why does the insurer need my number of employees
Number of employees is a risk and premium variable, not a CSRD question
The insurer asks for the number of employees because this is a direct indicator of the risk they are insuring. For liability insurance or a cyber policy, the size of the workforce helps determine the extent of exposure: more employees means more actions, more access to systems, greater chance of an error or incident. This is separate from sustainability reporting — it is an underwriting and premium question, not a CSRD or VSME question, even if the figure resembles what you enter there as well.
Origin and evidence are straightforward here: the number of employees is a factual figure that you determine yourself, not something that is attested by a third party. Insurers sometimes ask for a reference date or an average over the year; if the policy questionnaire does not specify that, the standard answer is the current number at the time of completion. If you are unsure whether the insurer means FTEs or headcount, the answer is usually acceptable as long as you state in the explanation which counting method you are using — this prevents disputes later when making a claim. For the underlying composition of this figure in your chain file, see how many employees does the company have.
Where this is separate from statutory reporting obligations
The number of employees has no separate statutory basis like, for example, the trade register number, which follows directly from the Trade Register Act 2007. The figure does appear in several contexts with different counting rules: the EFRAG VSME basic module for SME reporting, the ten measures of Article 21(2) of the NIS2 Directive (where company size determines whether the directive applies), and now also the insurance questionnaire. It is therefore advisable to check per questionnaire which counting method is requested, even if the figure itself remains the same. Insurers often combine the number of employees with other risk indicators, such as whether the company is ISO 9001-certified, in order to obtain a more complete risk picture.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.