may our external advisor fill in the questionnaires on our behalf

Can an adviser complete the list

Yes, that is allowed. There is no statutory article that prescribes who operates the input screen. What is requested in a questionnaire from a customer or buyer are facts about the enterprise: number of employees, ISO certification, presence of a continuity plan. Who types in those facts is not relevant for their accuracy — the person who types them in is not the person who signs for them.

What does matter: the answers always go to the customer on behalf of the enterprise, not on behalf of the accountant or adviser. In a CSRD report according to the VSME basic module of EFRAG, or in a set of control measures from Annex A of ISO/IEC 27001, there is often a statement that the information is correct. That statement belongs with the enterprise, even if a third party has entered the fields. In practical terms, this means the adviser can enter the data, but someone from the enterprise itself must confirm the answer before it goes to the customer's portal. This is also how the platform is structured: completion and confirmation are two separate steps, and the confirmation lies with the enterprise.

What does follow from a source

The same applies to the ten measures in Article 21(2) of the NIS2 Directive: the directive obliges the entity, not a specific official within or outside that entity, to implement and demonstrate measures. Who gathers the evidence — for example whether there liability insurance is in place or whether business continuity is ensured in the event of a disruption — is free to decide. The Trade Register Act 2007 also links the basic data of an enterprise to the enterprise as the registered party, not to the person who fills in a form. Where evidence is missing, the answer remains open until the enterprise has provided it itself; this does not change because an adviser is involved.