SB 253's 2027 Rules Take Shape: What CARB Previewed At Its July Workshop

CARB's July 21, 2026, public workshop gave reporting entities their first substantive look at how California's Climate Corporate Data Accountability Act (“SB 253,” Health & Safety Code § 38532) will operate in 2027 and beyond — the year Scope 3 disclosure and third-party assurances enter the program. 

Nothing CARB previewed in its workshop has been adopted. These are staff concepts, with a formal draft expected this fall and a 45-day comment period to follow. Even so, the direction is now visible on several questions that have been open issues since the statute passed.

Scope 3: A five-category phase-in — and no committed date for the rest

CARB confirmed it will phase in Scope 3 by category. Beginning with the 2027 reporting cycle, entities would be required to address only five of the fifteen GHG Protocol categories:

• Category 1 — Purchased goods and services
• Category 3 — Fuel- and energy-related activities
• Category 5 — Waste generated in operations
• Category 6 — Business travel
• Category 7 — Employee commuting

Notably, the required five do not necessarily capture a company's largest Scope 3 sources. Financed emissions (Category 15), use of sold products (Category 11), and upstream and downstream transportation and distribution (Categories 4 and 9) all sit in the voluntary bucket. 

CARB declined to commit to a date for full, fifteen-category reporting, despite pointed requests from investor and public-interest commenters. 

Scope 3 in practice: Exclusions and data provenance

CARB proposes permitting entities to exclude emissions sources, activities, entire Scope 3 categories, or other information where the omission, misstatement, or obscuring of that information would not reasonably be expected to influence users' decisions, assessments, or understanding. Staff confirmed at the workshop that this materiality-style exclusion can apply even within the five required categories. The trade-off is documentation: entities must explain the basis for each exclusion and, where quantifiable, disclose an estimate of the excluded emissions.

On data, CARB clarified that companies need not obtain emissions information directly from each supplier and may rely on spend-based methods, industry averages, proxies, and other secondary data. For each reported Scope 3 category, however, entities must disclose the calculation method, the data types used, and the percentage of emissions calculated using primary data. The flexibility, in other words, comes paired with a transparency obligation that lets users and assurance providers see how much of a figure rests on estimates.

Scope 2: Dual methods and a frozen version of the Guidance

Entities would report Scope 2 emissions using both a location-based and a market-based method, and by source type. Notably, CARB proposes incorporating the 2015 GHG Protocol Scope 2 Guidance by reference and will not automatically adopt the update now underway; staff explained that California administrative law does not permit "dynamic" incorporation of future changes to an outside standard. That approach gives reporters near-term certainty, but a company reporting both to California and under a regime that later adopts the updated Guidance could end up calculating Scope 2 two ways for the same year.

Assurance: A five-standard menu and an unresolved scope question

CARB continues to propose limited assurance for Scope 1 and Scope 2 emissions beginning in 2027 with one of the following standards: 

• AA1000 Assurance Standard (AA1000AS v3), 

• American Institute of Certified Public Accountants (AICPA AT-C Section 210), 

• International Standard on Assurance Engagements (ISAE) 3410 applied in conjunction with ISAE 3000 (Revised), for engagements commencing prior to December 15, 2026,

• International Standard on Sustainability Assurance (ISSA) 5000 for engagements commencing on or after December 15, 2026, and 

• International Organization for Standardization (ISO) 14064-3:2019 (with additional accreditation requirements).

Two items to watch: First, the ISO option's accreditation caveat drew repeated questions staff did not answer on the record, and staff acknowledged their assurance approach is not final. Second, engagement scope is still open.  The written proposal ties assurance to Scope 1 and Scope 2 emissions, but commenters asked whether it also reaches the accompanying qualitative disclosures — organizational boundaries, calculation methods, emission factors, and the missing-data and exclusion narratives. Where the final text draws that line will drive the cost and effort of assurance.

Insurers back in scope for 2027

The initial regulation exempts insurance companies for 2026 to avoid duplicating the climate disclosures they already file with the California Department of Insurance (CDI). Following Board Resolution 26-1, staff concluded that CDI reporting would not provide equivalent GHG information going forward as it does not include Scope 3 or assurance, and now propose removing the exemption beginning in 2027. 

Insurers could submit their CDI report to CARB but would need to supplement it with any additional information required under SB 253. Whether and how the regulatory text changes will be tested through the upcoming comment process.

What comes next

• CARB will hold six sector-specific virtual listening sessions between August 5 and September 9, 2026. The comprehensive 2027 proposal is expected this fall and will carry a formal 45-day comment period.

• Implementation guidance for the initial 2026 reporting cycle should be issued by September 1 and will include a voluntary online intake platform, a guidance document, and an instructional video, while the 2026 reporting template remains optional. 

• Even though the 2027 rules are not final, the workshop points to concrete preparation. Companies should consider building a documented process for identifying which emissions sources are relevant and for supporting any exclusions; assessing how much of their current Scope 3 (and Scope 1 and 2) figures rests on primary versus estimated data; and opening the conversation with prospective assurance providers about the evidence those providers will expect — including for the disclosures that may fall within, or just outside, the assured boundary. 

The phased design is more forgiving than day-one reporting of all fifteen categories, but that flexibility carries its own documentation, governance, and assurance considerations.