my customer has modified the questionnaire, do I have to do everything again
New questionnaire does not mean starting over
No, you usually do not need to redo everything. A customer who sends a new version of their questionnaire midway through the year almost always has two types of changes in it: questions that are literally the same but formulated differently, and a small number of genuinely new questions — often because the customer themselves falls under new regulation, such as the CSRD (Directive (EU) 2022/2464) which also generates questions for suppliers through the supply chain. The answers that come from your supply chain file — registered office address, number of employees, ISO certificates, the ten measures of Article 21 NIS2 — do not change because the format changes. The system recognizes the question again and links it to the same answer, even if the wording looks different.
What does come to you again is confirmation per answer. A modified list is treated as a new upload, and each linked answer asks for your yes or no again — even if the answer itself has not changed. This is not extra work on the file, but it is an additional control moment. For questions that are genuinely new and for which the file has no source — for example, a question about AI systems within service delivery while that topic had not yet been filled in — the system does not propose an answer. You fill that in yourself, once, and from then on it is ready for the next list as well.
Why the file remains leading, not the format
This follows from how the answer side is set up: one supply chain file with facts, to which each incoming questionnaire is linked — not a file per customer or per format. The underlying sources do not change because of a new list. The registration number under which the enterprise is registered comes from the Trade Register Act 2007 and does not change because a customer adapts their portal; an ISO 27001 certificate according to Annex A remains valid as long as the certification itself runs. Only when a question is new and has no match in the file, the source is missing — and then, according to the own rule that no answer is ever proposed without an underlying fact, nothing is filled in.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.