For a startup, ESG (environmental, social and governance) starts with being clear about the impact you want your company to create. Even at pre-seed, that should be a specific goal tracked with a few internal metrics, even if you never publish them. Beyond that, ESG isn’t a reporting exercise. It’s the short list of environmental, social and governance issues that actually affect your business, handled with real policies, honest metrics and regular conversations with the people your company affects. Skip the glossy sustainability report and the materiality matrix. Get governance, data security, employment practices and your supply chain right, answer customer and investor questionnaires accurately, and if your mission is central to the business, write it into your charter as a public benefit corporation rather than relying on a label.
Key takeaways
- Start with the impact you want to create. Even at pre-seed, set a clear goal and track it with two or three internal metrics, whether or not you publish them.
- No US law requires a private startup to publish an ESG report. Expectations arrive through customers, investors and, for large companies, California and EU rules.
- The issues that matter early are mostly good management: board governance, privacy and security, fair employment, honest claims and a clean supply chain.
- Don’t make environmental or impact claims you can’t prove. Unsupported claims draw regulators, competitors and class actions.
- Stakeholder engagement can be simple: know who your company affects, hear from them on a schedule, and show the board what you heard.
- If your mission is core to the company, a Delaware public benefit corporation (PBC) makes it legally binding. B Corp certification is a separate private standard, and it changed in 2026.
Start with the impact you want to create
Before policies, questionnaires or reports, get clear on the impact you want your company to have. Even at pre-seed, that should be a specific goal, written down, with two or three internal metrics that tell you whether you’re getting there. The metrics don’t need to be public, audited or perfect. They need to be honest and tracked from the start, because they shape what you build, who you hire and which customers and investors you choose, and they’re much harder to add later. If the goal is central enough to write into your charter as a public benefit, the same metrics become the backbone of your benefit report.
A good impact goal is tied to how the business makes money, so growth and impact move together, and it can be measured with data the company already collects or easily could. Three examples:
Environmental. A startup selling compostable packaging to food brands wants to keep single-use plastic out of landfills. It tracks pounds of plastic packaging replaced (units shipped times the weight of the plastic each one replaces), the share of each customer’s packaging that has switched, and the share of its products certified compostable in commercial facilities.
Social. A fintech startup offering early access to earned wages wants hourly workers to stop paying to reach their own money. It tracks the fees users pay compared with the overdraft and payday-loan fees they paid before signing up, how many users still overdraft each month, and the share of users earning less than the local median wage, so it knows it’s reaching the people it set out to serve.
AI. Picture a small group of researchers who leave a larger AI lab to start their own, because they believe advanced AI could be enormously beneficial or seriously harmful, and they want safety to come first. At pre-seed, before they have a product, they write down their goal: build AI systems that are safe and that people can trust. They track a few internal metrics from the start: the share of researchers and compute devoted to safety and alignment work; the results of a fixed set of safety tests run on every model before release, such as how often it helps with dangerous requests, deceives its user or ignores its instructions; and whether they’ve kept a written commitment not to release a model past a defined capability level until its safeguards meet a set standard. They also build the goal into the company itself, forming as a public benefit corporation with safety as its specific public benefit, so the board has legal room to put safety ahead of speed when the two collide. Safety goals are easy to state and hard to keep under commercial pressure, which is exactly why they need to be written down and measured from day one.
Keep the list short, review it with your board or advisors every quarter, and change a metric when it stops telling you something useful. Be careful about publishing any of these numbers before you can back them up (see marketing claims below).
What does ESG mean for a startup?
The three letters cover a company’s effect on the environment (emissions, energy, materials, waste), on people (employees, customers, suppliers and communities, including privacy and security), and the governance that holds it all together (the board, policies, ethics and controls). Investors use ESG to judge risks that don’t show up in the financials yet. Founders should use it as a checklist of things that can hurt or help the company.
The label itself has become politically charged in the US. Some states restrict ESG considerations in public pension investing, and many companies now talk about “impact,” “sustainability” or “stakeholders” instead. The substance hasn’t changed. A company that treats its people well, protects its customers’ data and tells the truth about its products is lower risk under any name.
Is any of this legally required?
For most startups, not directly. Here’s where the rules stand in October 2026:
SEC climate rule. It applied only to public companies, never took effect, and the SEC proposed to rescind it in 2026.
California. SB 253 requires companies with more than $1 billion in annual revenue that do business in California to report greenhouse gas emissions. The first Scope 1 and 2 reports are due November 10, 2026, and supply chain (Scope 3) reporting follows in later years. A companion law, SB 261, which requires climate risk reports from companies with more than $500 million in revenue, is paused while a constitutional challenge is on appeal at the Ninth Circuit. Few startups meet these thresholds, but their large customers do, and those customers will ask suppliers for emissions data.
European Union. Under the Omnibus I amendments (in force since March 2026, with member states implementing them by March 2027), the EU’s Corporate Sustainability Reporting Directive covers EU companies with more than 1,000 employees and more than €450 million in turnover, and non-EU groups with more than €450 million of EU turnover and an EU subsidiary or branch with more than €200 million in turnover. Companies with up to 1,000 employees in a reporting company’s value chain are protected from data requests beyond a voluntary standard.
Investors. Some venture funds, especially those with European or institutional limited partners, have their own reporting duties. They pass them on through side letters, annual ESG questionnaires or covenants to adopt basic policies. Read these before you sign, and answer them accurately.
Employment. DEI programs are under legal scrutiny, and since 2025 federal contractors must certify they don’t run DEI programs that violate federal anti-discrimination law. Have employment counsel review your programs.
Marketing claims. Environmental and social claims are advertising. The FTC’s Green Guides, state consumer protection laws and competitors’ lawsuits all reach “carbon neutral,” “sustainable,” “ethically sourced” and similar claims. Keep the evidence for every claim you publish.
What should we do at each stage?
| Stage | Do | Skip |
| Pre-seed and seed | A written impact goal with two or three internal metrics, clean governance and board approvals, CIIAAs, a privacy policy you follow, basic security, fair pay practices, honest marketing | ESG reports, materiality matrices, net-zero pledges, framework alignment |
| Series A and B | A one-page impact or ESG policy, accurate answers to investor and customer questionnaires, a few tracked metrics, a supplier code if you make physical goods, a handbook at around 20 employees | Full framework reporting, consultants’ maturity assessments |
| Growth and pre-IPO | Board oversight of key risks, an emissions inventory if customers or regulators need it, reporting aligned with the ISSB standards (which absorbed the TCFD and SASB frameworks) | Reporting on topics that don’t matter to your business |
How do we pick the issues that matter?
Your impact goal is what you’re trying to achieve. ESG issues are the risks and responsibilities that come with running any business, and they need attention whatever your mission.
Ask two questions about each potential issue: could it change the value of the company, and do the people we depend on care about it? Your industry answers much of this. The SASB industry standards, now maintained by the ISSB, are a free list of the topics investors consider material for each industry and a good starting point.
A software company’s list usually starts with privacy, security, employee practices and, increasingly for AI companies, the energy and water use behind their compute. A consumer products company’s list starts with materials, packaging, factory labor and product safety. A climate company needs to be precise about the impact it claims. A fintech or health company should add access, fairness in automated decisions and data use.
Track two or three metrics for each issue, using data you already have. Here’s what that might look like for a 40-person software company:
| Issue | Metric | Source |
| Data security | Security incidents and time to resolve; SOC 2 status | Security tooling |
| People | Voluntary turnover; pay range compliance; engagement score | HR system and surveys |
| Governance | Board meetings held; policies adopted and reviewed | Minute book |
| Environment | Cloud usage and the provider’s reported emissions | Cloud provider reports |
How should we engage stakeholders?
Stakeholder engagement doesn’t need a program office. Map who your company affects: employees, customers, suppliers, investors, regulators and, for some businesses, the local community. Decide how you’ll hear from each group and how often: an anonymous employee survey twice a year, customer interviews each quarter, a regular investor update. Write down what you learn and bring the themes to the board.
This is also good governance. In an ordinary Delaware corporation, directors owe their duties to the corporation and its stockholders, and they can weigh employee, customer and community interests when doing so serves long-term value. Informed decisions are what the duty of care asks for, and stakeholder input makes decisions better informed. In a PBC, considering stakeholders isn’t just permitted. The board must balance them. See Fiduciary Duties of Startup Founders and How Do I Update Investors in My Startup?.
Should we become a PBC or a B Corp?
They’re different things. A Delaware public benefit corporation is a legal form. Its charter names a specific public benefit, its directors must balance the stockholders’ financial interests, the interests of those materially affected by the company and that public benefit, and it must report to stockholders on its benefit at least every two years. No third-party standard or audit is required unless the charter says so. An existing Delaware corporation can convert with board approval and a majority vote of its outstanding stock, plus any separate class votes its charter requires. Venture-backed PBCs have gone public, including Warby Parker, Lemonade and Vital Farms.
B Corp certification is a private standard from the nonprofit B Lab. In 2026 B Lab replaced its 80-point score with required standards across seven impact topics, and it stopped issuing its “Pending B Corp” status in September 2026. Certification requires at least 12 months of operations and a legal commitment to stakeholders, which for a Delaware corporation generally means becoming a PBC.
Our view: for a mission-driven company on the venture track, the PBC comes first, because it binds the company and its board, not just its marketing. Certification can follow later if your customers or employees value the seal. See our Founder’s Guide: Public Benefit Corporation and What Legal Structure Is Best for Your Startup?. Westaway’s founder, Kyle Westaway, has advised benefit corporations for more than a decade and wrote Profit & Purpose on building companies that do both.
A lean starting checklist
- The impact you want to create is written down, with two or three internal metrics you review every quarter.
- Board approvals and minutes are current, and the board reviews key risks at least once a year.
- Every founder, employee and contractor has signed a CIIAA, and your privacy policy matches what you do.
- Pay practices, worker classification and anti-harassment policies are in place.
- Suppliers of physical goods have agreed to a supplier code.
- Every public impact claim has a file of supporting evidence.
- A one-page impact statement or annual update section is ready for investors and customers.
- Stakeholder check-ins are on the calendar.
Related reading: What Are the Startup Best Practices for Data Privacy?, Startup Employee Handbook and Startup Due Diligence.
If you’re considering a PBC, see our benefit corporation startup package, or our benefit report service if you already are one.
