what do I fill in if a question on the list does not apply to me

N.a. is only correct if the question truly does not fit.

"N.a." you only enter if the question concerns something that does not structurally occur in your enterprise — not if you do not know the answer or do not have the evidence at hand. That distinction matters, because a defending procurement team or an auditor reads "n.a." as a deliberate exclusion, and you must be able to explain it. A question about AI systems is for example truly n.a. if your enterprise does not use them — but note: does the enterprise use AI systems in its service provision? is interpreted broadly; an externally sourced tool with an AI component often falls under it. In case of doubt, "no, not applicable within the requested scope" is more precise than a bare "n.a.".

Borderline cases arise especially with questions that come from a larger framework and do not fit one-to-one on SME scale. The VSME-Basic Module of EFRAG is itself clear on this: some indicators are only relevant if the enterprise performs a certain activity or has a certain size. Then rather enter a brief reason — "enterprise has no own fleet", "activity X is not performed" — than only the label. The same applies to questions that come from the ten measures of Article 21 paragraph 2 of the NIS2 Directive: if a measure concerns supply chain security and you have no external ICT suppliers with access to your systems, that is a substantiated n.a., not a missing answer.

Where this distinction appears in the sources

The VSME-Basic Module explicitly distinguishes between mandatory and conditional indicators: a conditional indicator is precisely the category where "n.a." fits, provided the condition for applicability is absent. Under ISO/IEC 27001 that principle is formalized in Annex A control measures: a measure that is not applicable must be substantiated in the Statement of Applicability with a reason, not merely be ticked off. That same obligation to substantiate also applies pragmatically to identity questions — if a question about establishments in multiple countries does not fit, that can be traced back to in which countries does the enterprise have establishments? and a brief explanation of the factual situation suffices.