how long does it take before an uploaded questionnaire is filled in
Completion time depends on file status, not list length
The speed depends mainly on how complete the supply chain file already is, not on the number of questions on the list. If the basic data and common supporting documents are already there — registration number, ISO 27001 certificate, the ten measures of Article 21(2) NIS2, VSME figures — the system matches the recognised questions directly with existing answers. What remains is confirmation per answer: yes or no, no new input. With a file that has just been created the first round takes longer, simply because there are no answers yet to match.
What does slow down completion time: questions without source coverage. A question about AI use within the service or about a continuity plan only produces a proposal if a confirmed answer already exists in the file; if it does not, the field remains empty and the entrepreneur must complete it themselves before submitting to their customer's portal. This is not a system malfunction — the system deliberately does not invent an answer without a fact. Doubts about establishment data, such as the establishment address of the company or the registration number under which the enterprise is registeredare usually quickest to resolve because that data comes from the Business Register and is rarely missing.
What the matching relies on: the supply chain file, not the list itself
The basis is the single supply chain file in which answers per subject are recorded — identity and registration according to the Business Register Act 2007, cybersecurity according to the ten measures of Article 21(2) of Directive (EU) 2022/2555, sustainability figures according to the VSME basic module of EFRAG under Directive (EU) 2022/2464. The more of these subjects are already confirmed, the less needs to be supplemented with each new questionnaire; subjects that have never been completed, such as or whether the undertaking deploys AI systems within its service deliveryby definition produce an empty proposal the first time.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.