California SB 253 Reporting Checklist: What Companies Should Prepare for the First Reporting Cycle

SB 253 gets filed under "disclosure law," which undersells it. What California is actually building is a regime where a company's greenhouse gas figures get signed off by an independent assurer, the same discipline that governs financial statements. The report due this year is the gentle part. Everything after it tightens, and fast. So the useful way to think about the first cycle isn't "get a filing out the door." It's "lay the foundation for numbers that will eventually have to survive an audit."

What the Law Requires

The Climate Corporate Data Accountability Act, SB 253, signed in 2023 and amended the next year by SB 219, makes large companies doing business in California report their greenhouse gas emissions every year, publicly, through a state-designated system. The obligation phases in. Scope 1 and Scope 2 come first, beginning with the 2026 cycle. Scope 3, the value-chain category, joins in 2027.

The emissions math has to follow the Greenhouse Gas Protocol, the accounting framework most large companies already lean on for voluntary reporting. Independent assurance is part of the bargain too, though it arrives later and escalates in stages. CARB, the California Air Resources Board, writes and enforces the rules, funds the program through a per-entity fee, and can impose penalties up to $500,000 a year on a company that doesn't comply.

One distinction, because the two constantly get muddled. SB 253 is the emissions law. Its companion, SB 261, is a separate climate-risk-reporting law with a lower revenue threshold and a narrative format; it's currently frozen by a court order while SB 253 moves ahead. Keep them in different mental buckets.

Who's on the Hook

Companies keep hiring emissions consultants before checking whether the law reaches them. Reverse that order.

Two tests decide it, and both have firm definitions in CARB's regulation.

Revenue is the blunt one: you're in if total annual revenue tops $1 billion. "Revenue" here means gross receipts under California's tax code, no subtracting costs to slip beneath the line, and CARB uses the lesser of your last two fiscal years, which gives borderline companies a bit of slack.

The "doing business in California" test is the one that catches people off guard. It leans on the state tax code but keeps only the sales prong: clear roughly $735,000 in California sales (the figure inflates yearly, running about $757,000 for 2025) and you're in. The property and payroll tests in the underlying statute were dropped. A company with no California office, no California employees, and no California facilities can still qualify on sales volume alone. Where you're headquartered is beside the point.

Then the structural wrinkles.

Only U.S.-formed entities are directly covered. A foreign parent isn't a reporting entity itself, though it can file on behalf of a U.S. subsidiary that is.

Coverage gets judged entity by entity. SB 219 lets a parent file one consolidated report for the group, a genuine mercy for sprawling org charts, but each subsidiary still runs its own doing-business analysis. A parent over the line doesn't automatically drag in every subsidiary, and a qualifying subsidiary doesn't automatically pull in the parent.

Exemptions come off the top: nonprofits, government and majority-government-owned entities, companies whose only California presence is remote workers, and businesses whose only California activity is wholesale electricity trading. Insurers are exempt as well, but shakily, CARB carried that carve-out over from SB 261 and has since signaled it's reconsidering, so insurance companies should treat their exemption as provisional rather than settled.

The Emissions Data Itself

This is the heart of it, and the part that separates a filing you can defend from one you can't.

Scope 1 is what you emit directly, fuel burned in boilers, furnaces, company vehicles, anything you own or operate. Scope 2 is indirect: the emissions generated to produce the electricity, steam, heating, and cooling you purchase. Together they capture a company's operational footprint, and together they are the entire first report.

Scope 3 is the monster waiting in 2027. It reaches up and down the value chain, suppliers, business travel, product use, the lot, across fifteen defined categories. For most companies it dwarfs Scopes 1 and 2 combined, and it's assembled largely from other people's data, which is precisely what makes it hard.

Before you count anything, you draw the boundary: which entities, facilities, and joint ventures sit inside your inventory. CARB has floated two approaches, both standard in GHG accounting. Equity share counts emissions in proportion to ownership. Operational control counts everything from operations you run. The choice isn't cosmetic, it changes which subsidiaries and JVs land inside the number an assurer eventually signs, which means it drives how you scope data collection in the first place. Make that call deliberately, and early.

After the boundary comes methodology, and here CARB is still deciding. The Protocol permits different calculation methods and emission-factor sources, and the agency is working through which to require from 2027 on: spend-based versus activity-based approaches for Scope 3, which reference datasets to pull emission factors from, whether to phase Scope 3 in by category or by sector. Those specifics are live in the rulemaking. What isn't in question is the expectation beneath them, every figure has to trace to something real. A meter reading. A utility invoice. A fuel receipt. A logged shipment. Estimates are fine where actuals don't exist, but you have to know which is which and be able to show your work.

Preparing for Year One

The first cycle was built to be survivable, and CARB widened the ramp further with an enforcement notice in December 2024: for the inaugural report, it won't pursue penalties for incomplete disclosure as long as you made a genuine effort and kept your underlying data.

That yields two paths. Were you already measuring emissions when the notice landed? You file, report what you have, document the method, name the gaps, and preserve the raw inputs and assumptions. Weren't collecting data, and weren't planning to, as of that date? You can skip the numbers this once and file a short letterhead statement saying so, to a public docket CARB opens before the deadline. The second route buys a year and nothing more. The full inventory is due in 2027 either way.

Which fiscal year you report turns on your year-end. Books closed on or before February 1, 2026 means fiscal 2026; closed later means fiscal 2025. Calendar-year companies are reporting 2025 emissions.

The logistics are dull and easy to fumble. There's an annual per-entity fee, not fixed in statute, set by CARB, estimated in the low four figures but confirmed only when your determination notice arrives by September 10, with 60 days to pay. Every qualifying entity gets billed even inside a consolidated filing, though a parent can settle the whole tab at once. Keep your eligibility records, whatever proves you clear, or don't clear, the thresholds, for five years. And file through CARB's designated system rather than a PDF on your own site; confirm the mechanics as the date approaches.

On that date: CARB moved the first Scope 1 and 2 deadline to November 10, 2026 from an earlier August target, but the new date was still working through final approval as of mid-year. Plan around it, verify before you bank on it.

Getting Assurance-Ready

Assurance is where SB 253 stops being a reporting exercise and starts resembling an audit. It isn't required for the 2026 report, the one real break of the first cycle, but it lands soon after.

The ramp runs in stages. Limited assurance over Scopes 1 and 2 kicks in with the 2027 cycle, covering fiscal 2026 data. It tightens to reasonable assurance by 2030, the same year limited assurance on Scope 3 begins. The two levels are different animals. Limited assurance is a review: the assurer checks whether anything looks materially wrong and issues a "nothing came to our attention" conclusion. Reasonable assurance is the heavier lift, closer to a financial audit, with real testing of your controls, data sources, and methods, and a positive opinion at the end. Financial reporting made this same climb from review to audit long ago. This is that pattern, pointed at carbon.

CARB hasn't locked the assurance standards yet, but at its spring 2026 workshop it named the ones it's likely to accept: ISSA 5000, the new global sustainability-assurance standard that takes effect in December 2026 and supersedes the older ISAE 3410; ISAE 3000 and 3410 in the interim; the AICPA's AT-C 210 for limited engagements and AT-C 205 for reasonable ones; AA1000AS v3; and ISO 14064-3. The variety is deliberate, CARB wants enough qualified providers in the market that companies aren't stuck waiting in line.

And that's the real hazard. Assurance capacity is finite, and every large company under SB 253, plus everyone caught by Europe's CSRD, will be chasing the same reviewers. Leaving the search until 2027 is how a company ends up unassured.

So the readiness work starts now, on the 2026 data, before anyone's checking it. In practice that means treating this first inventory as though it were already under review:

Make every number traceable. An assurer will chase a reported figure back to its origin, so each one should tie to a document, an invoice, a meter log, a receipt, not a spreadsheet cell someone keyed in from memory.
Separate actuals from estimates, and record the basis for each estimate.
Get emissions off scattered spreadsheets and into something centralized and auditable, especially when the data lives across business units.
Settle the organizational boundary before it hardens into your data pipes.
Talk to assurance providers this year. Even an informal walk-through of your process exposes the gaps a formal review would flag, cheaply, and with time left to fix them.

If you're already building toward CSRD assurance, most of this carries over. The frameworks diverge at the edges, but audit-grade data is audit-grade data.

What's Still Moving

Two things could shift the ground under all of this. CARB is revising its own regulation, the clarifications that rode in with the deadline change, so some fine print may move before November. And the whole scheme sits under a First Amendment challenge: a coalition led by the U.S. Chamber of Commerce is contesting both climate laws in the Ninth Circuit, which froze SB 261 but left SB 253 running. The court heard argument in January 2026 and hadn't ruled by mid-year. A decision could land before your report is due, a reason to keep building, not a reason to wait.

None of the hard parts get easier by starting later. Clean, traceable emissions data and a Scope 3 supply chain you can actually pull numbers from take months to stand up, and no extension manufactures more of either. Year one is light on paper. Spend it building the machine that carries you through year three, when the audit shows up.

The First Cycle in Nine Lines

Run both scope tests per entity, $1 billion in gross revenue and the California-sales test, then strike out the exemptions.
Fix your reporting year (2025 for calendar-year filers).
Draw the organizational boundary, equity share or operational control, before you scope data collection.
Build the Scope 1 and 2 inventory on Greenhouse Gas Protocol methods, every figure traceable to a source document.
Choose your path: a full good-faith report, or a non-collection letter if you weren't tracking data as of December 5, 2024.
Start the Scope 3 supplier conversations now; 2027 is nearer than it reads.
Budget the per-entity fee (notice by September 10, 60 days to pay) and keep eligibility records for five years.
Engage an assurance provider and run a dry run this year, even though 2026 requires no assurance.
Watch CARB's revised rule and the Ninth Circuit; keep an SB 261 report ready if you clear its $500 million threshold.

Both the rulemaking and the litigation are still live, so dates, fees, and details can move. Check CARB's current materials before filing, and put the entity-level questions in front of your own counsel, this is general information, not legal advice for your situation.

Sources

California Air Resources Board, Sullivan & Cromwell, Greenberg Traurig, Morgan Lewis, Nelson Mullins, Fenwick, Davis Polk, White & Case, Cooley, Sabin Center Climate Litigation Database,PwC Viewpoint, PwC, KPMG, Deloitte (DART), ISS-Corporate, UL Solutions, ERM CVS, Persefoni, Watershed

This article is intended for general professional information and does not constitute legal, financial, or investment advice.