The executive liability gap in California SB 253 first-year filings

Here's the issue: California's Climate Corporate Data Accountability Act (SB 253) requires an executive officer statement certifying that the company's greenhouse gas disclosure is "true and correct." The first Scope 1 and Scope 2 reports are due August 10, 2026. Most finance teams are treating this as a compliance checkbox—calculate the totals, file the report, move on. But the certification carries personal liability under California law, and the standard is not "our best estimate" but "true and correct." That gap between what the CFO thinks they are signing and what the statute actually says is the liability surface.

However, an SB 253 filing consists of two things: the emissions totals themselves, and the evidence chain that supports those totals.

The emissions totals on their own have no value to the California Air Resources Board (CARB) or to the assurance provider who will verify them starting in 2027. The evidence chain—the invoices, utility bills, bill-of-materials data, allocation methodologies, and calculation lineage—is what the executive officer statement is actually certifying. When an officer signs "true and correct," they are not signing a number. They are signing the reproducibility of that number.

While calculating emissions has become cheaper—dozens of SaaS tools can ingest meter data and produce a total—building a defensible evidence chain has become more expensive. If a company files in 2026 with estimated allocations, missing supplier data, or undocumented assumptions, the 2027 limited assurance engagement will surface those gaps, and the officer who signed the 2026 statement will need to explain why they certified a filing with no support. The cost of rebuilding the evidence file after the fact, under assurance pressure, will outpace the cost of collecting it correctly the first time by a factor of three to five.

How do you solve this? I think the operators we work with are treating 2026 as a dry run on assurance methodology, not a compliance formality. They are collecting source documents now, documenting every allocation, and running a shadow assurance review internally before the executive signs. For now, that approach is the only one that closes the liability gap between "we filed a number" and "we can defend the number."

The shape of the argument, visualised below.

Myth 1: "Executive officer statements are standard boilerplate"

Reality: SB 253 requires a named executive officer to certify that the emissions disclosure is "true and correct." This is not a safe harbor provision. Under California's enforcement framework, personal liability attaches to the officer if the statement is later found to be materially inaccurate. The statute does not include language like "to the best of our knowledge" or "based on available information." The standard is absolute, and the officer's name goes on file with CARB.

According to CARB's February 2026 final regulation, "The reporting entity shall include a statement by a responsible corporate officer that the information provided is true and correct." The regulation does not define a materiality threshold for "true and correct," which means any subsequent assurance finding—limited or reasonable—that contradicts the officer's statement creates legal exposure.^[1]

Myth 2: "We can fix the data in 2027 when assurance starts"

Reality: Limited assurance of Scope 1 and Scope 2 becomes mandatory in 2027, but the 2027 engagement reviews the 2026 reporting year—the same period the executive already signed. If the assurance provider identifies missing source documents, undocumented assumptions, or allocation errors in the 2026 data, the company faces two problems: the assurance opinion will be qualified or adverse, and the executive officer's 2026 certification becomes a potential false statement. Fixing the data in 2027 does not retroactively cure the 2026 filing.

Corporate Sustainability Disclosure Explained, a January 2026 analysis, notes: "Assurance-ready means documented methodologies, controls, and audit trails, a substantially higher bar than producing a number, and a significant source of first-cycle cost and implementation complexity."^[2] The evidence chain is built in real time, not reconstructed under audit.

Myth 3: "SB 253 is just California's version of the SEC rule"

Reality: The SEC climate disclosure rule, now formally proposed for rescission as of mid-2026, included safe harbor protections for forward-looking statements and allowed for reasonable-basis disclosures. SB 253 includes no such protections. The statute applies strict liability to the executive officer statement, and CARB's enforcement authority includes civil penalties up to $500,000 per violation for knowing violations or failures to report.

As Commonwealth Climate Law's February 2026 board brief explains, "The claim is assured. The penalty is financial-grade. The enforcement date is fixed and near. A board that still files climate under corporate social responsibility is carrying a liability on the wrong risk register."^[3] SB 253 is not a disclosure framework—it is an enforcement framework with a disclosure mechanism.

Myth 4: "Limited assurance is just a light review"

Reality: Limited assurance is a negative-form opinion ("nothing came to our attention"), but the procedures required to issue that opinion are substantive. The assurance provider must review calculation methodologies, test source documents, verify allocation logic, and confirm that every reported emission line can be traced back to a primary record. For Scope 1 and Scope 2, this includes utility bills, meter readings, fuel purchase invoices, refrigerant logs, and vehicle mileage records.

CARB's July 2026 proposed assurance standards specify that verification must be performed pursuant to ISO 14064-3, ISO 14065, the GHG Protocol Corporate Standard, or equivalent. All four standards require population completeness testing, meaning the assurance provider must confirm that all emission sources are identified and quantified, not just sampled. A company that treats limited assurance as "just a review" will discover during the engagement that half their data is missing.^[4]

Myth 5: "Scope 3 is the hard part—Scope 1 and Scope 2 are straightforward"

Reality: Scope 1 and Scope 2 emissions are easier to measure than Scope 3, but they are not automatically assurance-ready. The difficulty is not in the calculation—it is in the evidence file. A Scope 1 total might include stationary combustion, mobile combustion, fugitive emissions, and process emissions. Each category requires different source documents, different emission factors, and different allocation rules if facilities are shared. A Scope 2 total might blend location-based and market-based methods, which triggers dual reporting and contract-specific documentation for renewable energy certificates.

Good.Lab's 2026 CSRD reporting guide notes that "achieving compliance will demand comprehensive and accurate reporting by certain companies on more than 1,100 sustainability metrics." While SB 253 requires far fewer metrics than CSRD, the principle is the same: every metric needs a support file, and the support file is what the assurance engagement tests. The CFO who assumes Scope 1 and Scope 2 are "done" because the calculator produced a number is signing a liability they have not yet quantified.^[5]

Myth 6: "We can outsource this to our sustainability consultant"

Reality: The executive officer statement cannot be outsourced. The officer signs personally, and the statute assigns liability to the individual, not the entity. A consultant can build the inventory, collect the data, and prepare the filing, but the officer is still certifying that the disclosure is "true and correct." If the consultant's work is later found to be incomplete or inaccurate, the officer—not the consultant—faces CARB enforcement.

This is the opposite of how most companies handle financial audits, where the auditor opines on the accuracy of the financial statements and management's assertions are backed by internal controls. SB 253 flips the model: the officer asserts first, and the assurance provider verifies later. That one-year gap between certification and verification is where the liability lives.

Myth 7: "The first year is a learning year—enforcement will be lenient"

Reality: CARB has not signaled any enforcement leniency for first-year filers. The statute's civil penalty provisions are live from the first filing deadline, and the agency's February 2026 final rule includes no phase-in period for penalties. The only relief provided is that limited assurance is not required in 2026—but CARB explicitly recommends treating 2026 as a dry run on assurance, and the 2027 engagement will review 2026 data.

Moreover, the Empowering Consumers for the Green Transition Directive (ECGT), which prohibits carbon-neutral marketing claims without substantiation, went live across the EU on September 27, 2026. That directive applies extraterritorially to non-EU companies marketing in EU member states, which means a US company with weak emissions data faces parallel enforcement risk in two jurisdictions. The "learning year" assumption does not account for the fact that regulators on both sides of the Atlantic are moving to financial-grade enforcement simultaneously.^[6]

Summary table: SB 253 myths vs. regulatory reality

How Emission3 fits

Emission3 is built for the executive officer liability problem. Every reported emission in the platform traces back to a source document—an invoice, a utility bill, a bill of materials, a meter reading. The calculation lineage is deterministic: you can replay any number, see which document it came from, and export an evidence pack that an assurance provider can test without asking you to reconstruct your methodology.

We do not produce estimates. We produce audit-ready lineage. When the CFO signs the executive officer statement in August 2026, they are signing a disclosure we can defend in the 2027 limited assurance engagement, because the support file already exists. That is the gap we close: between the number you report and the liability you carry when you report it.

If you are preparing a first-year SB 253 filing, the question is not "can we calculate Scope 1 and Scope 2 by the deadline." The question is "can we defend the number the executive officer signs." Those are two different projects, and the second one determines the cost and risk of the first.

Start with the evidence file, not the total

The first SB 253 Scope 1 and Scope 2 deadline is fixed: August 10, 2026. The executive officer statement is not optional, and the certification standard—"true and correct"—is absolute. Most finance teams are optimizing for filing speed. The operators who understand the liability surface are optimizing for evidence completeness. When 2027 limited assurance begins, the cost difference between those two approaches will be a multiple, not a margin.

If your company is in scope for SB 253—more than $1 billion in revenue, doing business in California—and you do not yet have a source-document-level inventory for 2025 and 2026, you are carrying an unquantified liability that becomes visible the day your executive officer signs. The solution is not to file faster. The solution is to build the evidence chain that makes the filing defensible, then file.

Book a CBAM readiness call with Emission3. We map your supplier data, identify gaps, and walk through what an assurance-ready evidence file looks like for SB 253, CSRD, and CBAM filings. All customers start with a readiness conversation—no anonymous self-serve, no placeholder estimates.^[7]