Does the undertaking use AI systems in its service delivery?

Does the undertaking deploy AI systems in its service provision

This question usually comes from a sustainability questionnaire and is not about AI risks as such, but about whether AI use has implications for the information the undertaking already reports on. There is no separate answer "yes, we use AI" that stands alone: what is relevant is whether that use affects matters such as data quality, customer information, working conditions or governance processes that already fall within the reporting scope.

Concrete evidence usually does not exist as a standalone document. What typically does exist: an internal note on AI use, a processing agreement with a software supplier, or a passage in the risk policy. If that does not exist, "no" or "not applicable" is a realistic answer — provided it matches the actual situation. This question is often linked to other parts of the supply chain file, such as whether the undertaking has a plan to continue operations in the event of a serious disruption, because AI dependency is sometimes included as a business continuity risk. The question in which sector the undertaking operates also plays a role: in some sectors, AI use is requested more explicitly than in others.

Where this follows from the CSRD reporting obligation

The CSRD itself, Directive (EU) 2022/2464, does not mention AI as a separate reporting topic. However, the directive does require reporting on "impacts, risks and opportunities" in the areas of environment, social matters and governance, through the reporting standards associated with the directive. A question about AI deployment in a customer questionnaire is typically a specification of that broader governance or risk section, and not a standalone CSRD requirement. This means that the answer depends on how the customer has framed this question in their own format, not on a fixed legal definition of "AI deployment" that appears in the directive itself.