do I have to submit the completed list myself to my customer's portal
Yes, submission remains with you
The platform completes the questionnaire, but does not submit anything to a third party's portal. You download the completed list, verify the answers question by question with yes or no, and log in yourself to your customer's portal to upload or re-enter. That applies to every list, of every type: a CSRD questionnaire based on the VSME basic module, a NIS2 request on the ten measures of Article 21(2), or an ISO 27001 question on a specific Annex A measure.
This is not a temporary limitation but the platform's starting point: there is never a login to a third party's system, and no list is automatically sent. The reason is simple: each customer's portal has its own login method, its own authorization and often its own employee responsible for submission. That cannot be automated without you losing control over your own answers. What does go faster: you only need to verify the basic data once. Questions about the establishment address of the company or the number of employees appear in almost every list, and they are ready as soon as the supply chain file is complete.
Where this follows from: division of roles in the text
This division of roles does not follow from a legal article but from how the platform is set up: the system recognizes questions and completes answers from one file, the entrepreneur verifies, and submission to the customer's portal is and remains an action by the entrepreneur themselves. For the content of the answers, external sources apply — for example, a question on information security often falls back on the control measures in Annex A of ISO/IEC 27001, and a sustainability question on the VSME basic module of EFRAG under Directive (EU) 2022/2464. If you doubt whether a document is still current, for example on a question about the company's registration number, you verify that against your own entry in the business register according to the Commercial Register Act 2007, not against what the platform had already filled in.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.