who must approve the answers internally before they are submitted

Internal approval is not a requirement from the questionnaire, but it is a matter of your own risk

None of the sources behind these questionnaires — the VSME module, the CSRD directive, ISO/IEC 27001 or Article 21 of the NIS2 directive — stipulates who must sign off internally at your organization before an answer goes out. That is a choice of your own organization, not a requirement of the customer or the legislator. What the sources do establish is the content: which facts must be correct, which supporting document applies, and at what level (organization or location) an answer applies.

In practice, this means: the more sensitive the answer, the more sense a second look makes. An answer about the establishment address of the company is factual and rarely changes — there approval is mainly a matter of keeping up. An answer about the status of the ISO 9001 certificate or about the ten measures of Article 21(2) NIS2 often concerns someone who deals with it substantively — quality, IT security, compliance. With us, you therefore confirm each answer with yes or no before it is submitted; you decide who gives that confirmation, per subject.

Why this lies with your organization, not with us or your customer

We recognize questions, populate answers from the supply chain file and let you confirm each answer — after that you submit it yourself to your customer's portal. Who may give that confirmation internally is not stated in any of the sources: not in the Trade Register Act, not in the VSME module, not in the CSRD directive or the NIS2 directive. This means that an internal approval rule — for example: financial answers by the controller, technical answers by IT — is an agreement you establish yourself, separate from what a customer asks for in his portal.