Earlier this month, the California Office of Administrative Law approved CARB’s initial regulations implementing the greenhouse gas emissions reporting and climate-related financial risk disclosure laws. As Zach recently noted on the PracticalESG blog, companies will now have until November 10, 2026 to submit reports covering their Scope 1 and 2 emissions. The blog includes this passage from a Morgan Lewis memo:
The California Office of Administrative Law approved the California Air Resources Board’s initial regulations implementing the state’s corporate greenhouse gas emissions reporting and climate-related financial risk disclosure laws on October 12, making the regulations immediately effective. The approval completes the administrative review process and formally establishes November 10, 2026 as the first-year reporting deadline under Senate Bill 253. Covered companies are subject to the initial Scope 1 and Scope 2 emissions reporting requirements by that date, consistent with CARB’s first-year reporting guidance.
Zach also notes:
California regulators have indicated that first-year reporting will be lightly scrutinized. The California Air Resources Board (CARB) is looking for companies to make good-faith efforts to comply. Alternatively, 2027 may be a different story. CARB has indicated that new reporting rules are coming. 2027’s rules are expected to introduce more stringent requirements, which will bolster reporting quality and increase compliance complexity.
SB 253’s companion law, SB 261, will require climate-related financial disclosures in addition to GHG metrics. SB 261 is currently enjoined by the Ninth Circuit Court of Appeals. The Court’s Opinion is still pending after oral arguments were heard over ten months ago. SB 261 reporting was originally slated to begin alongside SB 253, meaning that 2027 could see SB 261’s requirements reintroduced depending on litigation timelines and outcomes.
At the federal level, the SEC has not yet taken any action on its proposed rescission of the agency’s climate disclosure rules. Earlier this month, certain members of the House Financial Services Committee submitted a letter to the Commission expressing strong opposition to the SEC’s proposal.
With eight “blockbuster” rulemaking proposals issued since May that will modernize and overhaul public company compliance obligations, a number of non-proposal requests for comment that preview potential proposals to come, new or revised CFIs too numerous to count that tackle much more than cleanup, novel no-action letters and the lack thereof, the SEC is certainly keeping us on our toes. I think it’s safe to say that we’ll see some of these major proposals advanced to final rules and some new proposals, including executive compensation disclosure reform (still on OIRA’s dashboard), approved in 2027, if not in the last few months of 2026. Public companies are also navigating new risks and opportunities from extended trading hours, tokenization, prediction markets, increasingly divergent investor views, the use of AI/SI by investors and public companies themselves and a macroeconomic environment that presents new challenges every quarter.
If we’re a part of how you keep up with the breakneck pace of regulatory and market developments, thank you! We consider it our responsibility to inform you of developments and share wisdom from the top practitioners in our field to help you think through the practical implications of all these developments on you and your clients. (And we try to have some fun while doing it!) We hope our blogs are part of your daily routine and that our handbooks, checklists, podcasts, webcasts and Q&A forums are so useful that they’re also a regular part of your workday.
If you’re a member of TheCorporateCounsel.net and your membership runs on the calendar year, you may need to take action soon to keep the insights coming. You or someone else at your company or firm should have recently received a renewal notice by email. If that’s not you, you may still want to make sure your knowledge management team (or whoever else is responsible for renewing) knows what resources you can’t live without.
If you need help renewing, reach out to us at 1-800-737-1271 or Info@CCRcorp.com. We appreciate your business! Thank You!
In the month since I last wrote about prediction markets, the CFTC has proposed to further define the term “swap” to include event contracts, including those based on sports, politics, cultural, and weather-related events. The CFTC’s announcement of the proposal notes that “these contracts are financial instruments that are commonly known to the trade as swaps and proposes to resolve any ambiguity regarding these contracts.” At the same time, the CFTC issued an interim final rule codifying the agency’s longstanding position that gambling products (e.g., bingo games, lotteries and sportsbook and casino gambling), are excluded from the definition of “swap.” As the Mayer Brown Free writings + Perspectives blog notes:
Taken together, the Interim Final Rule and the [Notice of Proposed Rulemaking] represent a coordinated effort to distinguish state-regulated gambling from federally regulated event contracts and to remove the argument that treating event contracts as swaps would federalize every sportsbook wager. The releases are the latest in a series of CFTC actions affecting the prediction markets, including the June 2026 proposed rulemaking discussed in our prior post.
The CFTC itself is under scrutiny for its workforce reductions, with NPR recently reporting that the agency’s staffing is down 21% by the end of 2025. The article notes that the Government Accountability Office is currently investigating the staffing reduction at the CFTC, after Senator Elizabeth Warren called for an investigation into the agency’s staffing and reduction in enforcement actions back in July.
If you found yourself in a pumpkin patch during this past weekend, I hope that you spent a few minutes reflecting on the fact that Cybersecurity Awareness Month is quickly slipping away. For all who celebrate, Cybersecurity Awareness Month is “a global initiative every October that raises awareness about online safety and empowers individuals and businesses to protect themselves from cybercrime.” According to the National Cybersecurity Alliance (NCA) and Cybersecurity and Infrastructure Security Agency (CISA), this year’s theme for Cybersecurity Awareness Month is “Don’t Make it Easy for Them.” The NCA notes:
Staying safe online isn’t about making one perfect decision. It’s about building habits and repeating them consistently in the small moments that happen every day. In doing this, we can all make life difficult for cybercriminals.
Small actions make a big difference. We recommend starting with four easy steps anyone can take to boost their online safety:
• Use strong passwords and a password manager
• Turn on multifactor authentication
• Recognize and report scams
• Update your software
According CrowdStrike’s 2026 Global Threat Report, cybersecurity awareness is more important than ever as we enter the “the age of the AI adversary.” CrowdStrike notes:
The world is operating in the agentic era. Artificial intelligence is embedded across the modern enterprise. Agents write code, analyze data, orchestrate workflows, and make decisions at machine speed. Every layer of the enterprise is becoming faster and more automated. The adversary is operating in the agentic era as well.
In 2025, AI-enabled adversaries increased attacks by 89% year-over-year. AI accelerated phishing and automated reconnaissance, shortening the time from initial access to impact. It elevated less sophisticated threat actors and amplified the most advanced ones. It compressed the time between intent and execution.
AI has also introduced a new dimension of risk: adversaries targeting the very AI systems underpinning the modern enterprise. As AI is embedded into development pipelines, SaaS platforms, and operational workflows, AI systems themselves become part of the attack surface. Adversaries exploited legitimate AI tools by injecting malicious prompts that generated unauthorized commands. As innovation accelerates, exploitation follows. Security must parallel the slope of innovation. In the agentic era, cybersecurity is the foundational infrastructure required to protect AI itself.
Come to think of it, after reading CrowdStrike’s 2026 Global Threat Report, I might just head back to the pumpkin patch and hide out there for a while!
Despite the thoughtful guidance from NCA and CISA for Cybersecurity Awareness Month, all of the password changes and multifactor authentications in the world are not going to help when the agentic AI hackers are attacking the backbone of the internet. Last week, the creators of PHP – which is a programming language used by up to 70% of the internet – released security patches for what this WSJ article describes as “one of the most severe online bugs ever.”
Companies, governments and other organizations have been in a race to patch their websites since the vulnerabilities have been announced, given the threat that AI agents can move with lighting speed and precision in targeting known (and unknown) vulnerabilities. As the WSJ article notes, some website operators (including national governments) simply shut down their websites last week, rather than run the risk of being hacked.
In the “you can’t make this stuff up” category, this Techzine article notes that the PHP Foundation which provides critical infrastructure for approximately 70% of all websites is run entirely on donations and has only one full-time employee! The organization’s struggle to raise funds and lack of staffing underscores how fragile our electronic underpinnings can be, making it a target-rich environment for AI and human hackers.
Hunkering down in that pumpkin patch is not looking so bad now!
Yesterday, ISS announced that the comment period on proposed changes to its benchmark voting policies is now open and will run through 5 p.m. ET on November 4, 2026. ISS is seeking input from investors, companies, and other market participants on its proposed voting policy changes for the 2027 proxy season.
Here is a summary of the changes applicable to the U.S. market and all markets globally from the summary section of the request for comments:
Bylaw Amendments – Management Proposals to Ratify Existing Charter or Bylaw Provisions: Clarifies the policy for situations where a management proposal seeking ratification of an existing governance practice or provision addresses the same topic as a shareholder proposal and is used to exclude a shareholder proposal from the meeting ballot.
Executive Compensation – Option Valuation Model: Removes references to ISS’ binomial option pricing model, replacing it with Black-Scholes as the methodology to be used for ISS’ valuation of options to calculate Shareholder Value Transfer (SVT) from 2027.
Climate Board Accountability: A global update to the Climate Board Accountability policy for ISS benchmark policies worldwide, codifying a fully case-by-case approach to this topic for all markets.
Risk Oversight – Cybersecurity and AI: All ISS benchmark policies on director elections globally contain a provision where, under extraordinary circumstances, material failures of risk oversight may be addressed as governance failures or egregious actions through recommendations on director elections. This global change adds cybersecurity and artificial intelligence-related risks to the named examples of possible factors in assessing material failures of risk oversight.
The request for comments then includes marked copies of the policies showing the exact changes proposed plus a more detailed rationale for each change.
The changes applicable to the U.S. market seem pretty light compared to some prior years, and notably, quite a few topics addressed in ISS’s recent survey are not reflected in the proposed policy changes. That’s not particularly surprising for some survey questions that asked a “what if,” assuming pending SEC proposals are finalized as proposed.
ISS expects to release its 2027 benchmark voting policies, which will be effective for shareholder meetings occurring on or after February 1, 2027, in late November or early December.
While I’m very happy to be home from our “2026 Proxy Disclosure & 23rd Annual Executive Compensation Conferences,” coming back to a freeze warning, a pile of backed-up work and an extremely busy week of kid activities has part of me wishing I was still in Orlando soaking up the sun and all the wisdom our incredible speakers shared last week. I want to reiterate John’s thanks to our valued sponsors, inimitable speakers, and everyone at CCRcorp who made our conferences possible, as well as our attendees who joined us in person and virtually! I may be biased, but I think this year’s content was particularly valuable. (There was no shortage of things to talk about!) And whether we’re a stone’s throw from Disney World or not, seeing so many members of this community in one room is always fun and magical! I mean, look at these pictures! Some highlights for me this year, unrelated to the substance, are:
– Our “Scary Stories” panelists really leaning into the theme
– Super fun thematic backgrounds, like the private jet in the perks panel and the hearth making the “Fireside Chats” feel cozy
– Learning “Somewhere Over the Rainbow,” which I used to sing to my kids at bedtime, in sign language from NASPP’s keynote speaker, Mandy Harvey
Needless to say, I’m already looking forward to next year’s conferences and pleased that we get to enjoy some warm weather again. Here are some Jeopardy-style little-known facts about next year’s host city. Can you guess where we’re going? Find out in the next blog!
– This city is known as the birthplace of jazz.
– This city is home to the world’s oldest continuously operating streetcar.
– This city is famous for a season of celebration that begins in early January.
– This city used to have more miles of canals than Venice.
A quick logistical note: If you registered for the Conferences, archived videos and transcripts are coming soon! (Look out for an email.) And please share your feedback in this experience survey. We also welcome you to send suggestions to our editorial team directly at any time. Our contact information is always at the bottom of our daily blog emails and on the “About Us” page on TheCorporateCounsel.net.
If you were playing the little-known facts Jeopardy in my prior blog and thought, “What is New Orleans?” you’re exactly right! Get ready to visit the French Quarter, listen to some jazz and enjoy some po’ boys and beignets!
We’ll be gathering in New Orleans for our 2027 Proxy Disclosure & 24th Annual Executive Compensation Conferences on September 21 & 22 (Tuesday & Wednesday). Which means I don’t have to wait a whole year for the annual event I look forward to most, and – with the conferences happening before the end of Q3 – I suspect many of our members will have a much easier time traveling. Win-win! More info forthcoming!
When Glass Lewis announced an open comment period on the four perspectives that will underpin its research beginning in September 2027, it noted that it will continue to offer its Benchmark Voting Policy Guidelines for the 2027 Proxy Season, to be announced in October, with minimal expected changes (limited to significant regulatory and corporate governance developments). Those Benchmark Voting Policy Guidelines — which will apply to shareholder meetings held from January 1 through August 31, 2027 — were quietly released (I believe) late last week.
When you open the guidelines, you’ll immediately notice that they contain no “Summary of Changes.” That’s because there were no changes to the U.S. guidelines from 2026. The preface to the guidelines explains:
Glass Lewis’ single house policy has traditionally anchored the regional benchmark guidelines. Given Glass Lewis’ announced intention to move away from this single house policy, towards multiple perspectives representing varied viewpoints of its clients, policy development has entered a period of transition. As such, the Glass Lewis 2026 Benchmark Policy Guidelines will remain static for 2027.
Glass Lewis, however, remains committed to keeping policies current during this transition phase by ensuring that any relevant changes to regulation or corporate governance practices are reflected in the Benchmark Policy guidelines. A review of market-level regulatory and best practice changes over the preceding year concluded that these guidelines do not require revision for 2027
I went to the shareholder proposals section to remind myself how Glass Lewis approached the shifting shareholder-proposal environment last year. The document still provides that:
[T]he Benchmark Policy will generally approach these matters with the basic premise that shareholders should be afforded the opportunity to vote on matters of material importance. To be sure, the Benchmark Policy respects the limitations placed on shareholder proponents, as certain shareholder proposals can unduly burden companies or cross the line between the purview of shareholders and that of the board. It also recognizes that not all shareholder proposals serve the long-term interests of shareholders. Nonetheless, the Benchmark Policy views the basic right of shareholders to file proposals as critical to the proper functioning of our system of corporate governance and in the best economic interest of all shareholders.
A number of important corporate governance reforms, such as declassified boards and majority voting, would not have been achieved without shareholders’ willingness and ability to submit proposals, for which they bear the costs and only realize a portion of the benefits. Empirical evidence has shown that even withdrawn shareholder proposals, such as those on executive compensation, can encourage beneficial corporate practices, thereby benefiting all shareholders.
Like last year, it also notes that it will closely monitor regulatory changes and their ramifications and that the benchmark guidelines may be updated prior to or during the proxy season should regulatory changes warrant.
We’ll be posting related resources in our “Proxy Advisors” Practice Area. We’ve also already created the “2027 Resources” subsection of our “Proxy Season” Practice Area, which is always a treasure trove of helpful resources by the time proxy season is in full swing.
Yesterday, Corp Fin posted new, revised and withdrawn CFIs. Some of the updates are cleanup, and others provide clarification – particularly regarding when an Item 2.01 (Completion of Acquisition or Disposition of Assets) 8-K must be filed. Here are links to the CFIs (or redlines, where revised), along with a brief description of what’s new:
Securities Act Forms, Section 115 Form S-3. General Instructions 1.A.1 to I.A.8 – Registrant Requirements, Revised Question 115.02 & Regulation S-K, Section 115. Items 308 and 308T – Internal Control over Financial Reporting, Revised Question 115.02
Both CFI updates clarify the consequences of failing to provide management’s report on ICFR pursuant to Item 308(a) of Regulation S-K and the consequences of being current but untimely after the Form 10-K is amended to provide management’s report — specifically to include the implications for incorporating by reference on Form S-1 or S-11 and to remove references to transitional Item 308T.
Exchange Act Form 8-K, Section 105. Item 2.01 Completion of Acquisition or Disposition of Assets, New Question 105.01
Explains that registrants need only apply the applicable paragraph in Instruction 4 to Item 2.01 of Form 8-K when determining whether an acquisition or disposition is deemed to involve a significant amount of assets. Specifically, (1) a business development company that did not acquire or dispose of a business as determined under Rule 11-01(d) of Regulation S-X would only apply paragraph (iii) of Instruction 4, (2) a registrant that acquired or disposed of a business as determined under Rule 11-01(d) of Regulation S-X would apply only paragraph (ii), and (3) a registrant that is not a business development company and did not acquire or dispose of a business as determined under Rule 11-01(d) of Regulation S-X would apply only paragraph (i).
Exchange Act Forms 8-K, Section 105. Item 2.01 Completion of Acquisition or Disposition of Assets, New Question 105.02
Clarifies that Instruction 4 does not require registrants to include probable acquisitions of related businesses, real estate operations, and funds with the related businesses, real estate operations, and funds that have already been acquired when assessing aggregate significance for purposes of Item 2.01 reporting because Item 2.01 of Form 8-K only requires disclosure regarding completed acquisitions.
Exchange Act Forms 8-K, Section 105. Item 2.01 Completion of Acquisition or Disposition of Assets, New Question 105.03
Provides that registrants should use their most recent balance sheet required to be filed at or prior to the date of the acquisition or disposition, which may be an interim balance sheet, to derive “the total assets of the registrant and its consolidated subsidiaries” required for the significance test outlined in paragraph (i) of Instruction 4 to Item 2.01 of Form 8-K.
Exchange Act Forms 8-K, Section 110. Item 2.06 Material Impairments, Withdrawn Question 110.02 reflects a housekeeping update, withdrawing a now-irrelevant CFI.
