how often do I need to keep the file up to date

Updating is a different rhythm per section

There is no fixed update frequency for the entire chain file: each section follows the rhythm of the source behind it. Data from the Trade Register — name, legal form, registered address — change only if the enterprise itself makes changes, and then updating is primarily a check to see if the Chamber of Commerce registration has been processed. That applies for example to the establishment address of the company and for the registration number under which the enterprise is registered: these change rarely, but when they do, the file is out of date until then.

Other sections do have a natural rhythm. Turnover and number of employees usually move annually in line with the annual accounts — relevant for the company's annual turnover and for the number of employees. An ISO 27001 certificate has a validity date from the certifying body, and after a recertification or surveillance audit that is the trigger to review the Annex A measures again. The ten measures of article 21 paragraph 2 NIS2 and a VSME report have no statutory restoration date in the file itself, but are reviewed annually in practice because the underlying figures and risk assessments become outdated after a year. Anyone filling in a sustainability list for the first time under the CSRD scope should do well to link that section to the financial year for which it is reporting.

Where this rhythm comes from

None of the five sources prescribe an update period for the chain file; the Trade Register Act 2007 does require notification of changes in the statutory data, and the CSRD (Directive (EU) 2022/2464) and the VSME standard of EFRAG work with an annual reporting cycle because they align with the financial year. NIS2 (Directive (EU) 2022/2555, article 21 paragraph 2) and ISO/IEC 27001 Annex A mention no calendar period, but presume periodic evaluation of the measures as part of risk management. The chain file therefore follows per section the cycle of the source, not one overarching rule.