What does supplia actually not do, where does your role end

Four things outside our scope

Supplia fills in questionnaires for you from a single supply chain file, but does not assess anything in it. Specifically: no certification, no score and no badge. If a customer asks whether the company is ISO 9001-certified, the system recognizes the question and retrieves the answer from the file — is the company ISO 9001-certified? is then a fact that you have provided yourself, not something that Supplia verifies or approves. The same applies to the ten measures of Article 21(2) of the NIS2 Directive or the control measures in Annex A of ISO/IEC 27001: the system matches the question with an answer from your file, but does not verify whether those measures are actually in place.

Furthermore, Supplia never logs into your customer's portal and never submits anything. You upload the list, the system provides the pre-filled responses, and you confirm each answer with yes or no before submitting it yourself. No one at Supplia reads through the list — the confirmation and submission remain with you. This also means that Supplia does not make a statement on your behalf about what is or is not shared in response to a sensitive question, for example about in which countries the enterprise has establishments or about internal continuity plans. For that purpose, there is a confidentiality button in the response file itself, but the decision about what you share remains with you.

What this is based on: the source model per subject

This boundary follows from how the supply chain file is structured: each fact is linked to a source — the Business Register for identity and size, the EFRAG VSME basic module or Directive (EU) 2022/2464 (CSRD) for sustainability data, ISO/IEC 27001 or Directive (EU) 2022/2555 (NIS2) for information security. Supplia matches a question from a portal with the corresponding fact from that source and proposes an answer. Without a fact linked to a source, the system does not propose a "yes"; the factual accuracy and the decision to submit lie with the company itself, as does the question of whether the company uses AI systems in its service provision — that too is a fact that you confirm, not something that Supplia determines.