The US Securities and Exchange Commission (SEC) has finally adopted long-anticipated rules governing public company disclosure of climate-related risks, strategy, governance, targets and other metrics. As expected and widely reported, several groups have filed petitions for review to challenge the new rules, but the timetable for resolving the litigation is uncertain. The results of the upcoming national elections in November could also lead to future changes to the rules. Nevertheless, most public companies should not wait out the judicial and political process before commencing compliance efforts under the SEC climate rules. Unless the rules are vacated or withdrawn in their entirety in the future, which is by no means predictable, they will take effect on a very aggressive compliance schedule. In this alert, we discuss immediate next steps for public companies.

Determine Compliance Dates. For large accelerated filers—seasoned public companies with a public float greater than $700 million—the first tranche of reporting under the SEC’s new rules will be due in 2026 annual reports based on information for fiscal years beginning in 2025, with additional tranches of information required to be reported in subsequent years. As a practical matter, large accelerated filers with a calendar-year fiscal year will need to be in position to begin collecting data by January 1, 2025. Accelerated filers—seasoned public companies with public floats between $75 million and $700 million—are granted an additional year to begin compliance, with the remainder of public companies coming online in 2028 annual reports for fiscal years beginning in 2027. But in granting a longer phase-in period for these companies to comply, the SEC acknowledged that companies outside the large accelerated filer category would need the extra time to develop systems and processes to support appropriate compliance. If the rules survive challenge, there will simply not be enough time to develop those procedures and collect data on an abbreviated timeline. Thus, public companies should begin consideration of the new rules without delay.

Conduct a Gap Analysis. The new SEC disclosure standards were influenced by various other mandatory and voluntary reporting regimes, but they will nevertheless require bespoke disclosures uniquely tailored to the federal securities laws. Each public company should begin a thorough gap analysis to determine how the rules will apply to a given company’s activities and circumstances, what data is currently available to satisfy the new requirements, which personnel are available to collect that data and oversee reporting and where there are shortcomings in information, expertise or staffing that must be addressed. Those companies that do not currently report on climate-related information may be starting the process from scratch, and they will require considerable effort to prepare for compliance with the new rules. Even companies that are relatively advanced in their ESG reporting capabilities are likely to require improvements to systems and processes to address the breadth of the new SEC rules, several of which do not track closely any of the other voluntary or mandatory reporting systems.

Review Existing Disclosures. The SEC’s adopting release points out that large numbers of public companies already make some level of ESG disclosure. Some prior disclosure may be repurposed for the SEC rules, but new drafting and data collection will likely be required for most companies. Information that a company has previously determined is (or is not) “material” under other disclosure standards may (or may not) be material under the new SEC rules and the broader standards for disclosure under the federal securities laws. The SEC materiality test may also be impacted by the way information has been characterized in prior sustainability reporting. For example, previously-identified targets and goals or other key performance indicators disseminated through other communications channels may now be required to be discussed under the new SEC rules. Conversely, if a company concludes that previously-identified climate metrics are not required to be disclosed under SEC rules, the company should be prepared to defend that determination. This process may lead some companies to reassess prior statements and previously-set targets and goals with a view toward closer alignment with SEC requirements. The SEC staff has already begun reviewing sustainability reporting made outside the SEC disclosure system and has issued comment letters to public companies when potential inconsistencies with SEC disclosures are identified. We expect this staff review process to intensify and accelerate.

Assess the Control Environment. In our experience, the process for compiling, vetting and reporting data under voluntary ESG reporting regimes varies considerably from company to company. The new SEC rules are likely to necessitate changes to those processes. Depending on the context, information filed with the SEC or disclosed to investors can create liability under a negligence or even strict-liability standard. As with other information in periodic SEC reports, CEOs and CFOs will be required to certify the accuracy of the new disclosures under the Sarbanes-Oxley Act, with potential criminal liability for material misstatements or omissions. SEC filings are further subject to SEC rules regarding disclosure controls and procedures, as well as internal controls over financial reporting, each of which must be modified to accommodate the new data streams required under the SEC climate rules. New financial reporting requirements under Regulation S-X will be subject to the annual financial statement audit process. For companies required to report Scope 1 or Scope 2 emissions, third-party assurance will also be required over time. For these reasons, we believe most public companies will be required to enhance the control environment around information required to be reported under the new SEC rules.

Consider Interplay With Other Regimes. Though the SEC’s climate rules share some similarities with mandatory reporting regimes such as those in California and Europe, there is not complete overlap, and disclosure under one set of rules is not likely to satisfy another set in full. While it is possible to borrow from prior disclosure or leverage systems and controls developed for other reporting regimes, the disclosure requirements and liability standards under the federal securities laws will require most companies to enhance existing processes. As disclosures proliferate across regulators and geographies, companies should assess the totality of disclosure holistically to ensure consistency and avoid contradiction among reports.

Assess and Manage Litigation Risk. As sustainability disclosures have proliferated, so have the volume and variety of suits against companies challenging the accuracy of that disclosure. Potential plaintiffs include consumers, investors, NGOs, state attorneys general, other federal regulators, such as the Federal Trade Commission, and various categories of activists. Given the breadth of sustainability and climate disclosures, potential claims are not limited to those under the federal securities laws, and may, by way of example, instead sound under director fiduciary duty, consumer protection or deceptive advertising statutes that require different showings of harm than the securities laws. The limited safe harbor provided in the SEC’s climate rules for certain forward-looking information, together with common law protection afforded under the bespeaks caution doctrine, may not immunize a company from the full range of potential claims, particularly in suits making claims outside the federal securities laws. Companies making disclosure under the new SEC rules must, therefore, consider the full range of potential greenwashing claims and assess other litigation risk as well, and should craft disclosures with an eye toward managing these other risks.

Evaluate Insurance Coverage. Putative claimants alleging errors, misrepresentations, fiduciary violations and similar violations by companies and their officers and directors may be covered by directors and officers (D&O), errors and omissions (E&O) or similar management liability insurance. As with most insurance issues, however, the devil is in the details, since the availability and scope of coverage will depend on a variety of factors. A good starting point is always the policy language, but even there, policy forms and endorsements vary widely between insurers, so there is no one-size-fits-all approach for companies subject to SEC scrutiny. The SEC’s climate rules provide an opportunity for companies to analyze existing insurance programs before a claim arises to determine whether they may offer protection for violations or litigation that arise from the new reporting requirements.