does a director have to approve the questionnaire before it is submitted

Signing authority is a different matter from submission

No, it is not legally required. Who is authorized to represent the company — the board, a procuratist, or someone else with signing authority — is registered in the Commercial Register. However, none of the sources applicable to sustainability, cybersecurity, or insurance questionnaires (VSME, CSRD, ISO 27001, NIS2) prescribe who may submit a questionnaire to a customer. That is not a legal question but an internal arrangement.

In practice, the company handles this itself, through internal authorization or a signing mandate. For a cybersecurity questionnaire, substantive responsibility often lies with the CISO or IT manager; for a sustainability questionnaire, with whoever prepares the VSME or CSRD report. Who ultimately clicks "submit" is a process arrangement, not a reporting obligation. Note: this system does not submit anything to the customer's portal itself — the customer confirms each answer and submits themselves, so the internal approval required beforehand remains a matter for the company itself.

What is certain: who is authorized according to the Commercial Register

What is certain is under which registration number the company is registered and who is registered there as an authorized representative — that follows from the Trade Register Act 2007. That registration is the only hard, verifiable fact in this matter; who may actually check off or submit a questionnaire is not regulated in it and is therefore an internal matter. Some customer portals do ask for the name and role of the signatory in the questionnaire themselves; that is then a question from the customer, not a requirement from the underlying regulations. In case of doubt about who within your own organization should sign off, it helps to look at who also the statutory name and other basic information on behalf of the company — often that is the same official.