Attorneys Discuss 2023 Expected Regulations in Corporate Counsel

A host of new laws, regulations and reporting requirements are taking effect in 2023 that will keep tech companies on their toes.

Last March, the Securities and Exchange Commission proposed a rule requiring publicly traded companies to disclose climate change risks. Partner and global head of the ESG, CSR and business and human rights practice Michael Littenberg told Corporate Counsel that while the rule will inevitably face legal challenges, companies will still be expected to comply. He added that it’s unclear whether the final rule will cover indirect emissions that occur in a company’s supply chain, known as “scope 3,” which comprise the bulk of emissions for which tech companies are responsible and can be produced by business travel, commutes and purchased goods and services.

Michael said such emissions can be hard to quantify. Companies often rely on third-party data sources to calculate those emissions. “If scope 3 disclosures are mandatory for purposes of the rule, that raises the question of what is the liability for that data?” he said.

Another SEC-proposed rule would require publicly traded companies to report “material” cybersecurity incidents within four business days of determining an event has occurred, a tight timeframe that observers say poses some risk. Litigation & enforcement partner Amy Jane Longo said it likely will be difficult for companies to determine whether an incident qualifies as disclosable.

“Since the materiality of the incident is the determining factor, that puts a lot of pressure on companies—in a situation that is often very dynamic—to assess and make that determination,” she said.

“It calls for companies to do a lot of prep work ahead of time to make that assessment if an incident comes up. It’s a matter of both making sure that information about an incident circulates to the right people on a timely basis and also making sure that they’re getting the kind of information they need.”