can multiple colleagues fill in the chain file together
Multiple contributors per file is standard practice
Yes, multiple colleagues can work on the same supply chain file together. This makes sense: the questions in a CSRD list, a NIS2 questionnaire or an insurer format rarely concern a single function. Who provides the answer to the question about the number of employees is usually in HR or finance, while the ten measures of Article 21(2) of the NIS2 Directive tend to fall under IT or a security officer. One file, different data owners per section — that is the starting point, not the exception.
In practice, this works by dividing the file into sections: identity and registration, size and locations, certification, continuity, cybersecurity, sustainability. Each colleague completes their own section and confirms with yes or no as soon as the system proposes an answer from a previously completed source. This way, no one needs to understand the entire file to maintain a specific part — the person who knows whether the company is ISO 9001 certified, is not necessarily the same person who knows the registered address or the countries where it operates. Who exactly manages which section is a choice for the company itself; the platform does not enforce any role distribution.
What follows from the nature of the requested data
This does not follow from a single article, but from the structure of the standards themselves. The EFRAG VSME basic module and Directive (EU) 2022/2464 (CSRD) request data that typically spreads across finance, HR and operations. Annex A of ISO/IEC 27001 and Article 21(2) of the NIS2 Directive request technical control measures that usually fall under IT managers. None of these sources specify who within an organisation may provide the answer — that is an internal matter. The file follows that practice: it is organised by subject, not by sender, so multiple colleagues can contribute at the same time without overwriting each other's work.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
This is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.