Eleven months after you signed the matrix, an external assurer sits across the table and says four words that decide your year: "Show me the basis." She points at the double-materiality matrix in your sustainability statement, at the dot marked climate change sitting in the top-right corner, and she wants to walk backward from that dot to the raw inputs that put it there. Not a summary. The chain. Who said what, what the AI did with it, where you stepped in, what threshold you applied, and who signed. If you can reconstruct the matrix from the file, in front of her, without you in the room as the only living source of truth, the assessment holds. If you cannot, the most important judgment in your whole report is an assertion with nothing under it. This lesson is about building the workflow so that the day she asks, the answer is already on the table.

The Matrix Is a Conclusion, Not a Picture

The double-materiality matrix looks like the easy part of the report: a clean two-axis chart with topics plotted as dots, ready for the board deck. That picture is the most dangerous thing in your sustainability statement, because it compresses hundreds of decisions into a graphic that hides every one of them. Double materiality is the rule, central to the European Sustainability Reporting Standards (ESRS) under the Corporate Sustainability Reporting Directive (CSRD), that a topic is material if it is significant from either of two directions, and you must assess both. Impact materiality is how your company affects people and the environment, the outward view. Financial materiality is how a sustainability matter affects your company's own financial position, cash flows, access to finance, or cost of capital, the inward view. A topic that clears either threshold is material and goes in the report. The matrix is the conclusion of that assessment, and an assurer does not test the picture. The assurer tests the basis behind it.

CSRD survived the 2025 to 2026 Omnibus simplification. Directive (EU) 2026/470, published 26 February 2026 and in force 18 March 2026, narrowed the population but kept the largest undertakings in scope: more than 1,000 employees and more than EUR 450M turnover, with member-state transposition due 19 March 2027. The companies still in scope are the biggest ones, where a failed disclosure is a board-level event. Layer on the assurance reality: roughly 73% of large global companies now obtain external assurance on at least some sustainability disclosures, up from 51% in 2019. So your materiality assessment is not an internal planning exercise. It is an audited conclusion. Every dot on that matrix is a claim the assurer can ask you to support, and the whole point of an AI-integrated workflow is to make that support a by-product of the work, not a frantic reconstruction eleven months later.

The temptation AI introduces is real and worth naming up front. A model can ingest hundreds of stakeholder comments, survey responses, peer reports, and risk-register entries, and in minutes hand you a tidy cluster of themes plotted against severity and likelihood. That is genuinely useful. It is also the exact place where an unsupported conclusion can slip into the most consequential judgment in your report, because the model's clustering looks authoritative and the matrix it produces looks finished. The discipline of this lesson is to treat the AI's output as the start of the assessment, never the end, and to capture the basis at every stage so the finished matrix is reconstructable.

The Five Stages, End to End

An AI-integrated materiality workflow runs in five stages, from raw inputs to the signed matrix. For each stage there are three things you must be able to say afterward: what the AI did, what the human decided, and what evidence you captured. Hold those three columns in your head for every stage, because they are exactly the three columns the assurer will reconstruct. Miss any one of them on any stage and you have a gap in the chain.

Stage One: Gather and Register the Inputs

The workflow begins with evidence, not with the model. You assemble the raw inputs to the assessment: stakeholder consultation records, internal and external survey responses, the risk register, peer and sector benchmarks, regulatory and litigation signals, scientific and supply-chain data on actual and potential impacts. Before any AI touches them, you register them: each input gets an identifier, a source, a date, and a type. The AI role here is narrow and supportive, helping to deduplicate, to extract structured fields from messy documents, to flag where an input is unattributed. The human decision is what counts as a valid input and what does not. The evidence captured is the input register itself, the master list against which every later cluster and conclusion can be traced back. If an input is not in the register, it cannot legitimately influence the matrix, and if a conclusion rests on something not in the register, that is a finding waiting to happen.

Stage Two: AI Clusters, Human Names the Themes

Now the model earns its place. Given the registered inputs, AI clusters them into candidate themes: it groups the forty comments about water, the thirty about labour conditions in the supply chain, the twenty about product safety, and proposes topic groupings mapped toward the ESRS topical standards. This is real leverage, collapsing days of manual coding into an afternoon. But clustering is a suggestion, not a verdict. The AI role is to propose groupings and surface candidate themes with the inputs that drove each one. The human decision is whether the clusters are right: whether a theme the model split should be merged, whether a theme it merged hides two distinct issues, whether a quiet but serious input the model buried in a large cluster actually deserves to stand alone. The evidence captured is the mapping from every cluster back to the specific input IDs inside it, so that the basis for each candidate topic is the actual list of inputs, traceable by source, not the model's say-so.

Stage Three: Score Each Topic Against the Threshold

Each candidate topic now gets assessed on both axes against a defined threshold. The materiality threshold is the documented line, set in advance, that separates material from not material; on the impact axis it is built from severity (scale, scope, and irremediability of the impact) and likelihood, and on the financial axis from the magnitude of the potential financial effect and its probability. The AI role is to assemble the evidence for each score: pulling the relevant inputs, summarising the severity signals, drafting a first-pass score with its reasoning. The human decision is the score itself and whether the topic clears the threshold, because severity and magnitude are judgments your company owns, not outputs a model can settle. The evidence captured is, per topic per axis, the score, the inputs behind it, the threshold applied, and the rationale, the packet that makes a single dot on the matrix defensible. A score with no captured basis is a coordinate with no support, and the matrix is nothing but a field of those coordinates.

The matrix is only as defensible as the chain behind its weakest dot. An assurer does not test the picture; the assurer picks one topic and asks you to rebuild it from the raw inputs. If you cannot, the whole assessment is an assertion.

Stage Four: Assemble the Matrix and the Threshold Line

With every topic scored on both axes, the matrix assembles itself: each topic plots at its impact score and its financial score, and the threshold line separates material from not material. The AI role is mechanical and welcome, plotting the coordinates, drafting the summary view, generating the topic list that flows into the disclosure. The human decision is to confirm that the plotted position of each topic matches its scored basis and that the threshold line is the one you actually set and recorded, not one quietly redrawn to make the picture look cleaner. The evidence captured is the link from every dot to its scoring packet from stage three, so that pointing at any topic on the matrix opens the chain back to the inputs. This is the stage where the picture and the basis must be welded together, because a matrix whose dots do not link to their scores is exactly the unreconstructable graphic the assurer fears.

Stage Five: Governance Review and Sign-Off

The matrix is not final until a human with authority signs it. The AI role here is essentially none; sign-off is a governance act, not a generative one. The human decision is the review and approval: the materiality working group reviews the topics and thresholds, the responsible officer signs the conclusion, and any override of an AI suggestion or a borderline call is recorded with its reasoning. The evidence captured is the governance record: who reviewed, who decided, who signed, on what date, and the rationale for any contested call. This is the basis-of-preparation for the matrix, the documented foundation that says how this conclusion was reached and on whose authority. Without it, you have a matrix that nobody owns, and an unowned conclusion is one no assurer will accept, because accountability in disclosure is human and the file has to prove who held it.

Grounding the AI and the Provenance Thread

Two disciplines run through all five stages and make the difference between a workflow that survives assurance and one that merely looks efficient. The first is grounding. The AI in this workflow must answer from your registered inputs, your risk register, and your evidence base, never from the open web or its training data. When a model is asked to cluster or score from the documents you supply, it works from your facts; when it is asked to assess materiality in the abstract, it reaches for the generic and plausible, and a generic materiality conclusion is one with no basis in your company. Ground every prompt in the registered evidence and instruct the model to use only what you supply and to flag any gap rather than fill it, so that a missing input shows up as a visible hole, not an invented theme.

The second is the provenance thread, the unbroken link from the final matrix back to the raw inputs. Provenance is the documented origin and history of a figure or conclusion: where it came from and how it got to where it is. In this workflow, provenance means that every dot links to its score, every score links to its inputs, and every input sits in the register with a source and a date. The thread is what lets the assurer pull any topic and walk it backward without you. You build the thread not at the end but as you go, capturing the mapping at each stage as a by-product of doing the stage. The team that captures provenance continuously walks into the engagement with the chain already intact; the team that keeps only the clean matrix and plans to "document it later" walks in with a beautiful picture and no basis, which is the same as having done no assessment at all, because an assessment you cannot reconstruct is one you cannot prove you made.

A Worked Example: Reconstructing the Climate Dot

Watch the workflow do its job under the assurer's question. The company is a mid-cap industrial manufacturer. The assurer points at the climate-change dot in the top-right of the matrix and asks the team to reconstruct it.

The weak version, no thread. The analyst opens the matrix file. Climate is plotted high on both axes. Asked why, she explains from memory: "The AI clustered all the climate inputs and scored it material, and the working group agreed." The assurer asks which inputs. The analyst is not sure; the clustering was done in a chat session that was not saved. She asks which threshold was applied. The threshold was discussed in the workshop but not written down with the score. She asks who signed. The matrix was emailed around and nobody's approval is recorded against it. Every answer is "we did it, trust me." The dot is real, the work was probably sound, and none of it can be shown. That is a control finding on the single most important judgment in the report, and it widens: if climate cannot be reconstructed, the assurer reasonably doubts every other dot.

The strong version, thread intact. The analyst opens the matrix file and clicks the climate dot. It links to the climate scoring packet from stage three. The packet shows the impact score (high severity: contribution to climate change is large in scale and effectively irreversible; high likelihood: ongoing) and the financial score (material magnitude: carbon-price exposure and physical-risk disruption to two facilities; probable likelihood), each with the threshold applied and the rationale. Each score links to the inputs behind it: stakeholder consultation records IDs 044 to 071, risk-register entries RR-2026-003 and RR-2026-018, the sector benchmark, the scientific basis for the severity call, all sitting in the input register with sources and dates. The packet shows the AI's first-pass cluster and score, and the analyst's override raising the financial magnitude after the risk register was consulted, with her reasoning noted. The governance record shows the working group reviewed the topic on 14 February and the sustainability officer signed the materiality conclusion on 21 February. The assurer reconstructs the dot in four minutes, from raw input to signed conclusion, without the analyst supplying a single fact from memory. The dot holds, and because the thread is the same for every topic, the assurer's confidence in the whole matrix rises rather than collapses.

The difference between the two versions is not the quality of the underlying judgment. In both, climate is genuinely material and the team did real work. The difference is entirely whether the work was captured as it happened. The AI did the same clustering and first-pass scoring in both. What separated the defensible matrix from the indefensible one was the provenance thread, built stage by stage, so that the conclusion could be reconstructed by someone other than the person who made it. That is the whole game.

Running the Workflow Without Getting Burned

A handful of rules keep the workflow assurable. Register every input before the model touches it, so every later conclusion has a master list to trace back to. Treat AI clustering and scoring as proposals, never verdicts, and record every override with its reasoning, because the override is often where your real judgment lives and the assurer most wants to see it. Set and write down the threshold before you score, not after, so it cannot be accused of being reverse-engineered to fit the picture. Weld every dot to its scoring packet and every packet to its inputs, building the provenance thread as you go rather than reconstructing it later. Ground every prompt in your registered evidence and forbid the model from filling gaps from general knowledge. And never let the matrix leave the workflow without a recorded sign-off, because an unowned conclusion is one no assurer accepts.

Do that and the AI gives you what it is genuinely good for here: hundreds of inputs clustered in an afternoon instead of a fortnight, first-pass scores drafted in minutes, your hours redirected to the judgments that actually decide materiality. When the assurer says "show me the basis," you do not reach for memory. You open the file and walk her from the dot back to the raw input, stage by stage, and the most consequential judgment in your report stands on its own. The AI accelerated the work. You owned the decisions. The thread proved both. That is the materiality assessment that holds.

Key Takeaways

• The double-materiality matrix is a conclusion, not a picture; an assurer does not test the graphic, she picks one topic and asks you to reconstruct it from the raw inputs, so the workflow exists to make that reconstruction possible.
• Double materiality means a topic is material if it clears either the impact threshold (your effect on people and planet) or the financial threshold (the effect on your enterprise value), and both axes must be assessed.
• The workflow runs in five stages: register inputs, AI clusters and human names themes, score each topic against a documented threshold, assemble the matrix, and govern the sign-off; for every stage you must be able to state the AI role, the human decision, and the evidence captured.
• AI clustering and scoring are proposals, never verdicts; the human owns whether a theme is right, what each score is, and whether a topic clears the threshold, and every override is recorded with its reasoning.
• The materiality threshold is set and written down before scoring, built from severity and likelihood on impact and from magnitude and probability on finance, so it cannot be accused of being reverse-engineered to fit the matrix.
• Ground the AI on your registered inputs and evidence base, never the open web, and instruct it to flag gaps rather than fill them, so a missing input shows as a visible hole instead of an invented theme.
• The provenance thread, built stage by stage, links every dot to its score, every score to its inputs, and every input to the register, so an assurer can walk any topic backward without you in the room.
• The basis-of-preparation, including the governance record of who reviewed, decided, and signed, is what turns a matrix nobody owns into a conclusion the assurer accepts; an assessment you cannot reconstruct is one you cannot prove you made.