The customer asks to upload a certificate or attachment, is that possible

An attachment is a separate file, not a completed answer

Yes, that's possible: in addition to text fields, the system also recognizes questions where the customer requests a separate file, such as an ISO 27001 certificate, an insurer's declaration or an organizational chart. This works differently than a text answer. For a text question, the system retrieves a value from the supply chain file and prepares it. For an attachment question, the system searches whether a file of the correct type exists in the file and links it. If the certificate is not there ISO 9001 the field remains open — a placeholder or old file is never suggested if it is not certain to be the correct one.

Recognition of the document type is based on instructions in the question itself, not on what it contains: if the list asks for "proof of ISO/IEC 27001 certification", the system searches for a file labeled as such in the file, not for a PDF that happens to contain the word ISO. The same principle applies to a question about a continuity plan: the system matches on the labeled document about continuity of operations in the event of a serious disruption, not on textual similarity. If the label is missing, nothing is automatically linked and the system reports that no attachment was found — the customer then decides for himself whether to upload something or leave the field open toward his customer's portal.

Where this difference comes from

This distinction does not follow from a standard, but from how those standards themselves work: Annex A of ISO/IEC 27001 describes control measures that must be demonstrable, and that "demonstrable" is in practice often a certificate or audit statement, not free text. The same applies to the ten measures of Article 21(2) of Directive (EU) 2022/2555 (NIS2): a customer can ask for a description, but also for the underlying piece of evidence itself. The system aligns with this by recognizing per question whether text or a file is being requested, and this determines whether a value or a document link is prepared.