customer asks for supporting documents for each answer in the questionnaire what do I send

Evidence is usually a document you already have, not a new one

For most questions, you can submit an existing document instead of creating something new. For identity questions, this is a extract from the business register; for a certification question, the certificate itself, with scope and validity date; for a NIS2 question about the ten measures of Article 21(2), often a policy document, a risk analysis or the latest pentest report. For sustainability questions that rely on the VSME basic module, the evidence is usually the underlying calculation or the policy document from which the figure comes — not the answer itself, but what lies behind it.

The difficult point is when you don't have the requested evidence document, for example an ISO 27001 certificate while you have implemented the associated Annex A measures but are not having them certified. Then answer factually: name what you do have (the policy, the measure, the implementation date) and what you don't have (the certificate as a formal document). A customer can work with that; a guessed "yes" with a certificate that doesn't exist causes more damage in a later audit than an honest "no, but the underlying measure is in place". Also ask yourself whether the requested evidence is even applicable — or whether the undertaking deploys AI systems within its service delivery is for example a question where "not applicable" is just as valid an answer as evidence, if that is factually correct.

Where the evidence requirement comes from

For the ten measures from Article 21(2) of the NIS2 Directive, evidence of implementation is functionally expected, even though the Directive itself does not prescribe a fixed form of evidence. ISO/IEC 27001 Annex A works the other way around: the control measures are only evidence if they are included in a certified management system, which is why a certificate without scope statement says little. For identity data, the basis lies in the Trade Register Act 2007, which establishes which data of a business are registered — also see the establishment address of the company, which comes directly from that register. For sustainability figures, the VSME basic module by EFRAG is the voluntary standard that SMEs are often referred to when they do not fall under the full CSRD reporting obligation of Directive (EU) 2022/2464.