can multiple locations of our company use the same file

One file is possible, but not automatically for everything

Yes, multiple locations can work with one file, but it depends on what the question is specifically asking: the legal entity or the location. Many questionnaires ask about the enterprise as a whole — then one file at the level of the legal entity is sufficient, with the answer to in which countries the enterprise has establishmentscontained in it. Other questions are specifically location-bound: the location address, local certification, or a local continuity plan. You cannot cover those with one central answer without explanation.

The bottleneck usually lies with three categories of questions. First, identity questions such as the establishment address of the company — here you must indicate whether the client means the head office or the supplying location. Second, ISO certification: an ISO 9001 certificate can be held by one location or by the entire organization, and that difference is reflected in the answer to whether the undertaking is ISO 9001-certified. Third, the NIS2 measures: if locations manage separate networks and systems, one location may comply with the ten measures of Article 21(2) and another may not. One shared file then only works if you specify per location which part of the answer applies.

Where the legal entity-location distinction comes from

The Trade Register Act 2007 registers enterprise and location as separate data: a legal entity can have multiple locations, each with its own location number and address. That separation is the reason why a file at legal entity level does not automatically apply to a question that specifically concerns one location. For NIS2, the location sensitivity follows from Article 21(2) of Directive (EU) 2022/2555: the ten measures apply to the network and information system that provides the service, and that can differ per location. For ISO 27001, the scope of the Annex A certificate is decisive: whether it applies to one site or the entire organization is stated on the certificate itself.