CARB’s SB 253 Regulation Is Final: What Is Required for November 10, 2026?

What happened on October 12, 2026?

The Office of Administrative Law (OAL) approved CARB’s initial regulation implementing SB 253 and SB 261. The regulation became effective on approval, so the obligations it sets out are now legally binding rather than proposed. (Morgan Lewis)

What OAL approval actually means

OAL is California’s regulatory gatekeeper. It reviews an agency’s rulemaking for clarity, necessity, consistency and procedural compliance before the rule can enter the California Code of Regulations. Until October 12, CARB’s requirements existed as an adopted but unfiled rule, which gave some companies a reason to wait. That reason is gone.

How we got here

CARB’s board adopted the initial regulation on February 26, 2026. The text was then revised, including a 15-day modified-text notice in July 2026, before going to OAL.

The original first-year deadline was August 10, 2026. CARB moved it to November 10, 2026, giving reporting entities a three-month extension. (White & Case)

The extension was not a softening of the obligation. CARB used the additional time to publish a reporting template, a voluntary intake platform and guidance, all of which point toward a more structured regime from 2027 onward.

Who has to file by November 10, 2026?

A company is in scope for SB 253 if it is a US-organized entity with more than $1 billion in total annual global revenue that does business in California. Both tests must be met. Public company status is irrelevant: private companies are covered on exactly the same terms.

What “doing business in California” means

CARB’s definition tracks the Franchise Tax Board test in California Revenue & Taxation Code section 23101: actively engaging in any transaction for financial gain where the entity is either organized or commercially domiciled in California, or its California sales exceed an inflation-adjusted threshold (approximately $735,019 for 2024), including sales made through agents or independent contractors.

That threshold is low. A company headquartered anywhere in the United States with modest California sales is likely to meet the second limb. Most companies that assume they are out of scope on geography are wrong.

Parents, subsidiaries and foreign parents

A parent may file a consolidated report covering its in-scope US subsidiaries, and CARB staff guidance extends this to foreign parents. Fees, however, are assessed per in-scope entity rather than per report. CARB’s intake platform allows a parent to request a single invoice covering all of its in-scope subsidiaries.

Why CARB’s preliminary list settles nothing

CARB published a preliminary list of covered entities on September 24, 2025, derived by matching California Secretary of State registry data against Dun & Bradstreet revenue data. Two limitations matter:

• The Secretary of State dataset covered active filings only through March 2022, and entities were matched by partial name. Companies are missing.

• The list does not reflect exemptions.

Inclusion on the list is not a legal determination that you are covered, and absence from it is not a determination that you are not. Every entity remains responsible for its own coverage assessment. If you are near the $1 billion line, get the analysis in writing before you decide not to file.

What exactly must be reported?

Scope 1 and Scope 2 emissions for your prior fiscal year, and nothing else. Scope 3 is not required this year. Third-party assurance is not required this year. The statutory bar for the first filing is low, and most companies are over-preparing for it while under-preparing for 2027.

The more useful question is what CARB actually wants to collect, and that is answered in detail by the draft reporting template CARB published on October 10, 2025.

Scope 1 and Scope 2 only

Scope 1 is direct emissions from sources you own or control. Scope 2 is indirect emissions from purchased electricity, steam, heat and cooling. Both are reported on a GHG Protocol basis.

Which fiscal year

The report covers your prior fiscal year. If your fiscal year is not the calendar year, confirm which year CARB’s guidance treats as applicable to you before you assemble the data. This is a common and avoidable error for companies with January or June year-ends.

Scope 2 emission factors

CARB does not mandate a specific dataset. Its guidance names US EPA eGRID 2023 and the Cornerstone eGRID 2024 dataset among acceptable options, and allows other credible sources. (Ramboll)

Whichever you use, document the choice. The template asks for the emission factor source and the year as named fields. An undocumented choice is the cheapest thing to fix now and the most expensive thing to reconstruct later.

What CARB’s reporting template actually asks for

Use of the template is voluntary for 2026, and CARB’s disclaimer is emphatic: it “does not modify, replace, or supersede the statutes and does not impose requirements on anyone,” and its definitions “do not have the force of law.” CARB reserves the right to revise it at any time.

Read it anyway. It is the clearest available statement of the data structure CARB is building toward, and it is considerably more demanding than two numbers. The form runs to roughly 178 fields across nine sections.

Optional fields cover base year emissions with per-gas breakdowns, sector-specific reporting protocol, an uncertainty and data quality assessment, and a self-rating of completeness, accuracy and consistency.

Three things in the template that catch people out

Emissions are disaggregated by gas, not only by source. The template asks for CO2, CH4, N2O, HFCs, PFCs and SF6 separately, at total level and again for every Scope 1 source and every Scope 2 source. Most companies producing a first inventory hold a single CO2e figure per source and have never separated the gases. Doing that means going back to the activity data, not adjusting the output.

Emission intensity per million dollars of revenue is a named field for both scopes. CARB is tying the inventory to a financial statement figure. That has consequences for who should own this number internally, and the answer is increasingly the finance function rather than the sustainability team alone.

There is a full third-party verification section in this year’s template. More on that below, because it is the most commercially significant thing in the file.

What CARB will accept for 2026

Under the December 2024 Enforcement Notice, CARB will accept Scope 1 and Scope 2 data that an entity was already collecting, or had planned to collect, as of December 5, 2024. In practice:

• An existing annual GHG report you already produce

• Scope 1 and Scope 2 data reported to another program or voluntary initiative, such as CDP

• Data entered into CARB’s draft reporting template

If you were neither collecting nor planning to collect Scope 1 and Scope 2 data as of December 5, 2024, CARB recommends submitting a statement of non-reporting on company letterhead explaining the position. That statement will be public.

What is not required this year

• Scope 3. Begins in 2027, under a separate rulemaking.

• Third-party assurance. Not required for the 2026 submission. Limited assurance of Scope 1 and Scope 2 begins in 2027, covering the 2026 reporting year.

• Strict use of CARB’s template. The template and the intake platform are both voluntary for 2026.

How is the report submitted?

Two routes, both acceptable. CARB’s 2026 Report Intake Platform, hosted on its ArcGIS portal, or direct email to climatedisclosure@arb.ca.gov. The platform is voluntary for 2026, and CARB has published a video tutorial for it. (Clark Hill)

The reporting template and its memo

CARB posted both of these on October 10, 2025 and opened a comment docket that closed October 27, 2025:

• Draft Scope 1 and Scope 2 GHG reporting template (.xlsx)

• Accompanying memo explaining the template (.pdf)

CARB describes the template as intended to streamline reporting “especially for entities disclosing GHG emissions for the very first time.” The workbook is formatted for Excel, and CARB warns that dropdown functionality may not survive being opened in Google Sheets.

Two caveats. Both files predate the final regulation OAL approved on October 12, 2026, so they do not reflect the approved text. And they are explicitly a first draft: CARB asked for feedback on three open questions, including whether to mandate a single organizational boundary approach across all filers rather than retain the three GHG Protocol options. If CARB does that, companies that chose a boundary approach this year without documenting why may have to restate.

Everything you submit becomes public

Uploaded emissions reports and statements of non-reporting will be published. Decide what goes in the file on that basis. A thin submission is survivable. A submission containing an unverifiable claim you have to retract next year is not.

The fee

CARB’s proposed schedule sets an annual flat fee of $3,106 per SB 253 reporting entity, derived from an annual implementation cost of $13.9 million with 58% attributed to SB 253 across 2,596 entities.

The mechanics:

• Invoices go out on or before December 10, 2026

• Payment is due within 60 calendar days of the invoice date

• A parent can request one invoice covering its in-scope subsidiaries, but the fee is still assessed per in-scope entity

Use the intake platform to lodge fee contact and billing information even if you submit the emissions report by email. Getting the invoice to the right person is a trivial step that is easy to miss and annoying to unwind.

The verification section you do not have to fill in yet

This is the part of CARB’s template that deserves more attention than it is getting.

Assurance is not required for the 2026 filing. The template collects it anyway. Section three of the form asks for:

• The name of the third-party assurance provider

• The assurance provider’s email, telephone and address

• A date of verification

• Scope 1: a Yes/No confirmation that all reported Scope 1 emissions have been assured at the limited assurance level, with a mandatory free-text explanation if the answer is no

• Scope 2: the same confirmation and explanation for Scope 2

Read that carefully. The template does not simply leave assurance blank for companies that have none. It asks you to declare that you have none, and to explain why, in a field that will be published.

Why this matters more than the deadline

A company filing a template-format report this November is making a public statement about its assurance position, one year before limited assurance becomes mandatory. Its competitors are filing the same form on the same day. By December, anyone can read across the filings and see which companies in a sector already have an assurance provider engaged and which have an explanation in the box instead.

That is a reputational dynamic the statute does not create and the deadline does not describe. It emerges from the shape of the form.

The template is the audit checklist, published early

Look at which fields CARB chose to collect beyond the emissions numbers themselves:

Every one of those is a field a verifier opens on day one of an engagement. CARB has, in effect, published next year’s audit checklist a year early, inside a voluntary spreadsheet.

The companies that treat the template as a filing form will populate it in November and close the file. The companies that treat it as a specification will build the evidence behind each field now, while there is no deadline attached to doing so, and hand their assurance provider a finished package in 2027.

What happens if you cannot file complete data?

File anyway. CARB’s December 2024 Enforcement Notice provides enforcement discretion for incomplete first-year reporting where the entity demonstrates good-faith effort and retains the relevant data. An incomplete report filed on time is in a far better position than no report.

Discretion is not an exemption

This is the distinction that catches people out. Enforcement discretion is CARB choosing how to exercise its enforcement powers. It does not remove the obligation, it does not create a legal safe harbour, and it is transitional by design. Companies treating the Enforcement Notice as permission to skip 2026 are making a bet on the regulator’s forbearance continuing into a year when CARB has said it will not.

The penalty exposure

Health & Safety Code section 38532, as amended by SB 219, caps administrative penalties at $500,000 per reporting entity per reporting year.

Two things are worth noting about that number. It is a cap, not a tariff, and CARB has given no indication it intends to approach it in year one. But it is also per year, which means a company that decides to sit out 2026 and 2027 is not facing one penalty.

The reputational exposure is the sharper risk in practice. Submissions are published. A statement of non-reporting from a company whose competitors all filed is a document that sits on a public server indefinitely.

Does the Ninth Circuit litigation change anything?

Not for SB 253, and not for November 10. This is the single most misunderstood point in the current compliance picture, because the two California climate disclosure laws are in completely different positions and are routinely discussed as though they were one thing.

Where the case stands

In Chamber of Commerce of the United States v. Sanchez, No. 25-5327 (9th Cir.), the district court denied a preliminary injunction in August 2025. On November 18, 2025 the Ninth Circuit enjoined SB 261 pending appeal but declined to enjoin SB 253. (Foley)

Oral argument was heard on January 9, 2026 before Judges Nguyen, Bennett and Matsumoto. The panel focused heavily on SB 253’s Scope 3 mandate and on whether the disclosures are compelled speech or factual commercial-speech disclosures. (Pillsbury)

As at the date of this article, the panel has not ruled.

Why the two laws sit differently

The reasoning that keeps SB 253 alive is that quantitative emissions data is the kind of purely factual, uncontroversial commercial disclosure that receives lighter First Amendment scrutiny. SB 261’s narrative risk report, which asks a company to characterise its own exposure, is a harder sell as purely factual.

What a ruling would and would not undo

If the panel rules against SB 253, the most likely target is the Scope 3 mandate rather than Scope 1 and Scope 2. The compelled-speech argument is strongest where a company is required to report on emissions it does not control, generated by third parties, using estimates.

Scope 1 and Scope 2 reporting is the most resilient part of the regime. Even on an adverse ruling, a company that has built a documented Scope 1 and Scope 2 inventory has not wasted the work: the same inventory feeds SEC-adjacent disclosure, CSRD for companies with EU operations, CDP, SBTi validation, and customer and lender requests that are not going away.

Planning on the assumption that litigation will rescue you is the one strategy with no upside.

What comes next after November 10?

2027 is the year this regime acquires teeth. Three changes land at once, and each one is harder than anything required this year. (Morgan Lewis)

Scope 3 begins, with five named categories

CARB’s proposal for 2027 requires five Scope 3 categories:

Other categories may be reported voluntarily. CARB has not said when, or whether, the remainder become mandatory.

For most companies in consumer, retail, food and services sectors, Category 1 alone will dominate the footprint, frequently accounting for 80% or more of total emissions. It is also the category with the worst data.

Limited assurance becomes mandatory

CARB proposes requiring limited assurance by an independent third party over Scope 1 and Scope 2 emissions, including separately reported biogenic CO2, with the provider issuing a written report. This applies from 2027, covering the 2026 reporting year.

CARB has signalled a deliberately broad menu of acceptable standards, referring to frameworks including AA1000, AICPA, ISAE and ISSA, and ISO standards, and has not described the list as closed. A wide menu means assurance providers are plentiful, which is good news for availability and less good news for anyone hoping scarcity would delay the requirement.

The primary data percentage disclosure

This is the requirement almost nobody is discussing, and it is the one that will be most uncomfortable to publish.

For each required Scope 3 category, an entity must disclose the percentage of emissions calculated using primary data. Primary data means activity data obtained from the actual supplier or operation, as distinct from spend-based estimates derived by multiplying dollars spent by an industry-average emission factor.

Most companies starting Scope 3 today are at or near zero percent primary data in Category 1. That number is about to become a public, comparable, year-over-year metric sitting beside your competitors' numbers. It converts supplier data collection from a sustainability aspiration into a disclosed performance measure.

If you do one piece of forward work after filing in November, make it this: find out what your Category 1 primary data percentage would be today.

What should you do before November 10?

If you have not started

1. Confirm coverage. Revenue over $1 billion globally, and the California nexus test. Document the conclusion either way.

2. Open CARB’s template and read the Form tab. It is the fastest way to see the full shape of what is being asked, and it is free.

3. Establish what data already exists. Utility bills, fuel purchases, fleet records, refrigerant logs. Most companies have more Scope 1 and Scope 2 source data than they think, sitting in accounts payable rather than in a sustainability system.

4. Pick your emission factor set and GWP source, and write down why. Both are named template fields, and the organizational boundary choice may be constrained by CARB later, so your reasoning is worth recording now.

5. File something. A good-faith incomplete report beats silence. If you genuinely were not collecting and not planning to collect as of December 5, 2024, file the statement of non-reporting instead.

6. Lodge fee contact details so the December invoice reaches the right person.

If your inventory exists but is undocumented

The filing is the easy part. Spend the remaining time on the fields CARB’s template asks for beyond the headline numbers, because those are what get tested in 2027:

• Can you state your organizational boundary approach, and does the resulting entity list match your financial consolidation?
• Can you produce the obligated entity list, with equity percentages where the equity share approach applies?
• Is the emission factor source recorded, with its year, for both Scope 1 and Scope 2?
• Is the GWP source recorded, and consistent across all six gases?
• Can you split emissions by gas, not just by source, from the underlying activity data?
• Are de minimis exclusions listed, with the quantity of emissions each one removes?
• Can you trace every reported number back to a source document?
• Is there a record of who prepared each figure and who reviewed it?
• Can you reproduce last year’s number without the person who originally built it?

If any of these is a no, that is a 2027 assurance finding you have time to fix cheaply now.

What makes an assurance review expensive

Assurance cost is driven almost entirely by how much reconstruction the provider has to do. A review of a documented inventory with a clean audit trail is a sampling exercise. A review of a spreadsheet nobody can explain is a forensic exercise, and it is priced accordingly.

The difference between those two outcomes is decided in the months before the assurance provider arrives, not during the engagement. CARB has removed the usual excuse for not knowing what will be tested: the fields are published, in a spreadsheet, right now.

Companies that treat the November filing as a one-off compliance task and then put the file away will pay for that decision in 2027.