California SB 253 and SB 261: Are You Ready?

The launch of California’s mandatory climate-disclosure duo — SB 253 (the Climate Corporate Data Accountability Act) and SB 261 (the Climate-Related Financial Risk Act) — is imminent.

These landmark laws represent a significant, near-term regulatory shift for companies operating in the state, regardless of headquarters. Initial filings are due January 1, 2026, with the filing portal opening just a month prior. Compliance requires immediate action and proven reporting expertise.

The complexity of these new rules, particularly the ramp-up of assurance requirements and the global revenue threshold, demands a clear, authoritative strategy.

This guide will help you navigate the complexity with clear timelines, required deliverables, and an expert discussion of what happens if your company files late.

What Is Required for Compliance

---

SB 253 (The Emissions Rule)

If your company does business in California and has more than $1 billion in total annual revenue globally, you must disclose Scope 1, 2, and 3 greenhouse gas (GHG) emissions annually, aligned to the GHG Protocol, on a public digital platform administered by CARB (the California Air Resources Board).

Assurance Requirements:

• 2026: Limited assurance for Scopes 1 and 2 emissions begins in 2026.
• 2030: Reasonable assurance required for Scopes 1 and 2 by 2030. This transition requires a deep understanding of audit-level controls and data lineage.
• 2030: Limited assurance for Scope 3 by 2030. (A safe harbor for Scope 3 misstatements remains in effect until 2030.).

---

SB 261 (The Climate-Related Financial Risk Rule)

If your company does business in California and has more than $500 million in total annual revenue globally, you must publish a biennial climate-related financial risk report. This report must align with TCFD/ISSB-style frameworks (governance, strategy, risk management, metrics and targets).

The first report is due January 1, 2026. CARB has posted a draft reporting checklist and will run a public docket where companies post their report links. Insurers are exempt because they report under separate rules.

Penalties for Non-Compliance:

Non-compliance can result in significant penalties: up to $500,000 per year for SB 253 violations and up to $50,000 per year for SB 261. While CARB has signaled enforcement discretion for SB 253’s first cycle in 2026 if companies demonstrate good-faith efforts, a strategy based solely on this is risky.

Five Questions to Determine If Your Company Is in Scope

1. Do you “do business” in California?

CARB references the state’s Revenue & Taxation Code §23101: actively engaging in transactions for financial gain counts, along with bright-line tests for sales, property, or payroll presence. This also captures non-California-headquartered firms with a footprint or meaningful commerce in the state.

2. What is your global revenue?

• > $1B last fiscal year means you are likely in scope for SB 253.

• > $500M last fiscal year means you are likely in scope for SB 261. Anticipate that global revenue will be used, not California-only revenue.

CARB’s working concept for “total annual revenue” is gross receipts (per §25120(f)(2)), but it is still being refined in rulemaking. Expect global revenue, not California-only.

3. Are you an insurer?

Insurers are exempt from SB 261 (they already report under insurance-specific climate rules). CARB’s decision on exempting insurers from SB 253 is pending.

4. Are you part of a larger business group?

CARB has indicated parent-level consolidation may be permitted, meaning subsidiaries covered by a parent disclosure would not file a separate report.

5. Could you be in scope for both?

Yes. Given the revenue ranges and broad “doing business” test, many companies will fall under both SB 253 and SB 261.

Key Dates and Compliance Timelines

---

Now–December 2025:

CARB is holding workshops and drafting regulations. Draft SB 261 checklist is live (link above), and draft SB 253 templates are expected by December 2025 with finalized regulation in 2026.

December 1, 2025:

SB 261 public docket opens for companies to post a link to their climate-financial risk report.

January 1, 2026:

First SB 261 report due (with a required biennial cadence thereafter).

June 30, 2026 (proposed):

• For SB 253, companies will have to file their Scope 1 and 2 disclosures using FY 2025 data. CARB is still working on finalizing this date, so treat it as the working assumption until the final ruling. 

• Limited assurance on Scope 1 and 2 kicks in.

2027:

Scope 3 disclosures begin for FY 2026 data (exact due-date structure yet to be set by CARB). Scope 3 is under a safe harbor until 2030, meaning that there will be no penalties for good-faith misstatements. However, there will be penalties for non-filing.

2030:

Companies must have reasonable assurance for Scope 1 and 2 and limited assurance begins for Scope 3.

Required Compliance Deliverables

---

SB 253 (The Emissions Rule) Deliverable:

1. Annual GHG Inventory

This is an annual GHG inventory aligned with the GHG Protocol and submitted on a public digital platform administered by CARB.

• Scope 1: Direct emissions (owned/controlled sources).

• Scope 2: Purchased electricity, steam, heat, and/or cooling.

• Scope 3: Value-chain emissions, both upstream and downstream (e.g., purchased goods and services, use of sold products, transportation, business travel, investments, end-of-life). Companies should target June 30, 2026, for FY 2025 Scope 1 and 2 disclosures unless CARB finalizes differently. Scope 3 follows in 2027 for FY 2026 data.

2. Third-Party Assurance

• Limited assurance for Scope 1–2 begins in 2026, with reasonable assurance required by 2030. (Reasonable assurance is a higher, audit-like confidence level).

• Scope 3: Limited assurance by 2030 (subject to CARB review).

---

SB 261 Deliverable: Climate Risk Report

A public, decision-useful report posted to your website that addresses the following four TCFD/ISSB pillars:

• Governance of climate risks (board & management roles).
• Strategy (material risks & opportunities; resilience under scenarios).
• Risk management processes (to identify, assess, manage, integrate).
• Metrics & targets (KPIs, targets, progress).

Your Compliance Readiness Roadmap

1. Confirm applicability

Map your legal entities against §23101 tests, determining if you are in the > $1B category (SB 253) and/or the > $500M category (SB 261). If you are in a corporate family, decide whether the parent will file on behalf of subsidiaries (subs). Document this decision.

2. For SB 253: Lock your emissions accounting plan

• Choose inventory boundaries (equity share vs. control), data owners, and GHG Protocol methods.

• Scopes 1 and 2: If you have not already done so, establish processes to capture 2025 data now. Utilize utility invoices, fuel purchases, metering, and other available energy spend data.

• Scope 3: Start with Purchased Goods & Services, Upstream Transportation, Use of Sold Products, and Investments (if applicable). Decide whether to use primary or secondary data and build supplier request forms or other outreach mechanisms.

• Assurance readiness: Select an independent verifier (e.g., an audit firm or other accredited body) and pilot your internal controls. This includes data lineage, calculation files, and management review records.

3. For SB 261: Build a TCFD/ISSB-style narrative

• Draft around the four TCFD/ISSB pillars: governance, strategy, risk management, and metrics/targets.

• Scenario analysis: Select at least two plausible climate scenarios (e.g., a transition-intensive $1.5-2℃ pathway and a hotter physical-risk world) and describe business impacts and resilience measures for each.

• Integration: Demonstrate how climate risk integrates into enterprise risk management, capital expenditures (capex), strategy, and targets.

• Use CARB’s draft checklist as your outline and aim for decision-useful specificity using plain English. Publish the report by January 1, 2026, and add the URL to CARB’s docket.

4. Stand up governance and controls (for both laws)

• Form a cross-functional disclosure committee (Tap experts in Finance, Legal, Sustainability, Risk, Supply Chain, and IT.)

• Approve policies and procedures for data collection, calculation, review, and issue escalation.
  

5. Budget and vendors

• Expect flat filing fees and separate assurance costs, which will vary with scope, data quality, and the provider.

• If you engage software, confirm it supports GHG Protocol, supplier data collection, and audit trails. Export to CARB’s templates once finalized.
  

6. Legal and communication protocols

• Align with forward-looking statement practices; ensure statements about targets and transition plans are grounded in documented assumptions.

• Align SB 253 and SB 261 outputs with any other framework or standard used for other reports that may be published elsewhere, so you don’t create contradictions across filings.

Penalties and Enforcement

• SB 253: Non-compliance could cost your company up to $500,000/year. Non-compliance includes late, missing, or otherwise deficient filings. Scope 3 has a safe harbor until 2030, with penalties for non-filing only in 2027–2029 and no penalties for good-faith misstatements. CARB will use enforcement discretion for incomplete 2026 filings if you’ve made good-faith efforts.

• SB 261: Up to $50,000/year for failing to publish or for inadequate reports. CARB has stressed good faith matters, but there is no extension to the January 1, 2026 due date. Public scrutiny is part of the design (your link goes on a state docket).

FAQs Leaders Are Asking

If our fiscal year ends in September, when are we due?

CARB has floated a single calendar due date (for example, June 30, 2026, for FY 2025 Scope 1 and 2) rather than “months after fiscal year-end.” Watch for final rules and plan for a common date.

What does “good faith” look like?

Document your process, data sources, assumptions, controls, and management review. Keep audit trails. File on time, even if parts are estimated or marked preliminary, and explain your improvement plan.

Can we reuse disclosures from our sustainability report?

Yes, if your California filings meet the specific timing, content, platform, and assurance requirements. Many companies will harmonize disclosures to reduce duplication.

The Value of Early Preparation

Assurers will face high demand.

Limited assurance in 2026 means hundreds — possibly thousands — of companies will seek qualified providers simultaneously. Early preparation will ensure smoother attestation, fewer findings, and better pricing.

The “good faith” cushion is not a guarantee of leniency.

Filing late or neglecting Scope 3 planning will draw regulatory scrutiny, and increases risk.

Next Steps for Compliance

California’s climate-disclosure laws are moving forward. SB 261 risk reports go live January 1, 2026. SB 253 emissions reporting starts in 2026 for Scopes 1 and 2, with Scope 3 following in 2027. Assurance requirements ramp through 2030. Use the time left in 2025 to lock scope, build reports, stand up controls, and secure your assurance partner.

OBATA specializes in climate-disclosure readiness and TCFD/ISSB alignment.

Schedule your confidential consultation to establish your compliance strategy and secure a smoother 2026 filing.