On March 6, 2024, the Securities and Exchange Commission (SEC) released final rules regarding the Enhancement and Standardization of Climate-Related Disclosures for Investors (the Final Rules). We provided an overview of the Final Rules here. The Final Rules mark the third major climate-related disclosure regime enacted in the past two years: The European Union finalized its Corporate Sustainability Reporting Directive (CSRD) in early 2023, and California enacted a series of climate-related disclosure laws in late 2023.

 

These disclosure rules will have far-reaching consequences even though they admittedly do not apply directly to a majority of companies operating in the United States. The Final Rules apply to public companies, the CSRD pulls in non-European Union companies conducting more than €150 million on the EU market, and the California rules capture companies doing more than $1 billion of business in California. Adding to the complexity of this evolving area, the Final Rules immediately became the subject of multiple lawsuits, and on April 4, 2024, the SEC voluntarily delayed their implementation pending resolution of the litigation. The California laws likewise face legal challenges.

But these rules are unlikely to go away entirely, and their effect is to create significant pressure on the companies that are regulated to evaluate their exposure to climate change and other climate-related risk factors and then make well-informed decisions on whether to implement action plans to mitigate those risks. The disclosure rules will have long-lasting impacts affecting far more companies than those regulated directly. Here are some things that every company should be thinking about in response to these rules.

Can your company identify its sources and levels of greenhouse gas emissions?

All three rules require disclosure of information regarding greenhouse gas emissions. Greenhouse gas emissions are divided into “scopes.”

• “Scope 1” emissions include all the emissions that come from sources owned or controlled by a particular company: things like emissions from running a boiler to heating the office building or emissions from employees operating company-owned vehicles.
• “Scope 2” emissions are indirect greenhouse gas emissions from the generation of purchased or acquired energy: how was the electricity, steam, heat, or cooling that runs the company’s operations generated? Fossil fuel, solar, wind energy? These Scope 2 emissions are often a company’s largest source of greenhouse gas emissions.
• “Scope 3” emissions cover everything else: all the other greenhouse gas emissions in a company’s “value chain.” The value chain includes every part of a company’s operations, from acquiring and transporting raw materials to distributing a finished product.

Although the SEC Final Rules pulled back from requiring disclosure of Scope 3 emissions, both the EU and California rules require them. Companies that fall under the EU and California rules are already preparing to report Scope 3 emissions when the rules kick in starting in 2026.

Let’s break that down. For example, if you are a tier 1 or tier 2 supplier, to a company doing substantial business in the EU or California that now has to report under the climate-related disclosure rules (let’s call this the regulated company for clarity), then your company’s direct greenhouse gas emissions are in the regulated company’s “value chain” and have to be reported as part of its Scope 3 emissions. If your company transports raw materials to the regulated company, or transports the regulated company’s finished products to its customer base, your company’s direct greenhouse gas emissions have to be reported by the regulated company as part of its Scope 3 emissions. If your company purchases products from a regulated company, and your company’s use of those products generates greenhouse gas emissions, then your company’s direct emissions have to be reported as part of the regulated company’s Scope 3 emissions. Furthermore, nothing in these rules caps how far up or down the value chain you have to go to accurately capture the Scope 3 emissions: if your company is anywhere in the value chain of a regulated company, then your company’s direct emissions are arguably Scope 3 emissions that need to be reported. This means that your clients, business partners, customers, and suppliers may be contacting you for information on your company’s direct greenhouse gas emissions.

Waiting to take action until such a request comes in will put your business in a challenging position. It can take significant time to develop rigorous reporting measures and procedures that will provide accurate data—data that the regulated company ultimately will have to publicly report to regulatory agencies. Being able to readily provide accurate and timely information on greenhouse gas emissions to your business partners may provide a competitive business advantage over those companies that cannot. It is worth taking stock of your business partners now to see whether you fall within the value chain of a regulated company. If you do, consider taking steps now to identify and measure your company’s greenhouse gas emissions so you can effectively meet your business partners’ needs.

Does your company pose a material climate-related risk to a regulated company?

These rules also require disclosure of climate-related risks. The SEC Final Rules, for example, require disclosure of climate-related risks reasonably likely to have a material impact on a company’s strategy, operations, or short- and long-term financial condition. They also require disclosure of any transition plan to mitigate or adapt to these risks.

The definition of “climate-related risks” is quite broad, capturing both actual and potential negative impacts of climate-related conditions and events. It includes short-term weather events like hurricanes, floods, tornadoes, and wildfires; long-term effects like temperature changes, sea-level rise, and decreased access to fresh water; and transition-related impacts, such as technological changes to mitigate and adapt to climate-related risks.

As with the greenhouse gas emissions reporting, the climate-related risk disclosures have a hook to bring in more companies than just those directly regulated by the rules. Although the Final Rules specify that regulated companies ordinarily need not disclose climate-related risks to other businesses in their value chain, the Final Rules make an exception for when those risks are reasonably likely to materially impact the regulated company. To use our earlier example, if your company serves as a major tier 1 or tier 2 supplier to a regulated company, and your primary manufacturing plant is in a location that, due to a projected sea-level rise, faces a significant risk of flooding that could halt production, this could have a material impact on the regulated company, requiring disclosure. If your company will have to substantially retool its operations or change its business model to comply with greenhouse gas emissions reduction targets set by the state in which you operate, this could have a material impact on the regulated company with whom your company partners, requiring disclosure.

The only way to know whether your company’s individual climate-related risks may pose a material risk to a regulated company is to determine whether any of your business partners will be regulated under the climate-related disclosure rules, identify what your company’s climate-related risks are, assess the potential impacts, and evaluate possible mitigations. Companies that understand their risks and have an appropriate plan to address them will be better positioned to provide critical information to their business partners moving forward.

This emerging area of climate-related disclosures will continue to evolve, particularly in the face of the ongoing legal challenges. But these rules are unlikely to go away entirely. The European Union continues to make climate-related disclosure a priority. Other U.S. states already have signaled that they may follow California’s lead in adopting state-specific disclosure laws. Companies will benefit from taking stock of their potential risk factors now, so they have appropriate mechanisms in place to provide accurate climate-related information when – not if – the requests come in.