Shopify Plus Sustainability Reporting Requirements Guide

Three years ago, sustainability reporting for a Shopify Plus merchant meant a voluntary impact page on the about-us section of your storefront. In 2026, it means a legally binding disclosure filed alongside your financials, reviewed by an external auditor, and increasingly required by your wholesale partners before they'll write a purchase order.

This guide walks through what is now mandatory, who is in scope, when each obligation kicks in, and the practical steps to move from spreadsheets to audit-ready reporting.

The two regulations that matter most

If you sell into the EU or are a US-listed company, two regulations now define the perimeter of your reporting obligations.

CSRD (EU)

The EU Corporate Sustainability Reporting Directive requires in-scope companies to disclose against the European Sustainability Reporting Standards (ESRS) — twelve cross-cutting and topical standards covering climate, pollution, water, biodiversity, resource use, workforce, communities, consumers, and governance. Reports must be assured by an independent auditor with limited assurance through 2027 and reasonable assurance thereafter.

Critically, CSRD applies not only to EU-headquartered businesses. A US-headquartered Shopify Plus merchant that generates more than €150M in EU turnover and has at least one EU subsidiary or branch with €40M in turnover is in scope.

SEC climate disclosure rule (US)

The SEC's final rule requires US-listed companies to disclose material climate-related risks, governance over those risks, financial impacts, and — for large accelerated and accelerated filers — Scope 1 and Scope 2 greenhouse gas emissions with phased-in assurance. Scope 3 is required only where it is material or if a company has set a Scope 3 target. The rule is being phased in from fiscal years 2025 onward.

Who is in scope

Use this as a rough triage. Detailed scoping should be reviewed with counsel, but the high-level picture is:

• Public Shopify Plus merchants on US exchanges → SEC climate rule applies. Filing class determines timing.
• Private merchants with significant EU revenue (≥ €150M EU turnover and an EU subsidiary/branch ≥ €40M) → CSRD applies via the third-country provisions, with first reports due in respect of FY2028 financial years.
• EU-headquartered merchants meeting two of three thresholds (≥ €50M revenue, ≥ €25M assets, ≥ 250 employees) → CSRD applies directly.
• Merchants wholesaling into regulated retailers (Sephora, Target, Walmart, large EU department stores) → contractually in scope via supplier ESG questionnaires even if not in direct regulatory scope.

Key deadlines

1. FY2024: CSRD first wave — large EU public-interest entities (already reporting).
2. FY2025: SEC climate rule disclosures begin for large accelerated filers; CSRD second wave for large EU companies.
3. FY2026: CSRD third wave — listed SMEs in the EU.
4. FY2028: CSRD applies to non-EU parent groups meeting EU revenue thresholds — this is the wave that catches most US Shopify Plus brands selling in Europe.

Scope 1, 2, and 3 in plain language

Almost every framework you'll encounter is built on the GHG Protocol's three-scope model. The categories sound abstract until you map them to a Shopify Plus operation.

Scope 1 — Direct emissions

Anything you burn or release directly. For most Shopify Plus merchants, this is small: company-owned delivery vans, gas heating in your office or warehouse, refrigerant leaks in your facility's HVAC. If you outsource fulfillment to a 3PL, you may have no Scope 1 emissions at all.

Scope 2 — Purchased energy

Electricity, steam, and heat that someone else generates and sells to you. Your office and warehouse electricity bills are the canonical example. Scope 2 has two reporting methods (location-based and market-based) and most frameworks require you to disclose both.

Scope 3 — Value chain emissions

Everywhere else: the emissions embedded in the products you buy from suppliers, the freight that brings them to your warehouse, the last-mile delivery to your customer, returns, and end-of-life disposal of the product. For Shopify Plus merchants, Scope 3 typically represents 80–95% of total footprint. It is also the hardest category to measure, because the data lives in your suppliers' and carriers' systems, not yours.

Steps to become audit-ready

Audit-readiness is the bar that distinguishes a sustainability report from a marketing claim. An auditor needs to trace every published number back to a source system, a methodology, and a calculation log. Here is a pragmatic path to get there.

1. Inventory your data sources. Shopify orders, fulfillment data, supplier invoices, energy bills, payroll headcount. Write down which system owns the master record for each one.
2. Pick your frameworks early. CSRD or SEC will be the anchor; GRI and TCFD can be derived from the same underlying data once you have it.
3. Establish a base year. Most frameworks expect year-over-year comparability. The earlier you lock in a base year, the cleaner your trend lines.
4. Document methodology. For every estimated number — especially Scope 3 — record the emission factor, the source, the version, and the calculation. This is what an auditor will ask for first.
5. Automate the pipeline. Manual spreadsheet collection breaks at the second reporting cycle. Connect your Shopify store, your accounting system, and your supplier registry to a platform that maintains the audit trail for you.
6. Run a dry-run review. Six months before your first mandatory filing, produce a draft report and walk it through with your auditor. The questions they raise on a dry run are far cheaper to fix than the ones they raise on a real one.

Where merchants get stuck

The pattern we see most often is merchants treating sustainability reporting as a one-time project rather than a continuous data discipline. The first report is hard. The second is harder, because you suddenly need year-over-year comparability and you discover that last year's spreadsheet is missing the methodology notes that would have made restatement easy.

The merchants who handle 2026 well are the ones who started in 2024 — not because they had to, but because they recognized that data collection has a long warm-up period. If you are starting now, focus on the pipeline first and the polish second. A complete, traceable, slightly rough report beats a beautiful one that cannot be defended.

Where EsgForge fits

EsgForge connects to your Shopify Plus store, pulls the underlying transactions, and maintains the methodology and calculation log that auditors require. You stay in control of the disclosure; we handle the pipeline, the framework mapping, and the audit trail. Most merchants produce their first complete CSRD-aligned draft within their first month on the platform.