Who must upload the questionnaire from our customer

Whoever presses the button is an internal process

Supplia does not determine who uploads and submits the questionnaire — that is a choice the company itself makes, just as it does for who signs the annual accounts or who maintains the business register. In practice, this is usually whoever already has most of the answers at hand: for a cybersecurity questionnaire often someone with an IT or compliance background, for a sustainability questionnaire often the quality or sustainability officer, and for a questionnaire from insurers or banks often finance. Supplia fills in the answers from the supply chain file, but the confirmation per answer — yes or no — and the submission to the customer's portal remain an action by the company itself.

What is relevant to the question "who", however, is which part of the file the questionnaire touches. A questionnaire that mainly asks about the registration number and the registered address can usually be quickly confirmed by whoever has access to the file, without needing a specialist. A questionnaire that goes into the ten measures of Article 21(2) of the NIS2 Directive, or into the Annex A control measures of ISO/IEC 27001, sooner calls for someone who can assess those answers before clicking "yes". The system recognizes the questions and proposes the answer; the substantive check remains human work.

Why this is outside the scope of Supplia

Supplia does not explain, certify or assess anything, and never logs in to a third party's portal — submission to the customer's portal is and remains an action by the company itself, performed by whoever the company designates for this purpose. This does not follow from one specific statutory article, but from the nature of the platform: there is no kite mark or approval from Supplia, so there is also no role for Supplia in who internally is responsible for submission. However, it can be practical to determine in advance who confirms which part — for example who checks the data on the number of employees and who assesses the questions on AI use — so that not every questionnaire entails new investigation work.