who must confirm the answers with us before submission

Who signs internally is separate from what Supplia does

The customer decides that themselves; there is no statutory role requirement that says the director, the KAM coordinator or the compliance officer must sign. Supplia fills in the answer from the supply chain file and displays it per question, but the confirmation — the click on "yes, this is correct" — always comes from someone on the customer's side. We do not log in to the recipient's portal and do not submit anything on behalf of the company; who does that internally and who has authority to sign for it is an internal arrangement, not something that follows from a standard or guideline.

In practice, the choice is linked to the subject of the questionnaire. For a NIS2 questionnaire on the ten measures of Article 21 paragraph 2, the substantive knowledge often lies with whoever ISO/IEC 27001 policy manages; for a CSRD or VSME questionnaire, that often lies with whoever supplies the figures on employees and turnover. Who ultimately signs — often still the management, because they represent the company externally — is determined by the customer themselves, regardless of who has substantively reviewed the answers.

Where this is and is not required by a standard

None of the sources provided prescribe an internal approval role. The Dutch Trade Register Act 2007 lays down which data of a company are registered — think of the registered name and the registration number — but says nothing about who may tick off customer questionnaires. Directive (EU) 2022/2555 (NIS2), Article 21 paragraph 2, obliges organizations to implement the ten mentioned control measures, but leaves the internal division of responsibilities to the organization itself. The EFRAG VSME standard and ISO/IEC 27001 Annex A likewise describe what must be demonstrated, not who within the company must confirm it. That choice is therefore always internal policy, not an obligation from any of these sources.