Climate disclosure rules for U.S. companies, SEC and California mandates

What to take away

What the SEC climate disclosure rule requires of U.S. issuers

The SEC climate disclosure rule was adopted to put climate risk reporting inside the periodic reports that public companies already file. The rule appeared on the agency's rulemaking agenda alongside other disclosure items, as the SEC rulemaking activity page shows.

Its core idea is that investors need comparable information about how climate-related risks affect a registrant's business, results and financial condition.

For a U.S. issuer, the rule turns climate into a disclosure controls problem. Material climate risks must be described in registration statements and annual reports, not in a separate sustainability PDF. That means the same people who sign off on financial statements need to understand the climate numbers.

Governance and risk management disclosure

The rule asks for board oversight of climate risk and management's role in assessing it. Companies describe how climate risk is identified, how it is managed and how it feeds into strategy. This is governance disclosure, not a climate pledge.

Financial statement effects

The rule reaches into the notes to the financial statements. Severe weather, transition costs, carbon prices and related expenditures can be material, and the rule asks issuers to quantify them where they are. Attestation requirements apply to certain emissions disclosures for larger filers.

Scope 1 and scope 2 emissions

Direct emissions and purchased energy emissions are the foundation. The rule requires disclosure of material scope 1 and scope 2 emissions, subject to the phase-in schedule and the materiality standard. Smaller reporting companies get more time and narrower duties.

Materiality is the hinge

The SEC framework is built on materiality, the same standard used elsewhere in securities disclosure. A company that decides a climate risk is not material should be able to show its work. SEC staff guidance on disclosure expectations is a useful reference when that judgment is challenged.

California SB 253 and SB 261: scope and reporting thresholds

California passed two laws that reach far beyond public issuers. California SB 253, the Climate Corporate Data Accountability Act, requires large companies doing business in California to report greenhouse gas emissions. California SB 261, the Climate-Related Financial Risk Act, requires climate risk reporting.

The thresholds are the practical dividing line. SB 253 applies to companies with total annual revenues over $1 billion that do business in California. SB 261 applies to companies with total annual revenues over $500 million that do business in California. Both reach private companies, which is the key difference from the SEC regime.

The thresholds have edges worth checking. Both are measured against total annual revenue, not revenue from California operations, and neither is indexed for inflation.

A company at $999 million is outside SB 253; at $1.01 billion it is inside. A one-year revenue spike can pull a company into scope, and SB 261's lower line catches mid-sized private firms that have never filed a sustainability report.

Who counts as doing business in California

The phrase is broad. A company incorporated in Delaware with headquarters in Texas can still be covered if it has enough California activity. Corporate counsel should map revenue, employees, property and customers against the statutory test rather than assume a headquarters state decides the question.

What SB 253 requires

SB 253 requires reporting of scope 1 and scope 2 emissions, with scope 3 phased in later for the same filers. Reports go to a California emissions registry and follow the Greenhouse Gas Protocol. The California Air Resources Board writes the implementing rules.

What SB 261 requires

SB 261 requires a report on climate-related financial risk and the measures the company takes to reduce and adapt to that risk. The report follows the recommendations of the Task Force on Climate-related Financial Disclosures, now housed with the International Sustainability Standards Board.

Phase-in dates and penalties

The three rules start on different clocks, and only two of them have dates that are still operative.

SB 219, the 2024 clean-up law, gave the California Air Resources Board until July 1, 2025 to adopt the implementing rules. SB 253 requires scope 1 and scope 2 disclosure for fiscal 2025, filed in 2026, with scope 3 to follow from 2027.

SB 261 requires the first climate risk report by January 1, 2026 and every two years after that.

California penalties are administrative. SB 253 allows up to $500,000 per reporting entity per year for failure to report. SB 261 allows up to $500,000 for failure to file a complete report. Both put the issue in front of the audit committee.

The SEC rule has no penalty schedule of its own. It was adopted on March 6, 2024 and stayed on April 4, 2024, and in March 2025 the agency moved to stop defending it.

As adopted, emissions disclosure and limited assurance for scope 1 and scope 2 would have begun for large accelerated filers in fiscal 2026 and for accelerated filers in fiscal 2028.

Smaller reporting companies and emerging growth companies were exempt from the emissions requirement, and scope 3 was stayed before it took effect. Confirm the dates against the board's rulemaking and the SEC docket before you build a schedule.

Where SEC and California rules overlap and diverge

Both regimes want emissions numbers and climate risk narrative. Both push companies toward the Greenhouse Gas Protocol and toward board-level accountability. The overlap is real, and it is the reason a single data program can serve both.

Overlapping compliance steps for U.S. firms

The same inventory, the same controls, the same governance description and the same assurance readiness work can feed the SEC filing and the California reports. Companies that build one system and then map outputs to each regime avoid doing the work twice.

Where they diverge

The SEC regime is securities disclosure, so materiality and investor protection drive it. California's laws are emissions and risk mandates, so revenue thresholds and state jurisdiction drive them. A private company with $1.2 billion in revenue may have no SEC duty and a full California duty.

Litigation and political risk

Both regimes have faced legal challenges and political pushback. The SEC rule has been contested in court, and California's laws have been subject to budget and implementation questions. Compliance planning should assume the rules survive in some form and that dates may move.

What the overlap means for corporate responsibility

A company cannot treat these as paperwork. The disclosures reveal how the business actually manages climate risk. That is why they belong inside the company's wider disclosure controls, alongside topics such as corporate political donations canada rules.

EPA Greenhouse Gas Reporting Program data as a compliance input

The EPA Greenhouse Gas Reporting Program collects emissions data from large industrial sources across the United States. Facilities in sectors such as power generation, refining, chemicals, mining and waste report annually. The data is public and searchable.

For a company facing the SEC rule or California SB 253, the program is a starting point, not an answer. It covers specific facilities and gases, and it uses regulatory definitions that differ from the Greenhouse Gas Protocol. A company may report under the program and still need a separate inventory for disclosure.

What the program covers

The Greenhouse Gas Reporting Program covers direct emissions from large sources and some suppliers of fossil fuels and industrial gases. It does not cover most scope 2 purchased electricity or scope 3 value chain emissions. Those gaps matter for both the SEC rule and SB 253.

How to use the data

Where the program falls short

Facility thresholds mean small sites and many service businesses are absent. The program also lags the reporting year, so it cannot be the only source for a current disclosure. Treat it as corroboration and as a check on your own numbers.

Other EPA obligations

The program sits inside a broader body of EPA laws and regulations that govern air, water, waste and chemicals. Climate disclosure does not replace those duties.

Assurance, scope 3 emissions and supply chain data challenges

Assurance is where disclosure programs get tested. The SEC rule requires attestation for certain emissions disclosures by larger filers, and SB 253 phases in assurance over time. An assurance provider will ask for evidence, controls and a clear methodology.

Emissions assurance is usually performed to ISAE 3410 for greenhouse gas statements, with ISAE 3000 used for wider sustainability information. Both come from the International Auditing and Assurance Standards Board.

Limited assurance ends in a conclusion worded in the negative, meaning nothing came to the provider's attention. Reasonable assurance ends in a positive opinion and requires deeper testing of controls and data.

SB 253 requires limited assurance for scope 1 and scope 2 from the 2026 reporting cycle and reasonable assurance from 2030. The SEC rule requires limited assurance only, and only for larger filers.

Scope 3 is the hard part

Scope 3 emissions come from suppliers, customers, travel, commuting, investments and use of sold products. They usually dwarf scope 1 and scope 2 for a consumer-facing company. SB 253 requires scope 3 reporting for the largest filers, and investors increasingly ask for it even where the SEC rule does not.

Supply chain data quality

Supplier data arrives in different formats, with different boundaries and different years. A company can spend months chasing numbers that are not comparable. The practical answer is a tiered approach: spend effort on suppliers that drive the most emissions and use estimates elsewhere.

Controls and documentation

Assurance providers look for a control environment, not a spreadsheet. Document who owns each data point, how it is collected, how it is reviewed and how errors are corrected. The same discipline carries into other reporting topics, including corporate political spending disclosure.

Cost and effort

Assurance, data systems and supplier engagement cost money. The spend is easier to defend when it is tied to disclosure duties and to decisions the business actually makes. customer ethics by effect, not effort, keeps the program honest.

What to avoid

Do not claim more than the data supports. A company that overstates its emissions reductions in a voluntary report creates a disclosure risk when the same topic appears in a securities filing. What can a company honestly claim about its sustainability ethics? That question is worth answering before the filing deadline.

Compliance steps for U.S. firms facing both regimes

A company that may be covered by the SEC rule, by California SB 253, by California SB 261, or by all three needs one program with mapped outputs. The steps below are the sequence that works.

A worked example

A private manufacturer headquartered in Illinois with $1.4 billion in revenue sells into California. It has no SEC duty because it is not a public issuer. It is covered by SB 253 and SB 261.

It already files under the EPA Greenhouse Gas Reporting Program for two plants. The company builds a Greenhouse Gas Protocol inventory, reconciles the two plants to the program data, adds purchased electricity and a scope 3 estimate for purchased goods, and prepares a climate risk report. Total new headcount: one analyst and part of a controller's time.

Checklist before the first filing

Common mistakes

Treating the SEC rule and California laws as separate projects doubles the cost. Leaving scope 3 until the last year guarantees a scramble. Letting the sustainability team own the numbers without finance involvement weakens the controls that assurance providers test.

How climate disclosure fits a business ethics and responsibility program

Climate disclosure is not a standalone compliance exercise. It is a test of whether the company's public claims match its operations. That is the same test at the heart of corporate responsibility separated from giving, and what it actually costs.

Disclosure as an ethics issue

A company that reports emissions it cannot substantiate has a disclosure problem and an ethics problem. The two are linked because both rest on the same internal controls. Boards that treat climate disclosure as a legal formality miss the reputational and enforcement risk.

Connecting to existing programs

Most large U.S. companies already have codes of conduct, supplier standards and environmental compliance systems. Climate disclosure can be layered onto those programs rather than built beside them. The data owners, the review process and the escalation path can be shared.

Metrics that matter

Not every climate metric deserves board attention. Emissions against target, assurance findings, supplier data coverage and the cost of compliance are the ones that show whether the program works. Knowing which metrics matter is a filter worth applying when the dashboard gets crowded.

Governance and incentives

Compensation committees are beginning to tie climate metrics to executive pay. That raises the stakes for data quality, because a bonus tied to an unverified number is a governance risk. The U.S. Sentencing Commission Guidelines Manual, Chapter 8, treats effective compliance programs as a mitigating factor, and disclosure controls are part of that picture.

Common questions