Double materiality assessment workpaper (CSRD / ESRS basis)

Structure (7 sections)

1. 1. Applicability: why we are doing this assessment

   Start with the trigger, because it sets the depth of everything that follows. Three common cases: (1) the group meets the third-country undertaking reporting thresholds in the EU and must report in its own right; (2) it has an EU subsidiary that reports under the Accounting Directive; or (3) most commonly, an EU customer asks for sustainability information as part of procurement. For case (3), record one fact in particular: Omnibus I, Directive (EU) 2026/470, introduced a value-chain cap under which a reporting undertaking may not require information beyond the voluntary standard from value-chain undertakings that did not exceed an average of 1 000 employees in the preceding financial year, and those undertakings have the right to decline; the cap does not affect voluntary sharing, information already agreed contractually, or information gathered for due diligence or risk management. Put your own headcount, the preceding financial year figures and the information clause of the customer contract into this section so you can cite them directly in negotiation. Note that the CSRD and the ESRS were amended repeatedly in 2025–2026: check the current consolidated text before drafting.

   Evidence to attach

   • · Group EU turnover and EU subsidiary/branch net turnover for the last two financial years
   • · Average headcount calculation for the preceding financial year (for the value-chain cap defence)
   • · Extracts of the customer contract clauses on providing sustainability information
   • · Applicability conclusion and legal review memo

   Common pitfalls

   • · Preparing full ESRS reporting without knowing whether you are in scope, burning months of effort against no legal duty
   • · Accepting a customer questionnaire wholesale, handing over information that could have been declined under the value-chain cap and thereby creating an ongoing contractual obligation
   • · Reusing a 2024 scoping conclusion without checking the 2025–2026 stop-the-clock and Omnibus I amendments

2. 2. Mapping the business and value chain

   Draw the chain end to end and annotate each node with location, type of business relationship and sustainability exposure. For an AI company the chain is typically: chip and server manufacturing → data centres (owned, colocated or public cloud) → data collection and labelling outsourcing → model training and fine-tuning → product delivery (API, on-premises deployment or device) → customer use → hardware end-of-life. At each node ask three questions: is there a human rights exposure (labelling workforce, contract manufacturing labour, critical mineral extraction), is there an environmental impact (electricity, water, e-waste), and do we have leverage here. The map is the only input to the impact materiality judgement that follows; jumping straight to scoring without it is the most common methodological defect.

   Evidence to attach

   • · Value chain map with location, relationship type and spend/revenue share per node
   • · List of key suppliers and outsourcing partners (labelling vendors, contract manufacturers, cloud and compute providers)
   • · Preliminary exposure annotation per node
   • · Downstream customer industry mix and product use-case list

   Common pitfalls

   • · Mapping only tier-1 suppliers and leaving the mineral and contract-manufacturing nodes — where risk concentrates — off the map
   • · Treating public cloud as an impact-free service purchase and ignoring its electricity and water footprint
   • · Describing downstream only as "enterprise customers" without separating high-risk use cases such as law enforcement, hiring or credit

3. 3. Stakeholder identification and engagement

   List affected stakeholders (employees and outsourced workers, data subjects, neighbouring communities, supply chain workers) and users of the information (investors, customers, regulators), and record the engagement actually performed in this assessment: who, how, when, how many participated, the main views obtained and how those views changed the topic list. The ESRS expect meaningful engagement, not one anonymous survey. AI companies should be careful to cover two frequently overlooked groups: outsourced data labelling workers (hours, piece rates, the mental health burden of content moderation) and the individuals affected by model outputs (automated decisions, synthetic media). Where a group was not engaged, state why and what alternative information source was used.

   Evidence to attach

   • · Stakeholder list and prioritisation record
   • · Engagement records (meeting notes, raw survey data, interview notes, with dates and participant counts)
   • · Table mapping stakeholder views to changes in the topic list
   • · Explanation for any group not engaged and the alternative information source used

   Common pitfalls

   • · Claiming stakeholder engagement on the basis of internal management interviews alone
   • · Excluding outsourced labelling workers entirely — precisely the most characteristic social risk in the AI value chain
   • · Engaging but not recording how the views changed the conclusion, which reads as a box-ticking exercise

4. 4. Impact materiality assessment (effects on people and the environment)

   For each candidate topic assess actual and potential impacts, positive and negative, and record the dimensions used: severity (scale, scope, remediability) and, for potential impacts, likelihood. For negative human rights impacts, severity should weigh more heavily than likelihood — this is the fundamental methodological difference from financial materiality and must be stated explicitly in the workpaper, or reviewers will conclude the two logics have been conflated. Record the score, basis and data source topic by topic, and keep the negative decisions too (which topics were assessed and found not material, and why).

   Evidence to attach

   • · Topic list and per-topic impact assessment table (actual/potential, positive/negative, the three severity elements, likelihood, score, basis)
   • · Written statement of the severity-over-likelihood rule for human rights impacts
   • · Data source list (internal ledgers, supplier audit reports, stakeholder input, public incidents)
   • · Record of topics assessed as not material and why

   Common pitfalls

   • · Running impact materiality through a single financial "likelihood × impact" matrix, erasing the severity-first rule for human rights
   • · Assessing negative impacts only and ignoring positive ones
   • · Confining the assessment to own operations and excluding upstream and downstream impacts entirely

5. 5. Financial materiality assessment (financial effects on the undertaking)

   Assess how each topic affects cash flows, access to finance and cost of capital over the short, medium and long term, and record the thresholds and quantitative assumptions used. The most concrete items for an AI company: price elasticity of electricity and compute cost; power and water permitting risk where data centres sit; disruption of critical chips and components; the revenue risk of customers halting procurement after a failed carbon or human rights diligence; and the retraining or withdrawal cost of changing model compliance requirements. Where a topic cannot be quantified, use a qualitative grade and say why. This section shares the topic list with impact materiality but the scoring logic must be presented separately, with a topic entering the disclosure set if either side crosses the threshold.

   Evidence to attach

   • · Financial materiality table (topic, horizon, transmission mechanism, quantitative assumption or qualitative grade, threshold assessment)
   • · Basis for the thresholds, including how they relate to financial statement materiality
   • · Mapping to existing entries in the enterprise risk management system
   • · The double materiality matrix and the final disclosure topic list

   Common pitfalls

   • · Thresholds expressed only as "material", with no anchor to financial statement materiality
   • · Financial materiality conclusions that contradict the risk factors section of the annual report
   • · Treating double materiality as the intersection of the two sides, when the rule is that either side crossing the threshold brings a topic in

6. 6. Mapping to disclosure requirements and the data gap list

   Map the topics finally assessed as material to specific disclosure requirements (the ESRS 2 general disclosures plus the data points of the relevant topical standards), and annotate each data point with: whether data exists today, which system holds it, the owning function and the expected completion date. This table becomes the project plan for everything that follows. Also run the mapping in reverse, flagging the topics the ESRS cover that you assessed as not material and will not disclose — the ESRS still require an explanation for omissions, and omitting without explaining is the most common formal defect.

   Evidence to attach

   • · Topic → disclosure requirement → data point mapping (current data status, system, owner, deadline)
   • · Data gap list and remediation plan
   • · Draft explanation for omitted topics
   • · Reuse table against existing ISSB and exchange-guide data points

   Common pitfalls

   • · Mapping only to standard level rather than data point level, leaving nothing that can be scheduled
   • · Collecting the same data three times over for the ESRS, ISSB and exchange views
   • · Omitting topics without the required explanation

7. 7. Assessment governance, approval and reassessment

   Record who performed the assessment, who reviewed it, who approved it and how the results were discussed at board level. Also fix in writing the reassessment cycle and the events that trigger an off-cycle reassessment (major acquisitions, entry into a new market, a new high-risk product line, a significant incident or adverse event, a change in regulatory basis). Double materiality is not a one-off project — a workpaper with no reassessment arrangement invites the question "does the conclusion still hold" in the following year.

   Evidence to attach

   • · Assessment team composition and list of external support providers
   • · Review and approval records including board or committee minutes
   • · Written reassessment cycle and trigger events
   • · Comparison of this round against the previous conclusions (where not the first round)

   Common pitfalls

   • · The assessment is delivered entirely by an external consultant and nobody inside the company can explain the method or the conclusion
   • · No reassessment mechanism, so the same matrix is still being cited three years later
   • · The board never considered the materiality conclusion while the report claims board oversight