Using AI for GRI Reporting: What Can Be Automated and What Requires Human Judgement

Working edition · 1 August 2026

GRI requirements apply to the reporting organisation. An AI system can produce text, classifications or anomaly flags, but it does not become the data owner, materiality approver, legal adviser, assurance provider or highest governance body. The organisation must still apply the reporting principles, retain verifiable evidence and support every judgement.

There is also no single “AI accuracy” control. Risks differ by task: a summarisation error, an invented disclosure number, an incorrect calculation, a confidentiality breach and an overconfident materiality conclusion require different controls. The operating model should classify the use case before the tool is used.

Figure 1. AI can automate or assist defined tasks, while material judgements and final claims remain subject to qualified human decision and approval.

1. Classify the use case and risk. Define whether the system will automate, assist, inform a decision or draft a public claim.

2. Approve the source and data perimeter. Use current official standards, controlled organisation records and permitted access levels.

3. Define the output contract. State the required schema, prohibited claims, confidence labels and what the system must flag as unknown.

4. Generate with traceability. Preserve source anchors, model/version, prompt/template, retrieval set and output.

5. Perform technical and evidence review. Validate disclosure identifiers, boundaries, calculations, facts, examples and limitations.

6. Escalate specialist decisions. Route legal, human-rights, scientific, actuarial, assurance or privacy issues to qualified reviewers.

7. Approve the canonical answer and public wording. Separate preparation from final technical or governance approval.

8. Archive and monitor. Retain accepted edits, rejected outputs, incident records, regression tests and update triggers.

No source, no normative claim: the system must return a source gap rather than complete the logic from memory.

Use retrieval from approved documents and store exact source anchors with each claim.

Verify all GRI numbers, titles, editions, effective dates and reasons-for-omission rules independently.

Perform calculations in transparent spreadsheets or code, not free-form language generation.

Separate candidate mapping from approved mapping and candidate wording from published wording.

Use a do-not-say registry for compliance, certification, equivalence, assurance and causal-impact claims.

Require confidence labels and preserve conditions with the statement they qualify.

Run regression tests on known difficult scenarios and compare outputs when the model or prompt changes.

Block personal, grievance, privileged or client-confidential information from unapproved systems.

Monitor errors and near misses, and withdraw AI-generated content that cannot be verified.

NIST's voluntary AI Risk Management Framework organises risk management through Govern, Map, Measure and Manage. Its Generative AI Profile adds actions tailored to generative-AI risks, while the Playbook offers suggested implementation actions rather than a mandatory checklist. The OECD AI Principles reinforce transparency, explainability, robustness, safety and accountability. These are general governance sources; they do not change the GRI requirements or make an AI output technically correct.

A hypothetical reporting team asks a generative-AI tool to build a GRI Content Index from a draft report. The tool identifies many correct disclosure references but invents two disclosure numbers, marks several partial requirements as complete and describes a selected-emissions assurance statement as covering the report. The controlled workflow catches the errors because each entry must link to an approved source requirement, exact report location and evidence owner. The final reviewer rejects the invented identifiers, records incomplete requirements precisely and narrows the assurance wording.

Treating a high-confidence tone as evidence of correctness.

Using an uncontrolled web search when current official standards are available in the source pack.

Allowing the model to merge GRI, ESRS and IFRS requirements into a false equivalence.

Failing to preserve the exact condition or exception attached to a normative statement.

Using AI to make a reason-for-omission or legal conclusion without counsel.

Accepting automated mapping at disclosure-title level while missing sub-requirements.

Keeping no record of model, prompt, source set or human edits.

Putting restricted grievance or personal information into an unapproved environment.

Delegating final claim and publication approval to the same person who generated the draft.