CARB's first-year guidance lets companies file without assurance, reuse existing data, or submit a letterhead statement. Every filing will be public, and scope 3 and assurance arrive in 2027.
Key Takeaways
Six weeks from now, California's corporate climate disclosure law stops being a compliance project and becomes a public record. The first reports under SB 253 are due November 10, and the California Air Resources Board has spent September making that first filing as easy as it could reasonably be. Assurance is optional. Old data is acceptable. Companies with nothing to report can say so on letterhead. That generosity is real, and it is also the reason so many companies risk misreading what comes next. The guidance covers one cycle, and every filing made under it will be visible to investors, customers and activists long after the lenient rules have expired.
The law reaches further than many companies assume. It applies to entities that do business in California and have more than $1 billion in total annual revenue, public or private, wherever they are incorporated, according to Sweep's review of the early September guidance. Proskauer notes that CARB measures the revenue threshold by the lesser of an entity's two previous fiscal years of revenue, so a single strong year does not trigger coverage on its own. Obsidian Regulatory Intelligence points to Apple, Chevron, Alphabet and Walmart as examples of the companies in scope.
The dividing line is a date. CARB's enforcement notice of December 5, 2024 splits covered companies into two groups, as Donnelley Financial Solutions lays out. Companies that were already collecting emissions data submit scope 1 and 2 figures, with or without limited assurance. Companies that were not file a statement of non-reporting on company letterhead by November 10. Neither path permits doing nothing. Filers can submit an existing annual report that already contains the figures, data they reported to another regulatory program or voluntary initiative, or CARB's draft template, which remains voluntary. CARB will also not require a single emissions factor dataset this year: EPA's eGRID 2023, eGRID 2024 or other credible sources are all acceptable.
Reports can go through a voluntary intake platform on CARB's ArcGIS portal or by email. The platform asks for more than the guidance might suggest. As a Mondaq analysis of the intake form details, it requests the full legal name as filed on tax forms, a federal EIN, California Corporation Number or Secretary of State file number, and the California Principal Business Activity code from the company's state tax filing, entity by entity. Groups with many subsidiaries should expect the entity mapping to take longer than the emissions math.
Three features of this first cycle are permanent, and they matter more than the flexibility. The first is publicity. Uploaded emissions reports and statements of non-reporting will be made public, and CARB tells filers not to include confidential business information. A letterhead statement saying a billion-dollar company was not measuring its own emissions in late 2024 is a document that will be quoted back.
The second is cost. All covered entities will be assessed a fee regardless of whether they submit emissions data or a non-reporting statement. Invoices go out on or before December 10, 2026, with payment due within 60 calendar days, and Sweep notes the fee is adjustable by the California Consumer Price Index. The third is enforcement. CARB has said it will exercise enforcement discretion in the first cycle, but civil penalties for non-filing and late filing reach up to $500,000 a year, and Obsidian stresses that the penalty accrues for each year of non-compliance rather than as a one-off fine.
The legal picture is also sharper than headlines suggest. The Ninth Circuit injunction pauses only SB 261, the companion climate-related financial risk law, not SB 253, so the November deadline stands. CARB approved its Initial Regulation on February 26, 2026 and withdrew it on June 24 for clarifying changes, which is part of why companies are reading guidance documents rather than final rules six weeks out.
The flexibility has an expiry date written into it. DFIN quotes the guidance directly: it applies only to the 2026 reporting cycle, and requirements for 2027 and beyond are being developed through a second rulemaking. Under Obsidian's timeline, scope 3 reporting and limited assurance both begin in 2027, with reasonable assurance required from 2030. According to GSI Environmental, CARB has proposed requiring the five most commonly reported scope 3 categories from 2027: purchased goods and services, fuel and energy related activities, waste, business travel and employee commuting. Nothing in the guidance carries the letterhead option past this cycle, which is the detail that should worry those filers most. They face their first emissions inventory and their first value chain disclosure in the same year.
That is the trap in the easy first year. A company that files an old sustainability report this November and treats the job as done will enter 2027 needing assured scope 1 and 2 figures, a first scope 3 inventory built on supplier data it has never requested, and processes that can survive an auditor, all under rules that do not exist yet. The companies that use the next six weeks well will treat November as a dry run for that year, not as the finish line.

Report
The November filing is only the first of SB 253's obligations. Watershed's guide sets out who is covered, how the timelines stack from scope 1 and 2 through scope 3, and how to structure data collection so the 2027 report is not built from scratch.
Download
Guide
Scope 3 reporting in 2027 depends on emissions data that sits with suppliers, not in your own systems. This walkthrough shows how a shared supplier data platform helps companies meet disclosure laws that reach into the value chain.
Download
Report
CARB's 2026 guidance expires with this cycle, and a second rulemaking will set the rules for 2027 and beyond. This report quantifies what regulatory intelligence saves in audit costs and response time when requirements keep moving.
Download
Brussels narrowed its due diligence law to the very largest companies. Its Forced Labour Regulation has no size threshold, reaches every tier of the supply chain, and applies from December 2027.
Brussels wants at least 30% of every public tender scored on quality, including environmental and social impact. For suppliers chasing a €2.5 trillion market, sustainability data is about to become bid-winning evidence.
The SEC final rule on climate-related disclosures reshapes reporting obligations for public companies. We break down the key requirements, timelines, and compliance strategies.