I have five questionnaires in, can I get them all done at once
Yes, that's the whole point of one supply chain file
Filling out five questionnaires at the same time is exactly what the system is designed for. Each list is recognized separately, but they all draw from the same source: the supply chain file with answers that have already been recorded. Information on identity and company data — the registration number under which the enterprise is registered or the sector in which the enterprise operates — appear in almost identical form across a sustainability list, a cybersecurity list, and a bank questionnaire. The system fills them in parallel, not sequentially.
What does not proceed in parallel is the confirmation. Each list gets its own process: yes or no for each answer, and only then submit to the portal of that specific customer. This is intentional — a cybersecurity list asking about the status of ISO/IEC 27001 measures from Annex A has a different reader and a different purpose than a sustainability list according to the VSME baseline module of EFRAG. Having five lists presented at once saves the research work, but not the five separate confirmations. With overlapping questions — for example on the number of employees — you will often see the same answer come back multiple times, each time in the format of that one customer.
Why the source is recorded once, not five times
That the underlying data is maintained once and that each portal keeps its own format and submission obligation does not follow from one article but from the nature of the sources themselves: data from the Trade Register is recorded once, a CSRD report according to Directive (EU) 2022/2464 has its own scope, and the ten measures of Article 21(2) of the NIS2 Directive are assessed by a different portal than an insurer questionnaire. The supply chain file bundles those facts; each questionnaire remains a separate, independently submitted document.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.