

Companies electing to report emissions should maintain supporting documentation for organizational boundaries, activity data, emission factors, estimation methodologies, and any assumptions used in the inventory. While third-party assurance is not required for 2026 submissions, maintaining an audit trail can significantly reduce future compliance efforts as assurance requirements expand.

Submit a statement of non-reporting

A statement of non-reporting includes a statement on company letterhead indicating the company was not collecting Scope 1 & 2 data as of Dec. 5, 2024, and was not planning to collect such data when CARB’s Enforcement Notice was issued. This pathway should be understood as limited first-year flexibility rather than a long-term substitute for emissions reporting. An organization using this option should use the additional time to establish its emissions accounting methodology, identify data owners, develop collection processes, and prepare for future filing obligations.

The emissions data or statement of non-reporting should be submitted by Nov. 10, 2026 either through CARB’s voluntary intake platform or by email to climatedisclosure@arb.ca.gov. CARB will provide a written fee notice to each reporting entity on or before Dec. 10, 2026.  

CARB has also indicated that it will exercise enforcement discretion during the initial reporting cycle and has emphasized facilitating first-year reporting efforts. Companies should nevertheless maintain evidence supporting their selected reporting pathway and document the decisions made during the submission process.

2027 and beyond: Expand reporting and assurance

Following the initial cycle, entities will be required to report Scope 3 emissions in addition to Scope 1 and Scope 2 emissions. Limited assurance over Scope 1 and Scope 2 emissions is also expected to begin in 2027. Companies should therefore begin preparing Scope 3 inventories during 2026. Initial activities may include screening relevant Scope 3 categories, identifying likely emissions hotspots, engaging procurement and operational teams, evaluating supplier and value-chain data availability, and documenting calculation and estimation methodologies.

The format and submission method for future reporting periods are expected to be determined in 2027. Entities should continue monitoring CARB guidance, litigation developments, and changes to applicable reporting and assurance requirements. Assurance requirements are expected to expand to cover reasonable assurance for Scope 1 and 2 emissions and limited assurance for Scope 3 emissions in future years. Rather than treating each reporting deadline as a separate exercise, organizations should establish processes that can mature over time. This includes strengthening data governance, formalizing review and approval procedures, improving documentation, and preparing for changes in reporting formats, submission methods, and assurance requirements.

For more information on the distinctions among assurance standards and levels of assurance, read CohnReznick’s thought leadership article: Preparing for the Next Era of Sustainability Assurance.

How do companies prepare?

Compliance begins with understanding the law, but long-term readiness depends on the people, processes, controls, and systems used to produce the underlying information. Companies should develop a reporting approach that can scale as climate requirements, stakeholder requests, and assurance expectations evolve. The following two-phase framework can help organizations move from initial diagnosis to operational readiness.

Diagnose and prioritize

• • Understand the requirements. Determine whether your organization falls within the scope of SB 253, SB 261, or other climate disclosure requirements, and confirm applicable reporting boundaries and obligations.
  • Assess current reporting maturity. Evaluate the organization’s existing sustainability disclosures to identify which information is already available, where gaps exist, and whether current processes can generate complete, consistent, and traceable reporting.
  • Develop an implementation roadmap. Translate identified requirements and gaps into a practical action plan. Establish governance structures, define responsibilities across departments, secure leadership sponsorship, and prioritize activities based on regulatory deadlines, business risk, and data availability.
  • Enable effective data systems. Determine how the organization will collect, calculate, review, retain, and report sustainability information on an ongoing basis. Depending on organizational complexity, this may involve controlled spreadsheet-based processes, specialized carbon accounting software, or a combination of both.

Measure and evaluate

• • Develop a GHG inventory. Establish a greenhouse gas inventory aligned with the Greenhouse Gas Protocol by defining organizational and operational boundaries, collecting activity data, selecting emission factors, documenting methodologies, and calculating Scope 1 and Scope 2 emissions. Companies should also begin identifying material Scope 3 categories and assessing data availability across the value chain.
  • Assess climate-related financial risks. Evaluate how climate-related physical and transition risks may affect operations, assets, supply chains, customers, and financial performance. This may include conducting climate risk assessments, facilitating stakeholder interviews, evaluating impacts under different climate scenarios, identifying adaptation opportunities, and integrating climate considerations into broader enterprise risk management (ERM) processes.
  • Establish reporting metrics and disclosure. Determine which disclosures, metrics, assumptions, methodologies, and narrative explanations will be included in public reporting. This step helps identify disclosure gaps and establish a consistent reporting approach before filing deadlines arrive.

Operationalize and build trust

• • Prepare for assurance. Assign ownership for emissions and climate-related data, document methodologies, establish review and approval procedures, retain supporting evidence, and implement controls over data collection and reporting processes. Pre-assurance readiness assessments can help organizations identify process, documentation, and governance gaps before assurance requirements become mandatory.
  • Build a practical Scope 3 program. Companies should prioritize likely emissions hotspots, engage internal stakeholders, document estimation methodologies, and establish a phased approach for improving data quality over time. Supplier engagement can also help companies understand dependencies, strengthen supply-chain resilience, and align climate-related requests with broader procurement and risk-management objectives.
  • Connect compliance to business value. The greatest value often comes not from compliance itself, but from using climate data to make better business decisions. Use the reporting process to identify operational efficiencies, risk-management opportunities, and potential changes to products, services, or stakeholder engagement. 

Turn compliance into capability 

California’s climate laws require companies to produce new disclosures, but the longer-term business value lies in the capabilities developed through the reporting process. Reliable emissions and climate risk information can improve decision-making, reveal operational and value-chain vulnerabilities, and help organizations respond more efficiently to investor, customer, lender, and regulatory requests. 
 

Companies that begin early will be better positioned to address data gaps, engage internal stakeholders, prepare for assurance, and respond as regulatory expectations evolve. Even for entities that are not currently subject to the California laws, developing disciplined climate reporting processes can demonstrate risk readiness and provide a stronger foundation for future disclosure demands. 

The objective should not be to complete a one-time compliance exercise. It should be to build a credible, scalable climate reporting capability that strengthens with each reporting cycle.