An example: the VS report is due at the end of the month. The ESG manager has an AI assistant draft the section on energy use, checks the figures and sends the draft to management. The reply comes quickly: "Are we even allowed to do that? And do we have to label it?"
The short answer: the AI Act does not prohibit AI in the sustainability report. And if a person reviews the text and someone holds responsibility for the publication, the labelling obligation for text does not apply. The long answer is in this post.
The biggest danger is not that the AI knows nothing, but that it makes wrong answers sound plausible. That is why human review pays off twice: for the content and for the law.
As of October 2026. Based on the AI Act, Regulation (EU) 2024/1689, and the amending Regulation (EU) 2026/1744, the AI Omnibus. This post is not legal advice.
Deadlines at a glance
| Since / from | What applies |
|---|---|
| 2 February 2025 | AI literacy (Art. 4) and the original prohibitions (Art. 5) |
| 2 August 2025 | Obligations for providers of general-purpose AI models, including documentation of energy use |
| 27 July 2026 | AI Omnibus in force, Art. 4 weakened |
| 2 August 2026 | Transparency obligations (Art. 50) |
| 2 December 2026 | Machine-readable marking for systems already on the market before 2 August 2026; additional prohibitions in Art. 5 |
| 2 December 2027 | Obligations for high-risk AI under Annex III |
| 2 August 2028 | Obligations for high-risk AI under Annex I; first Commission report on energy efficiency |
Myth and reality
"The AI Act prohibits AI in the sustainability report." No. Sustainability reporting is neither among the prohibited practices (Art. 5) nor among the high-risk areas (Annex III).
"Every AI text must be labelled." No. The obligation covers text published to inform the public on matters of public interest. And it does not apply after human review with editorial responsibility.
"We need an AI certificate for everyone." No. Art. 4 requires measures that support AI literacy. It does not require a certificate or a specific level.
"The AI Act tells us how much energy our AI uses." No. Model providers document energy use for the authorities. They do not have to publish it.
Am I a provider or a deployer?
The AI Act assigns obligations by role:
- Deployers use an AI system under their authority (Art. 3(4)). An ESG team that uses an AI assistant or the AI features of ESG software is a deployer.
- Providers develop an AI system or have it developed, and place it on the market or put it into service under their own name (Art. 3(3)). This includes own use (Art. 3(11)). A company that builds and uses its own AI tool internally can therefore be a provider, with more obligations.
Is AI in ESG reporting high-risk AI?
Not as such. Annex III lists the high-risk areas: biometrics, critical infrastructure, education, employment, essential private and public services (for example creditworthiness checks), law enforcement, migration, asylum and border control, and the administration of justice and democratic processes. Sustainability reporting is not one of them.
One edge case deserves attention: employment. Annex III point 4 covers AI systems intended to make decisions on promotion or termination, or to monitor and evaluate the performance and behaviour of employees. If a tool analyses social metrics for individual people and this feeds into such decisions, assess it separately.
Do ESG teams need AI training?
Yes, but in proportion. Art. 4 applies to providers and deployers since February 2025. Originally they had to ensure, "to their best extent, a sufficient level of AI literacy" of their staff.
The AI Omnibus softened this. Since July 2026, they must take measures "to support the development of AI literacy of their staff". And further: the obligation "does not require providers or deployers to guarantee any specific level of AI literacy of any individual". The Commission and the Member States must support companies in this, in particular SMEs.
So an obligation to reach a result became an obligation to take measures. In practice, this means training that fits your tools and roles, and a record of who learned what and when.
Do I have to label AI text in the sustainability report?
Not if your team reviews the text and someone holds responsibility. Art. 50 applies since 2 August 2026 and splits by role:
- Providers must make sure that people know when they interact with an AI (para. 1), and mark AI content in a machine-readable format (para. 2). For systems placed on the market before 2 August 2026, they have until 2 December 2026 for para. 2.
- Deployers must disclose deep fakes (para. 4). The same applies to AI text "published with the purpose of informing the public on matters of public interest".
The Regulation does not say whether a sustainability report falls under this text rule. What matters is the exception: the obligation does not apply if the text underwent human review or editorial control and a person holds editorial responsibility. A team that reviews AI drafts and is responsible for the report meets both conditions.
For context: infringements of Art. 50 can cost up to EUR 15 million or 3 % of worldwide annual turnover, whichever is higher (Art. 99(4)). For SMEs, the lower amount applies.
What does the AI Act say about the energy use of AI?
For ESG teams, AI is not only a tool. It is also a source of emissions in their own supply chain. What the AI Act sets out:
- Providers of general-purpose AI models, such as large language models, document the "known or estimated energy consumption of the model" since August 2025 (Art. 53(1)(a), Annex XI). The documentation goes to the AI Office and the national authorities on request, not to the public.
- Nothing is required for customers. The information that model providers must give to companies that build the model in (Annex XII) does not include energy use.
- Standards are to reduce the energy and resource use of high-risk systems and promote the energy-efficient development of large models (Art. 40(2)).
- Voluntary codes of conduct can assess and minimise the impact of AI on environmental sustainability (Art. 95(2)(b)).
- By 2 August 2028 and every four years after, the Commission assesses whether further measures are needed, including binding ones (Art. 112(6)).
The AI Omnibus did not change this. For your carbon accounting, this means: the AI Act gives you no energy data on purchased AI services. Ask your providers directly.
Checklist for ESG teams
- List your tools: Which AI tools does your team use, and for what?
- Clarify your role: For each tool, are you a deployer or a provider?
- Check edge cases: Are there uses that relate to individual employees (Annex III point 4)?
- Build literacy: Train for your tools and roles, and keep a record.
- Set the review: Who reviews AI drafts, and who is responsible for the report?
- Ask your providers: Request energy and emissions data if you need it for your carbon accounting.
AI in ESG reporting with NetCero
Want to use AI in your ESG reporting and keep control? In NetCero, AI suggestions are labelled as such and are only applied once your team confirms them. In a free demo, we show you how NetCero supports your team with the CSRD, the VS standard and carbon accounting. Book a demo
For more on AI in ESG reporting, watch the recording of our webinar "AI & ESG: What Actually Works — and What Doesn't".
