Regulatory developments
In 2024, private companies will likely be affected, directly or indirectly, by federal, state, and global laws and regulations addressing cybersecurity, data privacy, AI, and climate and other sustainability issues.
Cybersecurity. In July, the US Securities and Exchange Commission (SEC) issued final cybersecurity rules that significantly increase the disclosure obligations of public companies, including the reporting of material cyber incidents within four business days of a materiality determination, as well as the companies’ processes for assessing, identifying, and managing materials risks from cybersecurity threats, including whether the company “… has processes to oversee and identify such risks from cybersecurity threats associated with its use of any third-party service provider.”3 The final rules do not exempt public companies from providing disclosures regarding cybersecurity incidents on systems owned by their business partners, including private companies. As a result, public companies will want to confirm that they have effective communication protocols in place with service providers, including private companies, to enable timely assessment and disclosure of material cybersecurity incidents. Private companies doing business with public companies can expect greater scrutiny of their own cyber preparedness, which may include how secure their systems are, as well as contractual obligations for incident reporting. (See “Maintain the focus on cybersecurity and data privacy and monitor management’s preparations for compliance with the SEC’s cybersecurity rules” in On the 2024 board agenda.)
Cybersecurity also poses compliance risks for private companies, including compliance with industry-specific laws and regulations as well as privacy laws and regulations that govern how personal data—from customers, employees, or vendors—is processed, stored, collected, and used. A number of countries and states have enacted privacy and personal data protection laws and regulations, and more are considering such legislation. Private company boards should help ensure that management is monitoring US, state, and global data privacy developments that may impact the company and help ensure that the company has controls in place to manage that data in accordance with applicable laws and regulations.
Climate and other sustainability issues. Some US, state, and global regulatory mandates regarding climate and sustainability disclosures will directly or indirectly pull in private companies. Management should be analyzing which laws and regulations the company must comply with and the likelihood that the company will be required to provide data on climate and other sustainability issues to business partners that have their own compliance mandates (such as reporting Scope 3 emissions). For example:
- California laws SB-253 and SB-261: Private companies doing business in California may find themselves subject to new California climate laws that go into effect in 2026. The California laws cover both public and private companies doing business in the state, with a $1 billion revenue threshold for those required to report greenhouse gas emissions and a $500 million revenue threshold for those required to report climate-related financial risks. Companies will need to monitor additional regulatory and legislative initiatives relating to the California climate legislation, as Governor Gavin Newsom noted concerns that would need to be addressed by the state administration and the legislature.
- European Union (EU) Corporate Sustainability Reporting Directive (CSRD): Private companies with operations in the EU may be required to comply with the CSRD, which requires covered companies to issue a sustainability report on a range of environmental, social, and governance (ESG) topics. The specific reporting requirements applicable to non-EU companies are under development, and private companies need to monitor the CSRD developments as well as other global climate and sustainability initiatives. (See “Keep abreast of management’s preparations for new US, state, and global climate and sustainability reporting requirements” in On the 2024 board agenda.)
