Which Carbon Accounting Standard Carries Legal Risk?

The legal risk in a carbon accounting standard rarely comes from the standard itself. The GHG Protocol does not issue fines. ISO 14064 does not haul a company into court. The risk arrives when a statute, regulator, assurance regime, lender, customer, or disclosure platform turns that private framework into the measure of whether the company reported correctly, preserved enough support, and used a methodology it can defend later.

That is the practical answer to the legal compliance question around ISO, the GHG Protocol, and carbon accounting standards: neither framework is law in its own right, but both now sit inside legal and quasi-legal systems that can make a methodology choice expensive to unwind. California SB 253 is the cleanest example because it expressly requires reporting “in conformance with the GHG Protocol standards and guidance,” including the Corporate Standard and Scope 3 Standard.[1] CSRD is different. It does not make ISO 14064 the carbon-accounting statute, but assurance practice under the EU regime makes ISO-style verification discipline hard to ignore.

The Compliance Status Map

A lawyer should not let the word “voluntary” do too much work here. A standard can remain privately written and still become the operative compliance yardstick once a statute points to it. The opposite mistake is just as dangerous: treating broad market adoption as a safe harbor. A company can follow a familiar framework badly, fail to document judgment calls, miss Scope 3 boundaries, or discover too late that its emissions data cannot withstand assurance.

SB 253 Is Where GHG Protocol Stops Being Merely Voluntary

California’s SB 253 applies to U.S. business entities with total annual revenue over $1 billion that do business in California, and CARB’s 2026 implementing activity has narrowed arguments about who is covered. CARB’s February 2026 approved regulation defined “doing business in California” by reference to California Revenue and Taxation Code Section 23101 and “revenue” as gross receipts under Section 25120(f)(2), with parent-subsidiary consolidation rules.[2]

That matters because ambiguity can buy time in a board memo, but it does not preserve evidence. Once applicability definitions are codified, counsel has to move from “maybe covered” to the less pleasant questions: which entity reports, whose systems produce the numbers, who signs off, who keeps the calculation files, and whether the company can show good-faith measures if CARB later challenges the report.

The penalty ceiling is not symbolic. SB 253 authorizes administrative penalties of up to $500,000 per reporting year, with CARB to consider facts and circumstances including good-faith measures.[2] The good-faith language is useful, but only if there is something to show: documented boundary decisions, retained source data, version-controlled emission-factor choices, and a record of why the company used a particular methodology at the time.

The deadline history is a good illustration of why filing calendars should not be built on stale summaries. CARB’s February 2026 materials established an August 10, 2026 deadline for initial Scope 1 and Scope 2 reporting, but CARB deferred that deadline to November 10, 2026 on June 24, 2026.[2] As of July 30, 2026, that deferral is the date counsel should be tracking, while recognizing that litigation and agency implementation can still alter the terrain.

CARB’s December 5, 2024 enforcement notice also deserves careful reading. It permits certain entities that were not collecting, and did not plan to collect, greenhouse gas data as of that date to submit a statement on company letterhead instead of a full report, but the notice is enforcement discretion rather than a statutory exemption, and it still requires retention of data.[2] The difference is not academic. An exemption means the duty does not apply. Enforcement discretion means the agency is telling you how it currently intends to handle a category of noncompliance.

What “in conformance with GHG Protocol” changes

SB 253 does not require a company to admire the GHG Protocol. It requires covered companies to report in conformance with specified GHG Protocol standards and guidance.[1] That phrasing turns choices that might once have lived in a sustainability team workbook into compliance artifacts. Organizational boundary, operational control, equity share, Scope 2 market-based accounting, Scope 3 category screening, exclusions, estimates, and recalculation policies become part of the record a company may need to defend.

For in-house counsel, the question is not whether the carbon team can say “we use GHG Protocol.” The question is whether the company can prove conformance in the way a regulator, assurance provider, or plaintiff would test it: by looking for the underlying data, the documented method, the controls over changes, and the explanation for judgment calls. The legal exposure is not created by the acronym. It is created by the gap between a statutory reference and a company’s ability to substantiate what it reported.

The SB 253 Litigation Posture Is Not the Same as the SB 261 Posture

The California litigation has to be described with some restraint because posture matters. Challenges to SB 253 and SB 261 have included First Amendment arguments, but emissions-data disclosure and climate-risk narrative disclosure have not traveled identically. Reported interim appellate activity treated SB 253’s emissions disclosure differently from SB 261’s climate-risk disclosure, with SB 253 analyzed as compelled disclosure of factual and uncontroversial information under Zauderer while SB 261 received more favorable treatment from challengers at the injunction stage.[3]

That distinction is one reason emissions data may prove more durable than broad climate-risk narrative requirements, but it is not the same thing as final certainty. Oral argument occurred on January 9, 2026, and as of July 30, 2026, the merits posture remained unresolved in reported coverage.[4] A future ruling, further injunction activity, or Supreme Court review could change the compliance picture. The immediate legal-management point is narrower: companies should not assume that challenges to narrative climate-risk disclosure will automatically disable emissions reporting obligations.

The federal backdrop does not remove that pressure. The SEC proposed rescission of its climate disclosure rule in 2026, but that process remains in flux, and state-level requirements have become the primary U.S. driver for many companies with California exposure.[5] A federal retreat may simplify one workstream while leaving SB 253 systems, contracts, and assurance expectations very much alive.

CSRD Makes ISO 14064 Important Through Assurance, Not Direct Incorporation

The EU CSRD analysis is less satisfying for anyone who wants a single statutory hook. CSRD reporting under ESRS E1 requires greenhouse gas disclosure, but ISO 14064 is not simply named as the mandatory carbon-accounting law in the way SB 253 points to the GHG Protocol.[1] ISO 14064-3 becomes important because assurance providers and accreditation systems need a verification framework for testing emissions assertions.

That distinction should shape the legal file. If a company is subject to CSRD, the question is not “Does ISO 14064 itself fine us?” It is whether the company’s emissions reporting can survive limited assurance, and later more demanding assurance expectations, using verification practices that market participants and accredited bodies recognize. A technically plausible inventory that cannot be verified is a compliance problem, not merely an operations problem.

This is where legal and sustainability teams often talk past each other. A carbon-accounting technician may focus on whether the calculation is reasonable. Counsel should also ask whether the evidence trail is reviewable by someone who did not build it: invoices, meter data, supplier responses, estimation logic, consolidation scope, recalculation triggers, and management approval. ISO 14064-3 is useful because it disciplines that review, even when the statute is not written as an ISO mandate.

Market Adoption Raises the Floor, but It Does Not Create a Safe Harbor

The commercial pressure is real. The GHG Protocol has reported broad integration into mandatory climate disclosure rules, and available reporting identifies approximately 92% of Fortune 500 companies as using the GHG Protocol, with more than 22,100 companies disclosing through CDP in 2025.[1] SBTi and CDP can also make GHG Protocol-aligned reporting functionally necessary for companies that want to satisfy investor, customer, or supply-chain expectations.

But adoption is not effectiveness, and it is not immunity. A procurement clause that asks for GHG Protocol data can create contract risk without creating statutory coverage. A voluntary CDP disclosure can become a representation investors or customers rely on. A supplier questionnaire can force Scope 3 discipline before a regulator does. Those pressures matter, but they should be labeled correctly: commercial obligations, assurance expectations, and reliance risk are not the same as a statute with a penalty schedule.

The 2028 Harmonization Is a Transition Risk, Not a Comfort Blanket

The GHG Protocol and ISO announced a partnership on September 9, 2025 to develop unified dual-logo corporate standards combining the ISO 1406x series with the GHG Protocol Corporate, Scope 2, and Scope 3 standards.[6] The point is not that companies can wait for the unified standard. The point is that a 2026 methodology decision may be judged against a moving target before the next assurance cycle is mature.

The timeline has already moved. Trellis reported on July 29, 2026 that the consultation draft is now expected in Q2 2027, after delay from the original timetable, and that the Scope 2 workstream alone drew roughly 1,100 comments.[7] The expected effective date remains 2028, but further slippage is possible.[7]

Scope 2 is the live example of why this matters. A group of 66 companies representing more than 33,500 organizations signed a “may not shall” letter opposing mandatory hourly matching.[7] As of July 30, 2026, that issue remained unresolved. Companies making energy procurement, renewable certificate, and emissions-accounting decisions now should avoid pretending that the final rule is already settled.

The transition cuts in both directions. A company that uses the GHG Protocol but has thin verification controls may need to add ISO-style assurance infrastructure. A company that is comfortable with ISO verification but has not built complete Scope 3 mapping may discover that its verified process is too narrow for statutory or customer disclosure demands. The unified Product Carbon Footprint standard is also expected to affect CBAM compliance, which gives the harmonization work a trade-compliance edge rather than merely a sustainability-reporting one.[6]

What Counsel Should Treat as the Defensible Position

This is not legal advice, and company-specific coverage should be assessed against the current statute, regulations, corporate structure, and reporting footprint. Still, the defensible posture is fairly clear. Do not describe the GHG Protocol or ISO 14064 as if they independently impose penalties. Do not dismiss them as “just voluntary” once they are incorporated into statutes, assurance practice, or contract commitments. Treat them as the methodology layer in a larger compliance system.

For SB 253, that means the legal file should tie the company’s coverage analysis to CARB’s codified applicability definitions, identify the reporting entity and consolidated group, preserve evidence of good-faith compliance, and document how GHG Protocol conformance was assessed. For CSRD, it means emissions assertions should be built for assurance review, not merely internal management reporting. For supply-chain requests, it means contract language should not promise more methodological certainty than the company can substantiate.

The live uncertainties are not reasons to wait. They are reasons to keep the file current: CARB’s deferred November 10, 2026 SB 253 deadline; pending California litigation and any further appellate review; the SEC rescission process; unresolved Scope 2 hourly matching; and the possibility that the GHG Protocol-ISO harmonization timeline slips again. The risk is not that GHG Protocol or ISO 14064 punish companies by themselves. The risk is that regulators, assurance providers, and counterparties now use carbon-accounting methodology as evidence of whether a company’s climate disclosure was supportable when it was made.

References

1. Overview of GHG Protocol Integration in Mandatory Climate Disclosure Rules, GHG Protocol, January 2025.
2. California Climate Legislation Reporting Updates 2026, Deloitte DART, updated July 1, 2026.
3. Injunction to Block California Environmental Disclosure Laws Denied, Skadden, November 2025.
4. California Climate Disclosure Laws: Ninth Circuit Hears Oral Argument, No Ruling Yet, White & Case.
5. Federal Requirements Wane as State Regulations Grow, Climate Solutions Legal Digest, December 2025.
6. GHG Protocol Announces ISO Partnership to Develop Unified Carbon Accounting Standards, Beveridge & Diamond.
7. GHG Protocol Adjusts Standards Update Timelines, Trellis Group, July 29, 2026.