Carbon Reporting

SEC Climate Disclosure Rules: Impact on Small Business Suppliers

January 9, 2026· 27 min read· by AI Sustainable Future Team

Most coverage of the SEC climate disclosure rules misses what matters for small and mid-sized suppliers. The SEC adopted the rules in March 2024, stayed them a month later, and on 29 May 2026 proposed rescinding them in full. They never took effect, and they never required Scope 3. Supplier requests have continued anyway, because they come from elsewhere: California's SB-253, the EU's CSRD, and large customers' own supplier programs. Your emissions sit inside your customers' Scope 3, usually in Category 1 (purchased goods and services), so their reporting turns into your questionnaire.

If you are a direct (Tier 1) supplier to a company like Walmart, Microsoft or Apple, or to any large company that runs its supplier requests through CDP, you may already have been asked for emissions data on the products or services you sell them. Through CDP alone, more than 200 requesting organizations asked more than 45,000 suppliers to disclose in 2025. This guide covers what the request looks like, what data you need, what it costs, and how to respond in a way that keeps the customer relationship and stands up to follow-up questions.

Two framing notes before we start. First, this guide is for companies with annual revenue of roughly $1M to $500M that supply large companies, directly or through another supplier. If you are an SEC registrant yourself, your legal and disclosure counsel will have more specific guidance; this piece is a primer on Scope 3 mechanics and is not legal advice. Second, the rules move. Statuses here are current as of October 2026; check sec.gov, ww2.arb.ca.gov and eur-lex.europa.eu for the specific rule you care about before making a filing decision.

The 2026 regulatory landscape for supplier carbon data

Four layers of pressure push Scope 3 requests onto suppliers. Know enough about each to recognize which one is driving a specific customer's request.

Layer 1: The SEC climate rule (stayed, rescission proposed)

The SEC adopted its climate disclosure rules on 6 March 2024. The final rules did not require Scope 3 at all. Scope 1 and 2 disclosure applied only to large accelerated and accelerated filers, only when those emissions were material, and was phased in together with an attestation requirement (SEC fact sheet). The rules never took effect. The SEC stayed them on 4 April 2024 pending litigation in the Eighth Circuit, voted on 27 March 2025 to end its defense, and on 12 September 2025 the court held the case in abeyance while the SEC reconsidered. On 29 May 2026 the SEC proposed rescinding the rules in their entirety. The rescission is a proposal and is not final.

What this means for suppliers: no SEC rule requires you, or your customers, to report Scope 3. The requests you receive come from the other three layers, and the SEC outcome has little bearing on them.

Layer 2: California SB-253 (first reports due 10 November 2026)

More concrete than the SEC rule. California SB-253, the Climate Corporate Data Accountability Act, applies to US-formed partnerships, corporations, LLCs and other business entities with more than $1 billion in annual revenue that do business in California, whether listed or privately held. CARB's regulation text takes the meaning of "doing business" from the California tax code (CARB regulation text). Per CARB's bulletin of 24 June 2026, the first Scope 1 and 2 reports are due 10 November 2026. Scope 3 reporting starts in 2027.

Two details matter for suppliers. The statute allows secondary data for Scope 3, including spend-based and industry-average factors, so a customer reporting under SB-253 can work with a documented spend-based figure from you. And the draft rules CARB previewed at its July 2026 workshop require limited assurance for Scope 1 and 2 only.

SB-261, the companion climate-risk law, covers companies with more than $500 million in revenue. Its first reports were due 1 January 2026, but the Ninth Circuit enjoined it on 18 November 2025.

Layer 3: EU CSRD (narrowed in 2026)

Directive (EU) 2026/470 narrowed the Corporate Sustainability Reporting Directive to companies with more than 1,000 employees and more than EUR 450 million in turnover, from financial year 2027. A non-EU group, such as a US parent, falls under separate CSRD rules for non-EU groups when it has more than EUR 450 million of net turnover in the EU and an EU subsidiary or branch above EUR 200 million. Most SMEs are outside CSRD, but the large companies inside it can still ask their suppliers for data.

The European Sustainability Reporting Standards (ESRS) adopted in July 2023 include gross Scope 1, 2 and 3 emissions in the climate standard, ESRS E1 (Delegated Regulation (EU) 2023/2772). The same standards let a reporting company estimate value-chain information with sector-average data and other proxies when it cannot collect that information after reasonable efforts.

Suppliers with 1,000 or fewer employees now have a ceiling on what they can be required to provide. Delegated Regulation (EU) 2026/1560, in force since 24 September 2026, sets a "value chain cap": the most that EU companies reporting under CSRD may require from those suppliers is a defined set of datapoints from the voluntary SME standard (VSME). The cap applies from financial year 2027, and Directive 2026/470 gives protected suppliers a right to decline requests that go beyond it. If a European customer asks you for data, the VSME standard is the reference point; our VSME Report fills the official EFRAG template.

Layer 4: Customer supplier programs

Many supplier requests come from a large customer's own commitments rather than from a specific rule. CDP is a major channel, as the 2025 request figures above show. Individual customer programs add their own asks:

Walmart Project Gigaton. Launched in 2017, it asks suppliers to set emissions reduction goals and report projects. In February 2024 Walmart said more than 5,900 suppliers had signed up and that their reported projects were expected to exceed its 1 billion metric ton goal, six years early (Walmart).
Microsoft. Its Supplier Code of Conduct (section 6.11) asks suppliers to disclose greenhouse gas emissions data "upon request", and its procurement program asks in-scope suppliers for third-party assurance or an external consultant's letter.
Apple. Its goal of 100% renewable electricity for Apple production by 2030 runs through its manufacturing suppliers.

Practical takeaway: even if every public disclosure rule were repealed tomorrow, CDP and customer programs would still be asking for your carbon data. Build the capacity to respond once. The same data package answers all four layers.

Will you be asked? A supplier decision tree

Not every SMB needs a carbon report. The question is whether any of your customers or counterparties will ask you for one, and the answer depends on who you sell to and where they are in their own disclosure cycle. Here is a four-question decision tree. If you answer yes to any one of them, expect a request, if one has not already arrived.

Do you supply a US company, listed or private, with more than $1 billion in revenue that does business in California? It is likely an SB-253 reporting entity, and its Scope 3 reporting starts in 2027.
Do you supply a company caught by CSRD: an EU company above 1,000 employees and EUR 450 million turnover, or a non-EU group with more than EUR 450 million of EU turnover and a large EU subsidiary or branch? If you have 1,000 or fewer employees, the value chain cap limits what an EU company can require from you for its CSRD report.
Have you received a CDP supply chain request, a Walmart Project Gigaton invitation, a Microsoft supplier request, or a questionnaire through a customer's supplier portal? If yes, the request is already here; the question is how you respond.
Is what you sell a large share of your customer's Scope 3? Physical products, logistics, travel services, data and cloud services, and manufacturing inputs are common examples. The GHG Protocol Scope 3 Standard tells reporting companies to prioritize data collection on the activities expected to have the most significant emissions (Scope 3 Standard, section 7.1), so suppliers in those categories are likely to be asked first.

What about smaller or private customers? Private companies can send these requests too, for example businesses owned by investors who track portfolio emissions, or companies that serve regulated customers. The request is often less formal than a CDP questionnaire, but the underlying data is the same. Treat it as a signal that the capacity to disclose is worth building.

What a disclosure request looks like, translating the asks

Requests come in three common formats. Each takes a different amount of time, asks for a different level of methodological detail, and carries different consequences if you get it wrong.

Format 1: CDP questionnaire (the most structured)

Your customer requests you through CDP's supply chain program, and you respond in CDP's online portal. CDP offers a shorter SME questionnaire with fewer, simplified datapoints. In CDP's 2024 overview, companies with fewer than 500 employees and under US$50 million in revenue were eligible and recommended to use it, while companies above 1,000 employees or US$250 million in revenue had to complete the full questionnaire (CDP SME questionnaire overview). The SME version has modules on risks and opportunities, governance, business strategy and climate performance, plus questions shown only to companies responding to a supply chain request. CDP scores responses. Of the three formats, this is the most work in year one; it gets faster in year two once the data collection is systematized.

Format 2: Customer-specific programs and portals

Some large customers collect supplier data through their own programs or portals, instead of or alongside CDP; Walmart's Project Gigaton and Microsoft's supplier requirements (above) are examples. The data overlaps with CDP (Scope 1, Scope 2 and the Scope 3 categories that matter to the customer), but the format, the portal and the follow-up questions vary. If you supply five large customers that each run their own portal, that is five re-formatting exercises a year, which is the argument for building the underlying data once and repurposing it everywhere.

Format 3: Email or Excel template (smaller customers, supplier-pressure chain)

An Excel spreadsheet from your customer's procurement team asking for tonnes CO₂e per unit of product or per dollar of revenue, sometimes with space for methodology notes. These are less standardized and often come from companies that are new to carbon accounting themselves. They take the least time if the underlying data exists. The risk: because the template is not standardized, your methodology notes (which factors, what boundary, what data source) matter more, and the customer may compare your response against another supplier's and flag inconsistencies.

The methodology question underneath every request: which data is good enough

Your customer decides what it needs from you, but the frameworks it reports under leave room for estimates. SB-253 allows secondary data, including spend-based and industry-average factors, for Scope 3. The 2023 ESRS let reporting companies use sector-average data and proxies when value-chain data cannot be collected. The GHG Protocol Scope 3 Standard asks companies to focus data collection on their most significant activities, and requires them to list excluded categories with a justification for each and to describe, for each category, the activity data, emission factors and global warming potential values they used (chapter 11 of the Scope 3 Standard).

The practical answer for an SMB supplier: use activity data (fuel volumes, kWh, travel segments) where you already have it. Use spend-based factors where activity data would require significant new collection and the category is not a large share of your footprint. Document the choice in a methodology note that travels with the response. An undocumented choice is itself a quality problem. Spend-based figures are approximate: our engineering estimate for spend-based screening is roughly plus or minus 25 to 40% at the category level (the GHG Protocol publishes no such figure).

In concrete terms for a typical SMB:

Scope 1 (direct): use fuel volumes when you have them, from fuel invoices, fleet cards or vehicle records, and refrigerant quantities from HVAC service records. If you only have fuel spend, convert it to litres or gallons with an official price series and say so in the methodology note; Carbon Draft does this and labels each row.
Scope 2 (purchased electricity): use kWh from utility bills. If you operate in markets with contractual instruments such as supplier-specific tariffs or renewable energy certificates, the GHG Protocol Scope 2 Guidance (2015) requires both a location-based and a market-based figure, known as dual reporting (Scope 2 Guidance).
Scope 3 Category 1 (Purchased Goods and Services): spend-based factors, such as the EPA Supply Chain GHG Emission Factors (v1.3, July 2024, in 2022 US dollars), are a recognized starting point: the spend-based method is set out in the GHG Protocol's 2013 Technical Guidance. For your top 10 suppliers, work toward supplier-specific data over the following years.
Scope 3 Category 6 (Business Travel): spend gives a screening figure. Flight segments, hotel nights and rental car days from your expense reports or travel booking export give a better one.
Scope 3 Category 7 (Employee Commuting): an employee survey extrapolated to the full workforce is the complete method. Spend on commuter benefits only captures the commuting the employer pays for, so treat a spend-based figure as a floor and say so in the report.
Other Scope 3 categories: screen for relevance, include the significant ones with the best available data, and exclude the others with a one-line justification per category.

A 90-day preparation timeline for your first disclosure

If you have just received a disclosure request and are starting from zero, here is a 90-day plan. It assumes one person internally spends about five hours a week on it, or that you bring in an outside specialist for parts of the work.

Days 1 to 14: Triage and commitment

Catalog every incoming disclosure request. CDP invitations, customer portal requests, Excel templates. Record the sender, the deadline, the scope requested (which scopes, which categories), and whether it is annual or one-time.
Pick one primary response. If you can respond to only one well, respond to the highest-revenue customer or the most rigorous framework. The output from that response will feed everything else.
Assign one internal owner. Usually the controller, CFO or operations manager. This person coordinates data pulls across accounting, HR, facilities and procurement.
Decide: internal, outsourced or hybrid. If your team has no prior exposure, hybrid (software plus outside review) is often the quickest route. Doing it fully in-house works if someone on staff is comfortable with financial data and spreadsheets.

Days 15 to 45: Data collection

Pull the accounting data: a year of accounts payable, the general ledger, utility invoices (with kWh, not just dollars), fleet fuel records and business travel records. This is the core of the inventory.
Run the employee commuting survey. A short form sent to all employees; Google Forms is free and sufficient. Record the response rate and how you extrapolated to the full workforce.
Request the refrigerant records from your HVAC vendor: the type and quantity of refrigerant added during servicing. Leaked refrigerant counts in Scope 1, and common gases carry high global warming potentials (R-410A is 1,924 under the IPCC AR5 100-year values).
Identify the 10 largest vendors by spend. These dominate your Scope 3 Category 1 and are the priority for supplier-specific data in year two.

Days 46 to 75: Calculation and draft

Apply emission factors. Scope 1 from the EPA GHG Emission Factors Hub (latest release). Scope 2 from eGRID subregion factors (eGRID2023) for your meter locations. Scope 3 from the EPA Supply Chain GHG Emission Factors, mapped to each vendor's spend category in your AP file.
Build the methodology appendix. Per category: data source, factor source and vintage, boundary decisions, and exclusions with their justification. This is what a reviewer will check.
Draft the disclosure response in whatever format the customer requested. If you are responding to several customers, fill out the most rigorous one (usually CDP) first, then port the answers.

Days 76 to 90: Review and submit

Internal review. Check five points before you send: Scope 2 dual reporting where it applies, a documented base year, the data source for each Scope 3 category, the justification for each excluded category, and emission factor vintage.
Send to the customer or submit to the portal. Keep the underlying workbook and methodology appendix on file; when the customer asks follow-up questions, you will refer to it.
Plan the year two refresh now. Mark your calendar about nine months out to begin the next cycle's data pull. Year two usually takes less time once the data pull and the vendor mapping are set up.

Five mistakes SMB suppliers make on their first disclosure

Responding without reading the customer's own guidance. Each program sets its own boundaries, units, categories and deadlines. Spend 30 minutes reading the specific guide before calculating, so the numbers you submit are traceable to the rules that customer uses.
Inflating Scope 3 with pessimistic assumptions to look thorough. A common trap is using the worst-case emission factor for every category to show conservatism. A customer comparing suppliers may then flag your number as an outlier, and you spend follow-up cycles defending figures that were never accurate.
The opposite: underreporting by excluding categories without a documented justification. If you submit Scope 3 covering only Category 1, with no screening table explaining why the other categories are excluded, the reviewer will either request more data or estimate it themselves. Neither outcome helps you.
Reporting parent-company emissions when the customer asked about the selling entity. If your company has several operating subsidiaries but sells only one product line to the customer, the boundary should match what you sell them. Confirm the boundary with the customer before calculating.
Providing numbers without methodology notes. A Scope 3 Category 1 figure of, say, 728 tCO₂e is useless to a reviewer without knowing which emission factors you used, what AP data period it covers, and how vendors were classified. Attach a methodology appendix to every response. If the portal does not accept attachments, put the notes in the free-text fields.

What this costs to stand up

Cost varies by path. Three realistic scenarios for a first-time SMB disclosure:

Path 1: Fully DIY with a software platform

Software cost: $20 to $299 per report with Carbon Draft ($20 for Scope 1 and 2, $49 with Scope 3, $299 with the full transaction ledger, an Excel workbook and a framework section), or $0 if you build the calculation in Excel. Internal time: most of the 90-day plan above, typically shared between the controller and the CFO. Best for: companies with a finance team comfortable with data work and no complex Scope 3 exposure.

Path 2: Outsourced to a sustainability consultancy or CPA firm

External cost: fees vary widely with scope, data quality and how many Scope 3 categories are included. Ask for a fixed quote that lists the categories covered, the factor sources, and the deliverables. Your internal time does not disappear: someone still pulls the data and answers questions. Best for: companies preparing for third-party assurance, with complex supply chains, or without internal capacity.

Path 3: Hybrid, software for the draft, professional review for sign-off

Software for the first draft (Carbon Draft, $20 to $299), then a CPA or consultant reviews the method and the figures before you send. This focuses paid professional time on review. A Carbon Draft report is a screening-grade inventory a reviewer or assurance provider can start from; it is not assured.

If you want to look at the accounting-firm side of this, and how the work breaks down for a CPA, see our CPA's Guide to GHG Protocol Scope 1, 2 & 3.

Why supplier requests continue without the SEC rule

A reasonable question: if the SEC rule never took effect and may be rescinded, why worry? Four reasons, in declining order of concreteness.

Customer programs run on their own timelines. CDP's supply chain requests, Walmart's Project Gigaton, Microsoft's supplier requirements and Apple's 2030 renewable electricity goal for its production do not depend on the SEC rule.
California fills part of the federal gap. SB-253's first Scope 1 and 2 reports are due 10 November 2026, and Scope 3 follows from 2027. If your customer is a reporting entity, its supplier data request is part of meeting a legal deadline.
CSRD still reaches some US supply chains. It now covers fewer companies, but a large EU company, or a US group with large EU operations, can still ask you for data. For EU reporters, the value chain cap limits what they can require from suppliers with 1,000 or fewer employees.
Investors, lenders and buyers ask too. Some investors, lenders and insurers ask the companies they finance or insure for climate information, and buyers and investors may include climate questions in due diligence. If your business is preparing for a sale or a capital raise, a documented emissions history is one less open question.

The practical frame: treat the SEC rule as background. Build the disclosure capacity around what you can count on (CDP, SB-253, CSRD and customer programs), and the SEC outcome stops mattering to your preparation.

Where to start, in one sentence

If you are not sure where to start, ask your existing CPA: they already hold most of the financial data needed to build your first carbon report, and the workflow for them is documented in our CPA's Guide to GHG Protocol.

Or respond to your first disclosure with Carbon Draft

If you have just received a CDP invitation, a customer portal request or an Excel template, Carbon Draft builds the underlying Scope 1, 2 and 3 calculation from one accounting or bank export: CSV or Excel from QuickBooks, Xero, NetSuite, Sage, SAP or Tally, or a DATEV, SIE or XAF file. Optional fields add annual kWh, renewable kWh, a supplier electricity factor, fuel volumes, gas and refrigerant. It runs in minutes, with no queue, and every factor is cited to its source document and table (methodology).

Pricing (details):

Basic, $20: Scope 1 and 2.
Complete, $49: adds Scope 3, up to 8 of the 15 categories: 1, 2, 4, 5, 6 and 7 where your ledger shows that spend, 3 derived from electricity, and 12 when you enter end-of-life tonnages.
Disclosure-Aligned Report, $299: the same Scope 3 coverage, plus the full priced ledger (every transaction with its factor), per-row confidence, an Excel calculation workbook, and a framework section for the GHG Protocol, CDP, CSRD (ESRS E1) and California SB-253 that sets out what each requires, what the report contains, and the gap.

Every tier gives you a cited PDF report you can quote from when you fill in CDP, a customer portal or an Excel template. Each report is a screening-grade inventory, and its cover says "SCREENING / INVENTORY / NOT ASSURED".

A note on units: all figures are in tonnes CO₂e (carbon dioxide equivalent), which puts carbon dioxide, methane, nitrous oxide and fluorinated gases such as refrigerants on one comparable scale using their global warming potentials. Carbon Draft uses the IPCC AR5 100-year values for refrigerants. Methane matters in particular if your supply chain touches agriculture, waste or natural gas.

Upload your accounting export at aisustainablefuture.com/carbon-draft and get a cited, screening-grade carbon report in minutes. Scope 1 and 2 from $20, Scope 3 from $49.

If you are a CPA firm whose clients are receiving these requests, see the partner program for accounting firms.