who is allowed to approve the answers here before they are sent
Confirming is an internal authority, not a system role
Who within the company may confirm an answer is not something Supplia determines or checks. The system recognizes questions, fills them from the supply chain file and sets each answer ready with the status "yet to be confirmed". Who may press that button is an internal arrangement within the enterprise — comparable to who may sign an offer or enter into a contract. Supplia imposes no rule on this and does not check whether the person confirming is authorized to do so.
In practice, this authority usually lies with whoever can substantively assess the answer: the quality manager for a question on ISO 9001, the IT responsible person for a question on the ten measures of Article 21(2) of the NIS2 Directive, the finance department for a question on annual turnover. For factual data such as the registration number under which the enterprise is registered or the countries where the company has establishments confirmation often lies with one central point of contact, because those data recur throughout the list. Who arranges this internally — one administrator, multiple approvers per subject — is up to the enterprise itself.
No approval, certification or logging on our part
Supplia does not confirm, assess or certify anything: there is no kite mark, no score and no approval from the platform itself. Each answer remains "yet to be determined" until someone within the company confirms it with yes or no; only then does the customer file it themselves with the portal of their own customer. This follows from how the process is structured: the system recognizes and fills, the human confirms, the enterprise files. There is therefore no article or standard — not the VSME basic module, not the CSRD Directive, not ISO/IEC 27001 — that prescribes who within a company may give that confirmation. This is and remains an internal matter.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.