ESG Reporting for Small and Medium Businesses: A 2026 Guide

ESG reporting for small and medium businesses is, in 2026, mostly voluntary in the United States. No federal rule requires a private SMB to publish emissions or ESG data, and the California and EU regimes are aimed at companies with revenue in the hundreds of millions or more. The practical pressure comes from customers, lenders and investors who are themselves covered and who send questionnaires down their supply chains.

This guide explains where each rule stood as of October 2026, which framework fits a company with 20 to 500 employees, and how to build ESG reporting for small and medium businesses on top of the books you already keep. It includes a worked Scope 1 and Scope 2 emissions calculation using EPA emission factors, so you can see what a first inventory looks like in numbers.

Where the Rules Stand in October 2026

The table below summarizes each regime and what it means for a smaller business.

The SEC climate rule

The SEC adopted its climate disclosure rule in March 2024 and stayed it pending litigation in the Eighth Circuit. On March 27, 2025, the SEC voted to end its defense of the climate disclosure rules. The rule never applied to private companies, so for most SMBs the federal picture is simple: there is no SEC requirement to report emissions.

California SB 253 and SB 261

California's two laws are the closest thing to a U.S. mandate. According to the California Air Resources Board program page, SB 253 applies to entities with total annual revenues in excess of $1 billion that do business in California, and, as of October 2026, CARB is updating its regulatory proposal to move the first Scope 1 and 2 deadline from August 10, 2026 to November 10, 2026. CARB's September 2026 reporting guidance uses that deadline and says CARB will accept first-year submissions whether or not limited assurance has been obtained. Entities that were not collecting emissions data in December 2024 are not expected to submit Scope 1 and 2 data for this first cycle. CARB says Scope 3 reporting begins in 2027, and its second rulemaking for 2027 onward is still in progress.

SB 261 requires biennial climate-related financial risk reports. On November 18, 2025 the Ninth Circuit enjoined its enforcement while an appeal is pending, and CARB's enforcement advisory states it will not enforce the January 1, 2026 deadline and will set an alternate date after the appeal is resolved. As of October 2026, CARB's program page lists no newer SB 261 notice or reporting date. Check CARB's page before any planning decision.

A $40 million supplier is far below both thresholds. The effect on you is indirect: a covered customer building its own inventory will ask for your electricity and fuel use, and its Scope 3 work from 2027 onward will widen those requests.

EU CSRD after the Omnibus simplification

The EU narrowed the Corporate Sustainability Reporting Directive through the Omnibus I Directive, Directive (EU) 2026/470 of February 24, 2026. The Commission's July 2026 delegated act on the voluntary standard explains that mandatory reporting now applies to undertakings exceeding EUR 450 million in net turnover and an average of 1,000 employees. U.S. groups with EU subsidiaries should read our CSRD compliance guide for U.S. companies with EU operations for the parent-level analysis.

The more relevant change for smaller firms is the value chain cap. It covers any company with up to 1,000 employees: a CSRD reporter cannot require it to provide more than the disclosures listed in the voluntary standard, and the company has a statutory right to refuse requests that go further. That standard is based on EFRAG's VSME (Voluntary Sustainability Reporting Standard for SMEs) and keeps its basic module and comprehensive module structure. Companies with 10 employees or fewer get a lower cap, because certain environmental disclosures are voluntary for them. The Commission adopted the delegated act on July 3, 2026, and it applies after the Parliament and Council scrutiny period ends.

ISSB and IFRS S1 and S2

The International Sustainability Standards Board publishes IFRS S1 (general sustainability disclosures) and IFRS S2 (climate). IFRS S2 is effective for annual reporting periods beginning on or after January 1, 2024, and the ISSB issued amendments to its greenhouse gas disclosure requirements in December 2025. No U.S. regulator requires them, although the IFRS Foundation encourages companies to apply the ISSB Standards voluntarily. For an SMB, S2 is a useful checklist of what a sophisticated investor will expect, even if a full S2 report is out of proportion.

Why ESG Reporting for Small and Medium Businesses Still Pays Off

Supplier questionnaires are the main reason to start. A short, consistent data set lets you answer each request from one file instead of rebuilding numbers for every customer.

Lenders are a second reason. A credit review may include questions about energy costs, physical climate risk to facilities, or safety records. Keeping that information with your business loan preparation documents shortens the back and forth.

The third reason is internal. Tracking energy use per unit of output often surfaces waste that also shows up as cost. If you plan efficiency upgrades, check which energy tax credits for small businesses and investment tax credits under Sections 48 and 48E still apply after the 2025 legislative changes.

Choose a Framework Sized for Your Business

You do not need to adopt every standard. A sensible order for most U.S. SMBs:

1. Use the VSME basic module as your content list. It was built for small companies, and EU customers reporting under the CSRD can only ask suppliers with up to 1,000 employees for disclosures inside the voluntary standard.
2. Calculate emissions with recognized EPA factors, so your Scope 1 and 2 numbers match the method most U.S. customers use.
3. Borrow the IFRS S2 headings (governance, strategy, risk management, metrics and targets) for the narrative if investors or international lenders are reading.

Keep the same framework for at least two or three years so trends stay comparable. If you change method, disclose what changed and restate the prior year if the effect is significant.

Decide What Is Material

Materiality is your filter. List the ESG topics that could change your revenue, cost or risk in a meaningful way, and the topics your customers and staff raise most often. Rank each as high, medium or low, report the high items in year one and keep the medium items on next year's list.

A food distributor will rank fuel, refrigeration and food safety high. A professional services firm will rank data security, training and travel high. The approach mirrors how auditors think about materiality and risk: concentrate effort on items large enough to change a reader's decision.

Build a Data Model Your Finance Team Can Maintain

Most ESG data already passes through accounting. Utility bills sit in accounts payable, fuel cards in expense reports, headcount in payroll. Build one register that lists, for each metric, the name, unit, source system, owner, frequency and the check performed.

Pull the data on the same schedule as your month-end close and store dated exports with each period. Treat the ESG register like any other part of your management reporting package, with a preparer and a reviewer. If you already track essential small business KPIs, add energy intensity and safety incidents to the same dashboard. Simple data analytics in accounting, such as variance checks against prior periods, catches most errors before a customer does.

Environmental Metrics: Start With Scope 1 and Scope 2

Scope 1 covers direct emissions from fuel you burn, such as natural gas for heating and diesel in owned trucks. Scope 2 covers purchased electricity. Scope 3 covers your value chain and is where most companies get stuck, so leave it for year two unless a customer insists.

You need activity data and an emission factor. Activity data comes from bills: kilowatt hours, therms and gallons. Emission factors come from the EPA GHG Emission Factors Hub, which lists 53.06 kg of CO2 per MMBtu of natural gas, 10.21 kg of CO2 per gallon of diesel, and a U.S. average electricity factor of 771.5 lb of CO2 per MWh from eGRID2023. Regional grid factors differ widely, so use your eGRID subregion once you have the basics working. One therm equals 100,000 Btu, so 10 therms make 1 MMBtu.

Track water and waste from meter readings and hauler invoices where they are material. If your first-year data is incomplete, say so and describe how you will close the gap.

Worked Example: A First Emissions Inventory (Illustrative)

Consider an illustrative distributor with 60 employees, $12 million in revenue, one warehouse and a small delivery fleet. Its annual activity data:

The arithmetic:

• Electricity: 600 x 771.5 = 462,900 lb, divided by 2,204.62 lb per metric ton = 210.0 tons.
• Natural gas: 2,500 x 53.06 = 132,650 kg = 132.7 tons.
• Diesel: 18,000 x 10.21 = 183,780 kg = 183.8 tons.
• Total: about 526.4 tons (rows rounded), of which Scope 1 is 316.4 tons and Scope 2 is 210.0 tons.
• Intensity: 526.4 / 12 = 43.9 tons per $1 million of revenue.

If an LED and controls project cuts electricity use by 10 percent, Scope 2 falls by 21.0 tons to 189.0 tons. That is the kind of target a customer can verify against your utility bills. This example uses CO2 factors only; adding methane and nitrous oxide changes the totals slightly, and your report should state which gases are included.

Social and Governance Metrics

For a first report, keep social metrics to what payroll and HR systems already hold: headcount, voluntary turnover, training hours, recordable safety incidents and your approach to pay and benefits. Define every category you use and avoid publishing data that could identify individuals.

Governance disclosures describe who oversees risk, how staff raise concerns, how you vet vendors and how you protect customer data. If customers ask about security, point them to the assurance reports you already hold; our guide to SOC 1 vs SOC 2 audits explains which report answers which question.

Controls, Evidence and Assurance

Customers increasingly ask how ESG numbers were checked. Apply the same discipline you use for financial data: documented sources, reconciliations to invoices, review by someone other than the preparer, and a dated evidence folder. The approach in internal controls testing for small businesses transfers directly to energy and fuel data.

Before you publish, have a manager who did not prepare the data trace a sample of figures back to bills. If a major customer requires outside assurance, start with limited assurance over Scope 1 and 2. California's statute requires limited assurance for covered reporters beginning in 2026, and CARB's first-year flexibility applies only to the 2026 cycle.

A 12-Month Plan

Manufacturers with several plants may want to align this calendar with outsourced financial reporting for manufacturing so cost and energy data close together. A shared business intelligence dashboard makes quarterly progress visible to leadership.

Common Mistakes

Tracking too many metrics drains time and confuses readers. Report the handful that drive cost or customer trust, and add more once the process is stable.

Changing units or factors from year to year breaks trends. Lock methods for a period, and when you change, disclose the change and its effect.

Publishing targets without owners or budgets leaves them unfunded. Tie each target to a funded project with a named owner and a completion date.

Claims without files cannot survive a customer audit. Keep invoices, meter readings and calculation workbooks in one dated folder tree.

Frequently Asked Questions

Is ESG reporting mandatory for small and medium businesses in the U.S.? No federal or California rule requires a typical private SMB to report. SB 253 applies above $1 billion in revenue, the SEC rule covers registrants only, and the SEC stopped defending it in 2025. Requests from customers and lenders are what usually create the obligation in practice.

What should a small business report first? Start with Scope 1 and Scope 2 emissions from utility and fuel records, a few people metrics from payroll, and a short governance description.

What is the VSME and can a U.S. company use it? The VSME is EFRAG's voluntary sustainability reporting standard for SMEs, with a basic and a comprehensive module. Any company can use it. Under the Omnibus I changes, the EU voluntary standard based on it caps what CSRD reporters can demand from suppliers with up to 1,000 employees.

Do California's climate laws affect suppliers below the thresholds? Indirectly. Covered companies report their own emissions in 2026, and CARB says Scope 3 reporting begins in 2027, so large California customers are likely to ask suppliers for activity data.

Does an ESG report need outside assurance? For a voluntary SMB report, no. Some customers ask for it, and limited assurance over Scope 1 and 2 is the usual starting point.

Next Step

Madras Accountancy supports growing businesses with bookkeeping, month-end close, CFO and advisory work, and audit support, which gives your ESG data a reliable financial base. To discuss how your utility, fuel and payroll records can feed a first ESG report, contact our team.