With the rise of AI, there is one step in the CSRD process where the opportunity is immediately obvious. The Double Materiality Assessment.
Because let’s be honest: desk research, sector analysis, structuring impacts, risks and opportunities, comparing sources, building a first scoring methodology and organising all the information are exactly the types of activities where AI can add real value.
And let’s be honest: yes, AI also helped organise this white paper. It would have been strange not to.
The time of building endless Excel sheets from scratch, manually searching through separate documents and trying to keep control of everything by hand is over.
But that immediately raises the next question:
How do you make an AI-supported DMA audit proof?
Because “AI said so” is obviously not a valid basis for a conclusion. And a polished output from an AI tool is not the same as a reliable audit trail.
AI can speed things up. AI can structure information. AI can help challenge your thinking. But the materiality assessment remains a professional and management judgement. And that judgement needs to be explainable, evidence-based and traceable for the auditor.
Here are our tips and tricks.
1. Use AI as an assistant, not as the decision-maker
The most important principle is simple: do not let AI determine the DMA. Use AI for preparation. Let it summarise, cluster, structure, draft initial impacts, risks and opportunities, identify inconsistencies and suggest first scoring options.
But the final assessment remains human work.
An audit proof conclusion is not: “AI concluded that biodiversity is not material.” A stronger conclusion would be: “Based on internal documentation, sector information and stakeholder input, biodiversity was assessed as not material. AI was used to structure the available sources and prepare an initial scoring proposal. This proposal was reviewed, adjusted and approved by the DMA team.” That difference matters. AI output is not evidence. AI output is a tool to organise evidence.
2. Define your DMA methodology before using AI
A common mistake is to let AI run first and then try to build a methodology around the output. Turn that around.
First define how you will perform the DMA. Think about:
- The process steps;
- The sources you will use;
- How you define impacts, risks and opportunities;
- How you assess impact materiality;
- How you assess financial materiality;
- Which time horizons you apply;
- Which thresholds you use;
- Who is involved in review and decision-making.
Only then should you use AI within that methodology. This prevents AI from determining the method. The method should determine how AI is used.
3. Work with a strong IRO register
The core of your DMA file is the IRO register.
For each impact, risk or opportunity, document:
- The relevant ESRS topic;
- The description of the IRO;
- Whether it is an impact, risk or opportunity;
- Where it occurs in the value chain;
- Which stakeholders are affected;
- Which sources were used;
- The initial score;
- What AI may have proposed;
- The human review comments;
- The final score;
- Why the IRO is or is not material.
This register is ultimately more important than the AI output itself. The auditor does not only want to see that something was assessed. The auditor wants to understand why the judgement makes sense.
4. Save your prompts and outputs
If you use AI in a DMA, you need to be able to show how.
Save:
- The prompts you used;
- The documents or information you provided as input;
- The output generated by AI;
- Who reviewed the output;
- What was changed afterwards;
- Why something was accepted or rejected.
This does not need to be a messy folder full of screenshots. Create a clean prompt and output log instead. The goal is not necessarily for the auditor to rerun every prompt. The goal is for the auditor to understand how AI was used and how you arrived at your conclusions.
5. Link every judgement to sources
This may be the most important tip. Never let AI make unsupported conclusions.
Every relevant conclusion in your DMA should be traceable to something concrete. For example:
- An internal policy document;
- A stakeholder interview;
- A risk register;
- Operational data;
- An incident log;
- Sector information;
- Laws and regulations;
- Financial planning information;
- Input from management or experts.
AI can help analyse and summarise those sources. But if an IRO or score is not based on anything, it should not simply enter the file. No source means it is a hypothesis. Not a substantiated conclusion.
6. Document human review explicitly
An AI-supported DMA becomes audit proof through human review.
Make sure you clearly document:
- Who reviewed the AI output;
- Which adjustments were made;
- Which scores were increased or decreased;
- Which IROs were added;
- Which IROs were removed;
- Where there was discussion;
- Which final choices were made by management.
The changes are often the most interesting part. For example, if AI scores a risk as low, but management increases the score because of recent customer questions or expected regulation, that is valuable professional judgement. Document it. That is how you show that AI was not followed blindly, but used professionally.
7. Do not forget stakeholder input
AI can do a lot. But AI cannot replace stakeholder dialogue. For a strong DMA, you need to show how relevant stakeholder perspectives were taken into account. This is especially important for impacts on people, value chains, employees, customers, communities or the environment.
Document:
- Which stakeholder groups were identified;
- Why they are relevant;
- How input was collected;
- Which themes came up;
- How that input influenced the assessment.
AI can help structure interview notes or cluster themes. But the input itself needs to be real.
8. Include AI risks in your control approach
If you use AI, you also need to show that you understand the risks.
| AI risk | What to do |
|---|---|
| AI invents information | Only work with source references |
| AI misses context | Include review by people from the organisation |
| AI scores inconsistently | Use fixed scoring criteria |
| AI focuses on generic sector risks | Add company-specific input |
| AI misses the value chain | Assess upstream, own operations and downstream separately |
| AI output is difficult to reproduce | Save prompts, inputs and outputs |
| Too much reliance on AI | Build in formal review and management approval |
By making this explicit, AI does not become a black box. It becomes a controlled tool.
9. Create a logical audit trail
In the end, the auditor must be able to follow the process from input to conclusion. So not just: here is our materiality matrix.
But:
- This is our methodology;
- These are our sources;
- This is our longlist of IROs;
- These are the AI-supported analyses;
- This is the human review;
- This is the stakeholder input;
- These are the scores;
- These are the thresholds;
- This is the final conclusion;
- This is the link to the ESRS disclosures.
If that line is clear, your file becomes explainable and auditable.
10. Position it correctly
Do not call it an “AI-generated DMA”. That sounds as if the machine determined materiality. And that is exactly what you want to avoid.
A stronger way to position it is: “An AI-supported Double Materiality Assessment, performed within a controlled methodology, with source-based evidence, human review, stakeholder validation and management decision-making.” That is much stronger. AI helps you work faster, more completely and more consistently. But the judgement remains with the organisation.
Conclusion
AI will change the DMA. And honestly, that is good news.
A large part of a DMA consists of collecting, organising, comparing, structuring and documenting information. That is exactly where AI can add significant value.
But it only becomes audit proof when AI is properly embedded in the process.
So not: AI in, output out, done.
But:
- A clear methodology;
- Strong source links;
- A solid IRO register;
- Saved prompts and outputs;
- Visible human review;
- Stakeholder input;
- Formal decision-making;
- A logical audit trail.
That is how AI becomes not a risk to your DMA, but a way to make the process stronger.
Eager to learn more about us? Read more about our services or get in touch.