Who within our company may amend the file

Who controls access to the file

Who may update the supply chain file is determined by the company itself: this is a choice in the account settings, not a statutory role. In practice, it works as with any shared business system: you appoint one or more administrators, and those administrators determine who else may edit or only view. There is no fixed function that must do this — at one company it is the quality manager, at another the controller or the owner themselves.

Where this becomes practical is with the source data. Some fields are close to the statutory registration, such as the statutory name and the registration number: these only change if the registration in the Business Register changes, and it is prudent that the person who maintains it — often the same person who also manages the KVK registration — also updates those fields in the file. Other fields, such as answers about information security or continuity, belong more to those who are substantively responsible for that subject. The file itself thus does not impose a role; it follows the role distribution that already exists in the company.

Why this is not a statutory role

None of the source documents relevant to the supply chain file — the Trade Register Act 2007, the EFRAG VSME standard, Directive (EU) 2022/2464 (CSRD), ISO/IEC 27001 or Article 21(2) of Directive (EU) 2022/2555 (NIS2) — prescribe which official within a company may enter or modify data. These regulations describe what a company must record or report, not who may do so administratively. Only ISO/IEC 27001, Annex A, touches on the subject indirectly: those control measures concern access management as such — thus the principle that access to systems must be limited and assigned — but even there no specific function is named. The assignment of rights in the file is therefore an internal arrangement, comparable to how a company regulates access to its accounting software or CRM.