who in my company should fill in the customer's sustainability questionnaire
The practice: no statutory function, but a factual source
There is no law that prescribes who completes a customer's sustainability questionnaire. This is different from, for example, the ten measures of Article 21(2) of the NIS2 Directive, where directors have their own responsibility. With a sustainability questionnaire — whether it stands alone or builds on the basic module of the EFRAG VSME standard — the customer decides for themselves how to distribute the process internally. In practice, it falls to those who already manage the data: HR for employee numbers, finance for revenue figures, facilities for energy consumption, and sometimes a quality manager for certificates and policies.
What more often causes confusion is not who presses the button, but who provides the underlying facts. Someone who how many employees the undertaking has must complete it has different source data than someone who must indicate whether the company uses AI systems in its service provision. That is precisely why a supply chain file has an owner per subject: not one person fills everything in, but each answer to each question comes from the person who knows the fact. The questionnaire itself is then formally submitted by one account, usually the person who manages the customer's portal — but the content comes from multiple places in the company.
Where this follows from: CSRD requires reporting, not a function
Directive (EU) 2022/2464, the CSRD, requires certain large undertakings to report on sustainability, but does not regulate who at a supplier completes the questionnaire that results from it. The EFRAG VSME basic module, intended for non-listed SMEs that receive such questions as suppliers, describes which data are requested — not who collects them internally. How to organize this is therefore a choice for the entrepreneur themselves, just as they determine internally who knows which business address or which sector is current.
What this is based on
- Trade Register Act 2007 — the data recorded for each company
- EFRAG VSME — the voluntary standard for non-listed SMEs, basic module
- Directive (EU) 2022/2464 (CSRD)
- ISO/IEC 27001 — Annex A, the control measures
- Directive (EU) 2022/2555 (NIS2), Article 21(2) — the ten measures
The regulation itself is on EUR-Lex. We refer for each claim; you do not have to take our word for it.
What you concretely need to do
The implementation of each obligation, with the deadlines involved and the templates for recording it, is included in the subscription.
View the subscription First the free quick-scanThis is not legal advice. This page provides general information on the regulations this platform covers. We do not know your situation. If in doubt about your own case, consult a lawyer or the competent supervisory authority.
Written with AI based on the sources above, checked by a human on 2026-09-05. Is something incorrect? Let us know — corrections receive priority.