Sustainability Assurance Requirements: SB 253 vs. CSRD Compared (2026)

If your company does business in California and the EU, you are now subject to two mandatory sustainability assurance regimes simultaneously. California's SB 253 and the EU's Corporate Sustainability Reporting Directive (CSRD) share the same destination but take different routes, and confusing one for the other will cost you time, money, and compliance standing.

This guide maps the two regimes side by side, explains what limited versus reasonable assurance actually demands from your data systems and controls, and tells you what to do in H2 2026 before the mandatory window opens.

Key takeaway: No assurance is required for SB 253's inaugural 2026 filing. But limited assurance on Scope 1 and 2 becomes mandatory in 2027, and the infrastructure to support it must be built now. CSRD has required limited assurance from day one and will stay there permanently after the Omnibus I simplification.

SB 253 vs. CSRD Sustainability Assurance Requirements: Side-by-Side

The table below captures the decisions that matter for CFOs, ESG controllers, and audit committees navigating both regimes. (For a full breakdown of SB 253's reporting mechanics, see California SB 253: November 10 GHG Reporting Guide for CFOs. For CSRD's scope and Omnibus I changes for US companies, see CSRD Reporting Requirements for US Companies 2026: The Omnibus Reset.)

Sources: PwC In Depth, updated July 30, 2026; Asuene, 2026; SGS Sustainability Assurance webinar, 2025

What the CARB Rulemaking Uncertainty Actually Means Right Now

The most important regulatory development of 2026 is one most ranking articles have not yet covered. CARB withdrew its regulatory package in June 2026, and on July 27, 2026, released proposed modifications that defer the year-1 Scope 1 and Scope 2 filing deadline from August 10 to November 10, 2026. A 15-day public comment period on those modifications closed August 11, 2026.

The modifications also incorporate first-year reporting and enforcement relief previously described in CARB's December 2024 Enforcement Notice, which confirmed that companies demonstrating good faith effort and retaining supporting data would not face penalties in the inaugural cycle. That relief was reaffirmed at CARB's March 23, 2026 public workshop.

Three things remain unresolved as of August 2026:

1. The formal Notice of Proposed Rulemaking for 2027 assurance standards has not been published. CARB has proposed five eligible frameworks (ISSA 5000, ISAE 3000/3410, AICPA AT-C 210/205, AA1000AS v3, ISO 14064-3) but these are not yet final.
2. ISAE 3410 has a proposed sunset. Under CARB's current framework, ISAE 3000 and ISAE 3410 are eligible only until December 2026. Companies currently using ISAE 3410 for voluntary assurance need to plan a transition to ISSA 5000 or AICPA AT-C for mandatory 2027 compliance.
3. Scope 3 assurance requirements are still under consideration. CARB presented three approaches at the March 2026 workshop: broad applicability across all 15 GHG Protocol categories, a sectoral phase-in prioritizing transportation and industrial sectors, and a category-based phase-in starting with the five most widely reported categories (purchased goods and services, business travel, and employee commuting).

One important distinction on enforcement: SB 261 (climate-related financial risk disclosures, Cal. H&S Code §38533) is currently under a court injunction granted November 18, 2025. SB 253 is not. Companies can reasonably deprioritize SB 261 TCFD-aligned risk disclosure preparation relative to SB 253 GHG assurance work, but should not treat the injunction as permanent.

What CSRD's Permanent Limited Assurance Means for Your Planning

CSRD's assurance requirement is now fixed at limited assurance, permanently. The EU Omnibus I simplification package, adopted April 2025, removed the originally planned escalation to reasonable assurance from the directive. This is a significant planning change that most companies subject to both regimes have not fully absorbed.

If your team budgeted for reasonable assurance preparation under CSRD, that investment is now misallocated. The practical implication: CSRD-scoped companies can align their assurance infrastructure with limited assurance standards and hold it there, rather than building toward a more demanding evidence threshold that will never arrive under EU law.

For US companies subject to CSRD, the primary eligible standard is ISSA 5000, the IAASB's International Standard on Sustainability Assurance. ISSA 5000 is also on CARB's proposed eligible list for SB 253, which creates a practical path to a single assurance engagement covering both regimes (discussed below).

Limited vs. Reasonable Assurance: What Each Demands From Your Data

Most content defines these terms. Few explain what they actually require from a finance or ESG team. Here is the operational difference.

Limited assurance is a negative assurance conclusion: the verifier states that nothing came to their attention indicating the data is materially misstated. The evidence-gathering is primarily inquiry and analytical procedures. The verifier will test whether your emissions numbers are traceable to source data, whether calculation methodologies are consistently applied across periods, and whether estimates are supported by documented assumptions. Think of it as the sustainability equivalent of a financial review engagement under SSARS.

Reasonable assurance is a positive conclusion: the verifier states the data is free from material misstatement. It requires substantive testing, corroboration of source data, and a much deeper examination of internal controls. It is closer to a full financial statement audit in evidence requirements and operational burden.

As Asuene's assurance practitioners put it: "GHG assurance is not an audit of your sustainability strategy. It is an independent examination of whether your emissions data is free from material misstatement."

For companies preparing for 2027 SB 253 limited assurance, the minimum infrastructure requirements are:

• Data traceability: Every emissions figure must trace to a source document (utility bill, fuel purchase record, activity log). Spreadsheet-only environments rarely survive this test.
• Methodology consistency: The same calculation approach must be applied across reporting periods. Verifiers will test year-over-year comparability for both SB 253 and CSRD.
• Documented assumptions: Estimates, emission factors, and boundary decisions must be written down and defensible, not reconstructed after the fact.
• Change logs: Any revision to prior-period data must be tracked and explained.

For the 2030 reasonable assurance phase under SB 253, add:

• Formal internal controls over emissions reporting (analogous to ICFR under SOX)
• Substantive testing protocols for key data inputs
• Audit committee oversight formalized in governance documents

Which Assurance Standard Should You Target?

ISSA 5000 is the convergence point. It is on CARB's proposed eligible list for SB 253 and is the primary standard under CSRD. For companies subject to both regimes, building toward ISSA 5000 now is the lowest-risk path to a single assurance engagement that satisfies both regulators.

Here is how the five CARB-proposed standards compare:

The ISAE 3410 sunset is an underappreciated trap. Companies that engaged a verifier under ISAE 3410 for voluntary 2025 or 2026 assurance need to confirm their provider can transition to ISSA 5000 or AICPA AT-C for the mandatory 2027 cycle. Not all providers are credentialed across all five frameworks.

Can your existing financial auditor do this? Possibly. AICPA AT-C 210 and 205 are designed for CPA firms, and the same firm that signs your financial statements can in principle provide sustainability assurance under AT-C. However, independence rules, capacity, and technical GHG expertise vary significantly by firm and engagement team. Do not assume your audit partner's sustainability practice is resourced for this without a direct conversation.

Can One Assurance Engagement Cover Both SB 253 and CSRD?

Yes, in principle, if structured correctly. The key conditions are:

1. The assurance standard used must be acceptable under both regimes. ISSA 5000 currently satisfies this.
2. The scope of the engagement must cover the emissions and sustainability data required by both. CSRD's scope under ESRS is broader than SB 253's GHG-only focus, so a CSRD engagement will typically encompass the SB 253 GHG data as a subset.
3. The verifier must be qualified under both regimes. CSRD requires a statutory auditor or accredited provider; CARB's provider requirements are still under formal rulemaking.

In practice, many multinationals will run a single ISSA 5000 engagement covering their ESRS sustainability data (which includes GHG) and use the resulting assurance report to satisfy SB 253's Scope 1 and 2 requirement. This is operationally efficient but requires careful scoping with your verifier before the engagement begins, not after.

The Verifier Capacity Problem Nobody Is Talking About

Qualified ISSA 5000 and ISAE 3410 verifiers are a finite resource. As 2027 SB 253 deadlines approach, approximately 5,300 California-scoped companies will simultaneously need limited assurance engagements. The supply of credentialed providers has not scaled proportionally.

This is not a hypothetical risk. The same capacity constraint played out in the EU as CSRD's first wave hit, with assurance providers reporting booking queues extending six to nine months. Companies that wait until Q1 2027 to engage a verifier will find the market significantly tighter than it is today.

The practical implication: engage a verifier in H2 2026, even for voluntary limited assurance on your 2025 or 2026 data. This serves two purposes. First, it secures your place in the provider's 2027 schedule. Second, it gives your team a dry run on the data infrastructure gaps the verifier will find, so you can fix them before the mandatory cycle.

H2 2026 Readiness Checklist: What to Do Before Mandatory Deadlines Activate

This checklist is structured by owner. Assign accountability before the end of Q3 2026.

CFO / Finance Leadership

• Confirm whether the company is in scope of SB 253 (revenue over $1 billion, doing business in California), CSRD, or both
• Allocate budget for verifier engagement in H2 2026 (voluntary assurance) and 2027 (mandatory)
• Decide on target assurance standard (ISSA 5000 recommended for dual-regime companies)
• Assess whether existing financial auditor can provide sustainability assurance under AICPA AT-C or ISSA 5000
• Review SB 261 enforcement status before committing budget to TCFD risk disclosure preparation

ESG / Sustainability Team

• Map all Scope 1 and 2 emissions data to primary source documents (utility bills, fuel records, activity logs)
• Document calculation methodologies and emission factors used, with version control
• Establish a change log for any prior-period data revisions
• Begin Scope 3 data collection for FY2026 (reporting mandatory from 2027 under SB 253)
• Test year-over-year data comparability for both SB 253 and CSRD purposes
• Engage a verifier for voluntary limited assurance on 2026 data to identify infrastructure gaps

Audit Committee / Board

• Add sustainability assurance to the audit committee's formal oversight remit
• Request a briefing on the five CARB-proposed assurance standards and the ISAE 3410 sunset risk
• Confirm that SB 253 penalties ($500,000 per reporting year) are on the board's compliance risk register
• Review CSRD Omnibus I implications: confirm that reasonable assurance preparation has been deprioritized appropriately
• Monitor CARB's formal Notice of Proposed Rulemaking for 2027 assurance standards (not yet published as of August 2026)

Key takeaway: "The window for building assurance-ready data infrastructure is H2 2026, before mandatory deadlines activate and before qualified verifier capacity becomes constrained." Asuene, 2026

FAQ

Does SB 253 require assurance in 2026? No. CARB confirmed that no assurance is required for the inaugural 2026 filing cycle. Companies that demonstrate good faith effort and retain supporting emissions data will not face penalties. The assurance mandate activates in 2027, covering fiscal year 2026 data.

What is the current SB 253 filing deadline? November 10, 2026, for Scope 1 and Scope 2 emissions. CARB's July 27, 2026 proposed modifications deferred the original August 10, 2026 deadline. A public comment period on those modifications closed August 11, 2026.

Has CSRD's assurance requirement changed after Omnibus I? Yes, materially. The EU Omnibus I simplification package (adopted April 2025) permanently fixed CSRD assurance at limited assurance. The originally planned escalation to reasonable assurance has been removed from the directive. Companies that had been preparing for reasonable assurance under CSRD should reallocate that budget.

Which assurance standards are acceptable under SB 253? CARB has proposed five: ISSA 5000, ISAE 3000/3410 (until December 2026), AICPA AT-C 210/205, AA1000AS v3, and ISO 14064-3. The formal Notice of Proposed Rulemaking has not yet been published. For companies also subject to CSRD, ISSA 5000 is the most practical choice.

Does SB 253 assurance cover Scope 3? Not yet. Scope 3 reporting begins in 2027 (covering FY2026 data), but assurance requirements for Scope 3 remain under CARB consideration. Three phase-in approaches were presented at the March 2026 workshop; no final decision has been made.

What are the penalties for non-compliance with SB 253? Administrative penalties reaching $500,000 per reporting year for failure to file or materially incomplete submissions. SB 253 is fully enforceable; the injunction that paused SB 261 enforcement does not apply to SB 253.

Is SB 261 still enforceable? No, not currently. A California court granted an enforcement injunction against SB 261 on November 18, 2025. SB 253 was not affected by that ruling and remains fully enforceable.