who in our company must approve the answers before we submit

Whoever signs determines this themselves within the company, not the system

Our system only proposes answers from the supply chain file; confirming each answer is a choice of the client, and we do not prescribe who must do this internally. At one company, the quality manager checks the box for an ISO question and the CISO signs off on an information security question; at a smaller company, one person does everything. What your client asks about rarely concerns just one domain: a questionnaire often mixes factual business data with substantive assessments, and that does not always require the same confirmer.

The distinction that is relevant: for a fact such as the registration number under which the enterprise is registered confirming is primarily about verifying that the file is correct. For a question that refers back to the ten measures of Article 21(2) of the NIS2 Directive, or to the control measures in Annex A of ISO/IEC 27001, the person who signs is actually confirming that the underlying measure has also been taken — that is a different responsibility than retyping an address. Which internal mandate applies is something the company arranges itself; the system only records who confirmed which answer at what time.

Where this distinction between proposing and confirming comes from

The fact that we propose and the client confirms follows from the principle that no assessment, score or approval takes place with us: every answer that reaches the client's portal has been approved by the client themselves. For questions that come from the EFRAG VSME basic module — such as those around employee numbers or locations — the source data is often already established in the supply chain file, for example at the number of employees of the undertaking or the countries in which the company has establishments; confirming there means primarily verifying that the file is current. For questions that relate to obligations under the CSRD Directive (2022/2464) or to the NIS2 measures, the confirmation is substantively more significant, and that is precisely why the platform does not prescribe a role: that assessment belongs with the company, not with the tool that proposes the answer.