We have already submitted but the answer has since changed, what now
Submitted answer remains as is, only the source in the file changes
An answer that has already been received by the customer does not change automatically. The customer's portal has the version that applied at the time of submission. What you now update in the supply chain file — for example, a new number of employees following a merger, or an ISO certificate that has just expired — only applies to future lists, not to the list that has already been submitted and confirmed.
Whether that is a problem depends on what has changed and how the customer deals with changes. For factual basic data that recurs frequently, such as the number of employees or the countries in which the company has establishments, some customers ask for a correction as soon as something materially deviates from what was stated. For a certificate that has expired or has just been renewed, such as ISO 9001is more sensitive: the validity date may have been correct at the time of submission, and will only be checked again in the next round. This is an agreement between the entrepreneur and his customer, not something the system arranges for you.
No source that retroactively adjusts the submitted answer
There is no legal or technical rule that automatically corrects an already submitted answer. The Trade Register Act 2007 does require keeping the basic data in the trade register itself up to date, but that is a different register from an individual customer's portal — a change there does not automatically take effect in a questionnaire that has already been answered. The same applies to voluntary reporting frameworks such as the EFRAG VSME standard: it describes what an answer must contain at the time of reporting, not what should happen if the situation changes afterwards. Anyone wanting to know whether a correction is necessary or possible afterwards will not find the answer in a standard, but in their own agreements with that customer or in the conditions of the portal where the submission was made.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.