Climate risk disclosure rules for businesses: where they stand in 2026

As of October 10, 2026, no federal rule requires U.S. companies to publish climate-specific disclosures. The SEC's 2024 climate rule has never taken effect and the agency has proposed to rescind it. California is the active regulator: SB 253 requires companies with more than $1 billion in revenue that do business in the state to report greenhouse gas emissions, with the first Scope 1 and Scope 2 reports now scheduled for November 10, 2026, while SB 261's climate risk reports are on hold under a court order. Most small and midsize businesses are not directly covered, but customers and lenders are passing data requests down the supply chain, and insurers ask for much of the same location-level information.

Where each regime stands

The SEC rule

The SEC adopted its climate disclosure rule on March 6, 2024, and stayed it on April 4, 2024 while challenges to the rule moved forward in the Eighth Circuit (Release 33-11280, per the SEC). In March 2025 the Commission voted to stop defending it. On September 12, 2025 the Eighth Circuit put the consolidated case, Iowa v. SEC, in abeyance until the SEC reconsidered the rule or renewed its defense. On May 29, 2026 the SEC proposed to rescind the rule in full (File No. S7-2026-19, Release 33-11421), published in the Federal Register on June 3, 2026, with comments due August 3, 2026 (SEC proposal page). A final rescission needs another Commission vote.

Rescission does not erase disclosure duty. Public companies must still describe material risks in Regulation S-K Item 105 and known trends in Item 303, which include climate matters when they are material, according to a Holland & Knight summary. A company that overstates its climate resilience, or omits a known physical risk to its facilities, faces the same securities exposure as with any other misstatement; see Securities class actions and the D&O market.

California: SB 253 and SB 261

California enacted two laws. SB 253 covers Scope 1 (direct emissions) and Scope 2 (purchased power, steam, heating and cooling) beginning in 2026, with Scope 3 (value chain emissions) beginning in 2027. SB 261 requires a report on climate-related financial risk and the steps taken to reduce it.

Key developments, per Davis Polk (July 7, 2026) and Mayer Brown (August 2026):

• CARB approved its initial regulation on February 26, 2026 with an August 10, 2026 first deadline. On June 24, 2026 it pulled the package back from the Office of Administrative Law, deferred the first Scope 1 and 2 deadline to November 10, 2026 and issued modified text on July 27, 2026 with comments due August 11. The November date depends on that approval.
• For the first cycle, CARB does not require third-party assurance, and companies may use an existing emissions report or data prepared for another program. A company that was not collecting Scope 1 and 2 data as of December 5, 2024 can file a letter on its letterhead.
• CARB's preview of the 2027 framework, not yet adopted, contemplates limited assurance on Scope 1 and 2, a Scope 3 phase-in limited to five of the 15 GHG Protocol categories, and extending SB 253 to insurers. Annual fees begin with 2026, with CARB's fee notice due by December 10, 2026.
• On November 18, 2025 the Ninth Circuit enjoined SB 261 pending appeal, declined to enjoin SB 253, and heard argument on January 9, 2026. A merits decision is pending, and a ruling for the challengers could change SB 253 as well.

Check the CARB and court dockets before relying on any date here. These rules have moved several times in 12 months.

What this means if you are not covered

Under CARB's proposed 2027 Scope 3 categories, covered companies would report emissions from purchased goods and services, fuel and energy, waste, business travel and employee commuting. Your customers who are subject to the rule will ask you for data. Banks, private equity investors and large buyers send questionnaires on emissions, climate exposure and sometimes insurance, whether or not a statute requires them. A hypothetical: say a 150-person machining shop in Ohio supplies a California-based manufacturer. The customer asks for annual electricity and fuel use, its flood and wildfire exposure at each plant, and the limits and deductibles on its property policy. The shop can answer much of this from utility bills and its insurance file, and reusing one set of data for customers, lenders and insurers saves time.

Where insurance comes in

Directors and officers. Disclosure is a governance risk. A public company's Directors and officers (D&O) insurance covers defense of securities claims alleging misstatements, but exclusions and conduct language vary, and fines and penalties are a separate question; see are fines, penalties and punitive damages insurable?. Ask your broker whether the policy covers regulatory proceedings about sustainability reports, and how "greenwashing" is treated. Private companies subject to California reporting have exposure too, and private-company forms differ; see D&O insurance for private companies and startups.

Property underwriting. Climate disclosure draws on the same data underwriters use: addresses, construction, flood zone, wildfire score and values. A clean statement of values serves both. If you disclose physical risk, make sure the numbers match what you gave insurers, because inconsistent statements create problems in a claim or lawsuit. See catastrophe models: how insurers price hurricanes, quakes and fires and climate change and the commercial insurance market.

Insurance availability as a risk. Where a location's coverage is restricted or deductibles are rising, say in wildfire or flood areas, that affects the financial risk a company would describe. Our guides on secondary perils: the storms, floods and fires that are not hurricanes and wildfire and commercial property insurance: cover, cost and mitigation explain the market.

A practical checklist

1. Confirm whether your entity or a parent meets the California revenue thresholds and does business in the state; get legal advice, because "doing business" is defined by regulation.
2. If you are in scope, inventory Scope 1 and 2 data sources now (fuel, electricity, refrigerants) and plan for the November 10, 2026 date, while watching for changes.
3. If you are a supplier, build a standard answer pack: energy use, location risk, certifications and insurance summary.
4. Match disclosed numbers to your property schedule and loss history.
5. Ask the broker how your D&O and E&O policies treat sustainability reporting claims.
6. Assign one owner who watches the CARB, SEC and court developments quarterly.

Key takeaways

• The SEC's climate rule is stayed and proposed for rescission, but existing materiality-based disclosure duties still reach climate risks.
• California's SB 253 is in effect with a proposed November 10, 2026 first deadline for companies over $1 billion in revenue; SB 261 is enjoined pending appeal.
• Small businesses are mostly affected through customer, lender and insurer data requests, not statutes.
• Keep climate disclosures consistent with what you tell insurers, and ask your broker how D&O responds to sustainability-reporting claims.
• Dates have moved repeatedly; verify them with the regulator before acting.