do I need to fill in this sustainability questionnaire completely again each year

Completing it again each year is usually not necessary

What changes must be updated; what remains the same only needs to be confirmed. That is the practical difference from "completing it entirely from scratch." Most fields in a sustainability questionnaire — legal form, number of employees, turnover, locations — do not change or change only slightly from year to year. If the answer in your supply chain file is still correct, confirming with yes is sufficient. Only where the situation has genuinely changed, or where the customer requests different evidence this year, do you need to review it again.

The distinction you must make yourself is: is it a basic fact or a periodic return. Basic facts such as the establishment address of the company or the number of employees are fixed until something genuinely changes. Periodic returns — such as scope 1/2/3 emissions, or the number of incidents in the past financial year — by definition belong to one period and must be submitted each year with new figures, even if the method remains unchanged. Do not confuse the two: presenting an old emissions figure as a current answer is not time-saving, it is an incorrect answer.

Why some fields are fixed and others are not

This follows from the nature of the requested data, not from a choice by the customer. Identity and structure data correspond to what is recorded in the Business Register (Business Register Act 2007) and change only upon an actual change, such as a new location or address change. Sustainability figures according to the VSME baseline module of EFRAG, drawn up under Directive (EU) 2022/2464, are by definition period-bound: an emissions figure for 2023 is not a valid answer to a question about 2024. For information security, the situation is more nuanced: the ten measures of Article 21(2) of Directive (EU) 2022/2555 and the control measures in Annex A of ISO/IEC 27001 describe a structural policy that only changes with an amendment to that policy — for example regarding the use of AI systems or is a business continuity plan. There too, the rule applies: confirmation is possible as long as the underlying policy has not changed.