CARB Clarifies Assurance, Risk Reporting, and Entity-Level Obligations Under California’s Climate Disclosure Laws

At its public workshop on August 21, the California Air Resources Board (CARB) provided further guidance on the implementation of Senate Bills 253 and 261. The agency emphasized that climate-related disclosures will be held to standards comparable to financial reporting, with third-party assurance and board-level oversight as key compliance components.

CARB also addressed which corporate entities will be subject to reporting obligations. The agency stated that it intends to rely on the California Secretary of State's records to determine whether an entity is "doing business in California." This includes entities formed in California as well as those that have designated a California agent for service of process. Entities that meet the applicable revenue thresholds and appear in the Secretary of State's registry may trigger reporting obligations, even if they are subsidiaries of a larger corporate group.

CARB further indicated that it is still considering a structure that would allow a parent company to report on behalf of its subsidiaries, provided the parent formally accepts reporting responsibility for each covered entity. Companies with complex legal structures should begin reviewing their California registrations and assessing whether consolidated reporting is feasible under CARB's developing rules.

With phased obligations beginning in 2026, companies must prepare to measure, disclose, and verify greenhouse gas (GHG) emissions and report material climate-related financial risks. By 2030, emissions data for Scopes 1 and 2 must meet audit-grade assurance standards.

SB 253 and SB 261: Scope, Deadlines, and Timelines

Senate Bill (SB) 253 requires companies to disclose GHG emissions across Scope 1 (direct), Scope 2 (indirect from purchased energy), and Scope 3 (indirect across the value chain). The first reporting deadline for Scopes 1 and 2 is 2026, with limited assurance. Scope 3 disclosures begin in 2027 without assurance in the first year. In 2028, Scope 3 disclosures must obtain limited assurance. By 2030, Scope 1 and 2 disclosures must obtain reasonable assurance, while Scope 3 remains subject to limited assurance.

Senate Bill (SB) 261 requires the first climate risk disclosure by January 1, 2026, and every two years thereafter. Covered entities must disclose material climate-related financial risks and the measures taken to mitigate them. These include physical risks (e.g., wildfire, drought) and transition risks (e.g., regulatory or market changes). The statute also mandates that boards and executive leadership oversee climate risk management as part of the company's governance structure.

CARB reaffirmed that the laws apply broadly to entities "doing business in California" under Revenue and Taxation Code§ 23101. This includes many out-of-state and international companies with qualifying in-state activity.

Third-Party Assurance as Compliance Benchmark

CARB confirmed that assurance is a central compliance obligation under SB 253. Beginning in 2026, companies must obtain limited assurance-a third-party review of emissions data for material misstatements. By 2030, Scope 1 and 2 disclosures must meet reasonable assurance, aligning with standards applied in financial audits.

Scope 1 and 2 data are typically accessible through internal systems, but Scope 3 data often rely on third-party inputs and lacks standardized methodologies. Audit readiness will require clear documentation, internal controls, and validated estimation methods.

The market for assurance providers remains small. CARB cautioned that delaying engagement could lead to capacity constraints and increased costs.

Preparing for Compliance

SB 253 and SB 261 elevate climate disclosure to a regulatory obligation, with potential enforcement and litigation risk. Companies must integrate climate data into broader risk and reporting frameworks and adhere to the following compliance milestones:

• January 1, 2026: First SB 261 climate risk disclosure due
• 2026: Scope 1 and 2 GHG emissions reporting begins with limited assurance
• 2027: Scope 3 GHG reporting begins (no assurance required)
• 2028: Scope 3 GHG disclosures must obtain limited assurance
• 2030: Scope 1 and 2 disclosures must obtain reasonable assurance

To prepare, companies should:

• Review California-registered entities, including subsidiaries, for potential reporting obligations.
• Evaluate whether a parent-level consolidated reporting structure is viable.
• Conduct a gap analysis of current reporting systems and governance practices.
• Engage assurance providers early to assess data quality and secure capacity.
• Align climate and financial reporting processes to ensure consistency.
• Formalize board and executive roles in climate oversight.
• Train cross-functional teams on CARB's methodologies and expectations.
• Monitor further rulemaking and guidance from CARB.

Takeaways and Next Steps

CARB's August workshop reinforces that assurance, risk disclosure, and entity-level applicability are central to California's evolving climate reporting regime. Companies subject to SB 253 and SB 261 should act now to ensure systems, governance, and legal structures are prepared for phased compliance.

Legal counsel can assist in evaluating exposure and developing a compliance roadmap tailored to both the entity structure and the regulatory timeline. For tailored guidance on California's climate disclosure requirements, please contact the author or any member of Frost Brown Todd's Environmental Practice Group.