why do I have to keep filling in the same questions for different customers

Same fields, different packaging

This is because most questions do not come from that customer, but from a common source: a law, a standard or a standard form that each customer more or less adopts. Questions about the number of employees, turnover, countries of establishment or an ISO certificate come back because this information is already required or standardized elsewhere — not because each customer has separately decided they want to know it. A basic module like the VSME from EFRAG is even made precisely for this: one fixed set of fields that multiple customers can adopt, so that an SME supplier does not have to invent a new questionnaire for each customer.

The difference between portals is often in the packaging, not the content. One customer asks "what is your head office", another "where is your registered office" — two phrasings for the establishment address of the company. The same applies to continuity: one list calls it "business continuity plan", another "emergency plan for outage", but it is about a plan to continue business operations in the event of a serious disruption. Anyone who recognizes the underlying question does not have to repeatedly figure out what exactly is meant.

Three sources that work through everywhere

Three regulations explain most of the overlap. The Trade Register Act 2007 establishes which basic data of every business are registered — name, number, address, sector — and those fields therefore appear in almost every portal. Directive (EU) 2022/2464, the CSRD, requires reporting on sustainability for an increasingly large group of companies, and this obligation extends to their suppliers, who are presented with the VSME basic module from EFRAG as a simplified alternative. And Article 21(2) of Directive (EU) 2022/2555, the NIS2, names ten specific security measures that organizations in designated sectors must take — the same ten that regularly appear in cybersecurity questionnaires, often recognizable by the structure of ISO/IEC 27001 Annex A, which provides practical alignment with it.