how often do I need to update my data and answers to stay current

Timeliness varies by field, not by file

There is no fixed calendar that applies to all fields in the supply chain file: the update frequency depends on what the field represents and which supporting document it is based on. Basic data from the Commercial Register — the statutory name, the registration number, the registered address — change rarely and only need to be updated if the registration itself changes. Fields that come from a certificate or audit, such as ISO 9001 or the control measures of ISO/IEC 27001 Annex A, follow the validity period of that certificate: as soon as the certificate expires or is reviewed, the answer is outdated, not before.

For figures such as number of employees and annual turnover the logic is different: these are linked to a financial year, and are therefore replaced annually once the annual figures are established — refreshing earlier makes no sense because there is no new fact yet. For sustainability fields under the VSME basic module, the same principle applies: the module is designed as annual reporting, so the underlying data refresh follows that cycle. The file itself does not enforce a deadline; it displays for each answer the date of the underlying supporting document, so that the entrepreneur can see for themselves which answer needs a new version before confirming.

The review date follows from the source, not from a fixed rule

This logic does not follow from a single article prescribing "once per year", but from the nature of the underlying regulations: the Commercial Register Act 2007 requires notification of factual changes, not a periodic review period; the VSME basic module of EFRAG and the CSRD (Directive (EU) 2022/2464) are built around the financial year; and a certificate under ISO/IEC 27001 has a fixed validity period determined by the issuing certification body. Those reporting under the NIS2 Directive on the ten measures of Article 21(2) work with supporting documents linked to their own security cycle, not to an external calendar date.