The ESG policies to have in place before you fundraise

Before you fundraise, most UK startups should have six short ESG policies in place: an environmental policy, a code of conduct (covering ethics, anti-bribery and conflicts of interest), a data protection policy with a privacy notice, an information security policy, an equal opportunities and anti-harassment policy, and a health and safety policy. Add a responsible AI or product policy if your product makes decisions about people. Each one can be one to three pages long.

You probably follow most of these already. The policies simply put what you do in writing, so an investor can see it.

Which ESG policies do investors expect at seed and Series A?

Here is the core set, with why each one matters to an investor.

Policy	Why investors care	Legally required?
Environmental policy	Shows you know your footprint and have a plan, however small	No
Code of conduct	Covers ethics, bribery, gifts and conflicts of interest	No, but supports Bribery Act compliance
Data protection and privacy notice	Personal data is usually the biggest ESG risk for software startups	Privacy information is required if you process personal data
Information security	Breaches are expensive and damage trust	No, though customers often require it
Equal opportunities and anti-harassment	Signals a healthy culture as you hire	No standalone requirement, but supports Equality Act compliance
Health and safety	Basic duty of care	Must be written down once you have five or more employees

The HSE is clear on that last one: every business needs a health and safety policy, and if you have five or more employees you must write it down. That includes a team working from a co-working space.

Are there policies only some startups need?

Yes. Investors also look at what is material to your sector, meaning the issues most likely to affect your business. Expect extra questions if you are in one of these areas:

• AI and automated decision-making. A responsible AI policy covering training data, bias testing and human oversight.
• Fintech. Anti-money laundering and financial crime controls, plus fair treatment of customers.
• Healthtech. Clinical safety, patient data handling and adverse event reporting.
• Consumer products and hardware. Supplier standards, product safety and end-of-life or packaging policies.
• Marketplaces. Seller or provider vetting and a process for handling complaints and harmful content.

A Modern Slavery statement is only legally required once turnover reaches £36 million, so it is unlikely to apply before Series B.

What does a good startup policy look like?

Investors read a lot of policies. The ones that land well share four features.

• Short. One to three pages. If a new hire would not read it, it is too long.
• Specific to you. It mentions your actual business, such as your co-working office, your cloud provider or your remote team, not “the Group’s global operations”.
• Owned. A named person is responsible for it. In a small startup that is often a founder or the COO.
• Reviewed. It carries an adoption date and a review date, usually annual.

An environmental policy for a 10-person SaaS company might fit on one page: a statement of commitment, your biggest impacts (likely flights, cloud hosting and your share of office energy), three or four practical actions, who owns it and when it will be reviewed. That is far more credible than a sweeping pledge to “protect the planet”. Our environmental policy template and code of conduct template guides show what to include.

Which policy gaps worry investors most?

Not all gaps are equal. Investors are relaxed about a missing whistleblowing policy at seed. They are much less relaxed about gaps that point to real risk.

Data protection comes first for most software startups. If you hold customer personal data with no privacy notice, no clear lawful basis and no access controls, expect follow-up questions and possibly a condition in the term sheet.

Conflicts of interest come next. Founders who own a supplier, or contracts with friends and family, are fine if declared and documented. Undeclared, they look like a governance problem.

Health and safety matters as soon as you pass five employees, simply because it is a legal requirement and easy to fix.

Close those three first. The rest can be dated commitments.

How to put the policies in place this week

Work through them in order of effort.

1. Health and safety. The HSE has a free template and the policy itself can be short for an office-based team.
2. Privacy notice and data protection. Check the one on your website is current. The ICO has guidance written for small organisations.
3. Equal opportunities and anti-harassment. Acas publishes free guidance you can adapt.
4. Information security. Write down what you already do: password manager, two-factor authentication, device encryption, access reviews, backups.
5. Environmental policy and code of conduct. These need your business specifics. Start from the templates linked above and edit them to match how you actually work.

An environmental policy is far more convincing with real numbers behind it. The ESG Now questionnaire asks about your energy, travel, waste, team and governance, then produces a shareable ESG report with your carbon footprint and a private action plan that shows which policies you already have in place and which are worth adding next. A small team in a co-working space typically finishes in 15 to 20 minutes, without needing any utility bills. Your first report is free. Start here.

Once your policies are adopted, convert them to PDF, date them and drop them into your data room. Our ESG data room checklist shows where they fit.

Keeping policies alive after the round

Most investors will ask for an annual ESG update after they invest, often using a questionnaire based on frameworks like ESG_VC. That is where policies either prove their worth or get exposed as shelfware.

A few habits help:

• Put policy reviews in the calendar once a year, ideally just before your ESG update is due
• Mention new policies in onboarding so every new joiner reads them
• Bring ESG to a board meeting once a year, even for 15 minutes
• Refresh your carbon footprint annually so the environmental policy has current numbers behind it

Done this way, the policies you write before the raise become the backbone of your reporting for the next few years. If a questionnaire is already on its way, read how to prepare for an ESG due diligence questionnaire, and visit the startups raising investment hub for everything else founders need.