how do I ensure that the chain file contains current information

Timeliness is arranged differently per data source

The supply chain file remains current if each answer has its own expiration date, instead of one general "last updated" date for the entire file. Data from the business register — the statutory name, the registration number and the business address — change rarely, so you verify those during a Chamber of Commerce update. Figures such as number of employees and annual turnover belong to a fiscal year and thus shift annually. An ISO 27001 certificate has a validity period stated on the certificate itself; the ten measures of article 21(2) of the NIS2 Directive have no fixed expiration date, but are in practice assessed periodically because threats and systems change.

For VSME indicators, a reporting year often applies: the answer you enter now belongs to the last completed year and will be replaced after year-end closing. As long as you keep the supporting document and its date for each answer, you can see at a glance with any new questionnaire which answer has expired and which is still valid — without having to look up everything again. This also prevents you from accidentally resending an old certificate or a revenue figure from two years ago.

Where the source data and reporting cycles come from

This classification follows the nature of the source: the Trade Register Act 2007 requires businesses to report changes in basic data, which makes those data relatively stable between updates. The EFRAG VSME standard works with a basic module set up for annual reporting, in line with the reporting cycle under Directive (EU) 2022/2464. ISO/IEC 27001 provides for certification with a validity period set per certificate in Annex A. Article 21(2) of Directive (EU) 2022/2555 mentions the ten measures themselves, but does not prescribe a fixed reassessment period — the update frequency is therefore a matter of reasonable timeliness, not a legal deadline.