SB 261 Explained: Who Must Comply, Report, and Deadlines

SB 261 compliance requires any company with more than $500 million in annual revenue that does business in California to publish a biennial report describing its climate-related financial risks and the steps it has taken to reduce them. The law, formally the Climate-Related Financial Risk Act, is codified at Health and Safety Code Section 38533 and overseen by the California Air Resources Board (CARB). The original filing deadline was January 1, 2026, but a federal court injunction has paused enforcement, and CARB has said it will set a new date once the litigation concludes.

Current Status of Enforcement

On November 18, 2025, the Ninth Circuit Court of Appeals granted an injunction in Chamber of Commerce v. Sanchez, blocking CARB from enforcing SB 261 while the appeal is pending.¹ In a December 2025 enforcement advisory, CARB confirmed it will not penalize covered entities for missing the January 1, 2026 statutory deadline and said it will announce an alternate reporting date after the appeal is resolved.

The underlying statute has not been repealed or amended. Everything the law requires remains on the books, and companies that expect to be covered should keep preparing so they are not scrambling if CARB sets a short new deadline. Those that want to file during the pause can do so: CARB opened a voluntary submission docket on December 1, 2025.²

Which Companies Are Covered

SB 261 applies to any “covered entity,” defined as a corporation, partnership, limited liability company, or other business entity that meets two conditions: it has total annual revenues above $500 million, and it does business in California.³ Revenue is measured from the prior fiscal year and includes income earned everywhere, not just inside California. The entity does not have to be incorporated in California. Companies formed under the laws of another state, the District of Columbia, or a federal act qualify if they clear both thresholds.

California’s test for “doing business” comes from Revenue and Taxation Code Section 23101. A company is doing business in the state if it actively engages in transactions for profit there, or if its California sales, property, or payroll exceed annually adjusted dollar thresholds.⁴ For 2025, those were roughly $757,000 in California sales, $75,700 in California property, or $75,700 in California payroll. The figures adjust each year for inflation.

Insurance companies are carved out. The statute excludes any entity regulated by the California Department of Insurance and any entity in the business of insurance in another state.³ Those entities face separate climate-related requirements under the insurance code.

Parent Companies and Subsidiaries

Reports can be consolidated at the parent level. If a subsidiary independently qualifies as a covered entity, it does not need to file a separate report as long as the parent’s report covers it.³ For large corporate groups where multiple subsidiaries each exceed $500 million in revenue, one consolidated report satisfies the obligation for the whole group.

What the Report Must Contain

The statute requires two categories of disclosure. First, a covered entity must describe its climate-related financial risk. Second, it must explain the measures it has adopted to reduce and adapt to that risk.³ The law defines climate-related financial risk broadly as material risk of harm to financial outcomes from physical and transition risks, reaching everything from supply chain disruptions and employee safety to shareholder value and consumer demand.

Physical risks are the direct consequences of environmental changes: extreme weather, flooding, wildfires, rising sea levels, and similar events that can damage assets or disrupt operations. Transition risks are the economic shifts tied to moving toward a lower-carbon economy, such as new regulations, changing technology, or evolving customer preferences. A report needs to address both and explain how each could affect the company’s financial position.

The statute includes a safety valve. If a covered entity cannot produce a complete report, it must still provide the disclosures it can, give a detailed explanation for the gaps, and describe the steps it plans to take to produce complete disclosures in the future.³ That is not permission to skip reporting. It is a structured way to acknowledge limitations in a first-cycle report, especially for companies new to climate-risk analysis.

Which Reporting Frameworks Qualify

The default framework is the one developed by the Task Force on Climate-related Financial Disclosures (TCFD), specifically the June 2017 Final Report of Recommendations or any successor to it.³ The statute does not lock companies into TCFD alone. CARB’s draft compliance checklist confirms entities may also use the International Sustainability Standards Board’s IFRS S2 standard, or a report prepared under any requirement from a regulated exchange, national government, or other governmental entity, including U.S. federal rules.⁵ The TCFD formally disbanded in 2023 and its principles were folded into IFRS S2, so companies already reporting under IFRS S2 can likely satisfy SB 261 without duplicating work.

Deadlines and Reporting Cycle

Under the original timeline, the first climate-related financial risk report was due on or before January 1, 2026, covering data from the prior fiscal year. After that, reports are required biennially.³ Every two years, not every year. That is less frequent than the annual emissions reporting required under the companion law SB 253.

With the Ninth Circuit injunction in place, the January 1, 2026 deadline is suspended. CARB has said it will announce a new compliance date once the litigation is resolved.¹ The biennial clock would presumably start from whatever date CARB sets, though the agency has not confirmed that.

Where to Publish and How to Submit

The statute requires each covered entity to publish a copy of its report on its own website and make it publicly accessible.³ The document should not sit behind a paywall or password gate. An investor relations page or a dedicated sustainability section is typical placement.

Beyond website posting, CARB’s docket process indicates entities should also submit through the public docket system. For companies voluntarily filing during the injunction, CARB asks for a company statement on official letterhead and a link to the report on the company’s website, submitted via the docket page.² Companies filing consolidated reports need to specify which subsidiaries are included.

Penalties

CARB has authority to impose administrative penalties of up to $50,000 per reporting year on entities that either fail to publish a report or publish one with inadequate information.⁶ For a company with revenue above $500 million, $50,000 is modest, but public identification as noncompliant with a high-profile climate law can carry more weight than the dollar amount.

CARB considers compliance history and the nature of the reporting failure when setting a penalty. A company that made a genuine attempt but fell short will likely face a different response than one that ignored the requirement outright. The gap-reporting provision works in a company’s favor here: documenting what you cannot yet report and explaining why is far better than submitting nothing. While enforcement is paused, the penalty framework stays on the books and will apply once CARB sets a new compliance period.

How SB 261 Differs From SB 253

SB 261 is one of two major California climate disclosure laws passed in 2023. The other, SB 253 (the Climate Corporate Data Accountability Act), requires large companies to report their greenhouse gas emissions, including direct emissions, energy-related indirect emissions, and eventually supply-chain emissions. SB 253 applies to a narrower group: businesses with more than $1 billion in annual revenue, double the threshold for SB 261.⁶

The two laws ask different questions. SB 253 asks how much greenhouse gas a company is producing. SB 261 asks how climate change could hurt a company financially. A business with revenue between $500 million and $1 billion is subject to SB 261 but not SB 253. A business above $1 billion that does business in California faces both. There is natural overlap in the underlying data, since an emissions profile feeds into transition-risk analysis, but the reports serve different purposes and follow different frameworks.

Both laws are caught up in the same litigation. The Ninth Circuit injunction covers SB 261 specifically, but the broader legal challenge in Chamber of Commerce v. Sanchez targets both. Companies subject to either or both should track the case, because the outcome will determine whether these obligations proceed as written, are modified, or are struck down.

Administrative Fees

CARB plans to charge covered entities an annual fee to fund administration of the SB 261 program. The statute authorizes the fee but does not fix a dollar amount. CARB calculates the total cost of running the program each year and divides it among reporting entities.⁷ The draft regulatory text describes this as a flat annual fee per program. CARB anticipated invoicing companies after adopting its fee regulations, projected for September 2026. Given the enforcement pause, that timeline may shift.

1
California Air Resources Board. Enforcement Advisory Climate-Related Financial Risk Reporting (SB 261)
2
California Air Resources Board. Climate-Related Financial Risk Reports (SB 261) Docket
3
California Legislative Information. California Health and Safety Code 38533
4
Franchise Tax Board. Doing Business in California
5
California Air Resources Board. Climate Related Financial Risk Disclosures Draft Checklist
6
California Air Resources Board. California Corporate Greenhouse Gas Reporting and Climate Related Financial Risk Disclosure Programs
7
California Air Resources Board. Article 6 – California Climate Disclosures