What Businesses Need to Know About California’s SB 253 and SB 261

Q: Thank you for talking with us, Wes. Would you mind starting with a quick overview of the difference between SB 253 and SB 261? 

A: They are companion laws that were deliberately issued in parallel. SB 253 is the Climate Corporate Data Accountability Act. It requires companies to disclose their greenhouse gas emissions, using hard numbers and standardized calculations. SB 261 is the Climate-Related Financial Risk Act. It’s more narrative-based and focuses on describing the financial risks climate change poses to a business, supported by data. 

In short, SB 253 is about emissions data; SB 261 is about climate risk disclosure. 

Q: What companies are subject to the laws? How many companies are we talking about in terms of 253/261 compliance? 

A: The scope is very broad. 

SB 253 (emissions reporting) applies to any company with more than $1 billion in annual revenue that does business in California. That doesn’t mean $1 billion of revenue in California. It means any global company above that threshold with even minimal business activity in the state. 

SB 261 (climate risk disclosure) applies at a lower threshold—$500 million in revenue for companies doing business in California. 

That means thousands of companies across the U.S. and worldwide will be subject to these requirements simply because they have an office, employees, clients, or sales in California. 

Q: When do the reporting requirements begin? 

A: For SB 261, the first climate risk reports are due January 1, 2026. 

For SB 253, reporting on Scope 1 and Scope 2 emissions will begin sometime in 2026, covering 2025 data. Scope 3 emissions, which include a company’s supply chain, are pushed back to 2027 due to the complexity of data collection. 

Q: Why is the Scope 3 portion of SB 253 such a challenge? 

A: Scope 1 and 2 reporting can be based on things like utility bills and direct fuel use, which companies already track. Scope 3 is different. It requires gathering emissions data from suppliers and other third parties. Many of those third parties may not be subject to the same laws and so they could be less prepared or motivated to produce this type of data. That means sending surveys, requesting information, and consolidating data from hundreds of organizations in multiple formats.  

It’s a massive data-collection exercise that many companies have never done before. 

Q: Will California be the only state requiring this? 

A: No. California is leading the way, but other states are following quickly. New York, Illinois, Colorado, New Jersey, and Minnesota are all developing what appear to be nearly identical climate disclosure requirements, with start dates as early as 2027. 

So instead of one clear federal standard through the SEC or other federal agencies, companies may soon face multiple state-level reports, each with slightly different requirements. 

Q: How can companies prepare for reporting in multiple states? 

A: Companies should expect to file different reports in different states, but the underlying data collection can be centralized. That’s where software matters. A system like Locus Technologies can help companies collect data once, manage it consistently, and then adapt outputs to meet different state requirements. 

Configurability is key because the regulations are still evolving, and states may tweak their requirements. Companies need tools that can adapt as rules change rather than relying on one-off spreadsheets, email traffic, and manual processes. 

Q: What kind of verification will be required? 

A: Reports must undergo third-party assurance. Initially, California will accept limited assurance—essentially an auditor confirming they didn’t see obvious errors. By 2030, the state will require reasonable assurance, which means a much deeper review of the data and sources, similar to a rigorous financial audit. Locus Environmental provides these types of verifications across the West coast and other key markets in the US. 

Q: What are the most important steps companies should take now to ensure they are in good standing when the first reports are due? 

A: Scope 3 has always been within scope for voluntary reporting – but that’s it. This is going to be the first US requirement for Scope 3 reporting, and that’s why companies are understandably nervous. Since emissions tracking is required by both laws, that’s a good place to start. 

• Study the standards being referenced in each of the laws. California points to the Greenhouse Gas Protocol for emissions and the IFRS climate disclosure standards for financial risk. These are already published and widely used, and they are internationally recognized standards – which is fitting considering the number of global companies doing business in California.  
• Start early with data collection, especially Scope 3. It’s going to take time to identify suppliers, send requests, and consolidate responses.  
• Implement systems to centralize and reuse data. With multiple states moving in this direction, companies that enter their data once and can adapt it for multiple reports will be in the best position. 

Q: What makes these laws different from earlier ESG reporting? 

A: The biggest difference is that these disclosures are not voluntary, they are mandatory. Companies can’t opt out, and the reports will be publicly disclosed by the state. That raises the stakes for accuracy and transparency. Plus, the language states that enforcement actions will be taken if companies don’t comply.  

Q: You referenced Locus software earlier. The companies that will be subject to SB 253 and SB 261 may be using Locus software or similar products already for EHS compliance and ESG reporting. Can you expand upon the other software capabilities that will help companies comply with these new laws? 

A: The most important attribute is flexibility. California’s rules reference existing standards like the Greenhouse Gas Protocol and IFRS, but the details will continue to evolve—and other states are creating their own variations. Companies will need systems that can adapt quickly as regulations shift, rather than one-off tools tied to a single standard. 

Second, compliance depends on scalable data collection. For Scope 3 in particular, companies may need to gather emissions information from hundreds of suppliers, each using different formats. Software that enables structured data intake through surveys or online forms, rather than endless email and spreadsheets, will be essential. API connections to third-party systems may also become increasingly important. 

Third, companies should look for platforms that allow them to enter data once and output it in multiple reporting formats. With New York, Illinois, Colorado, and other states preparing similar laws, having a system that can generate different jurisdiction-specific reports from a single dataset will save enormous time and reduce errors. 

Finally, audit readiness matters. Because reports will be subject to third-party assurance and made public, companies will need tools that can track data sources, maintain clear documentation, and support verification workflows.