How does the system know this is the same question as with another customer
One supply chain question, multiple formulations per portal
The system matches on the underlying question, not on the text of the portal. "Describe your ISMS" and "do you have an information security policy compliant with ISO 27001" are the same question for the system, because both refer back to the same control objective from Annex A of ISO/IEC 27001. The same applies to the ten measures of Article 21(2) of the NIS2 Directive (Directive (EU) 2022/2555): a customer portal asking for "incident response plan" and another asking for "procedures for cyber incidents" point to the same measure from that list. The system recognizes the question by its meaning, not by the word.
That matching works differently per subject, because the sources are structured differently. For sustainability, the anchor point is the basic module of EFRAG VSME, the voluntary standard to which many procurement questionnaires refer without stating it themselves — even a question that only mentions "scope 1 and 2 emissions" is recognized as part of that module. For identity and business data, the anchor point is the fixed structure of the business register: a portal asking for "company registration number" or "KvK-nummer" is the same question as a portal asking for "legal entity identifier based on the Business Register Act". Where no fixed standard exists — for example, a question about business continuity planning that is formulated differently by each bank — the system recognizes the question by the pattern of previous answers you have confirmed to similar formulations.
Recognition follows the standard, not the portal
Where a European or international standard is established — the basic module of EFRAG VSME under Directive (EU) 2022/2464, Annex A of ISO/IEC 27001, or the ten measures of Article 21(2) of Directive (EU) 2022/2555 — recognition is most stable there, because portals almost always refer to those same underlying points, even with their own words. Where that is lacking, the system builds on consistency in previous answers; you confirm yourself per question with yes or no whether the linked formulation is correct.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.