who is responsible for filling in the security questionnaire

Role assignment is not itself a regulatory requirement, but verifying the answer is

The questionnaire itself does not prescribe who completes it; Article 21(2) NIS2 and Annex A of ISO/IEC 27001 address the measures an organisation takes, not the official who signs the form. In practice, it is usually the person who knows the information security policy: a security officer, IT manager, or, in smaller companies, the director themselves. With an ISO 27001 certificate, a responsible person is often already designated in the management system — that name is then the logical point of contact for this questionnaire.

What is clear: the answers must be based on something. If a question concerns access control, someone must be able to point to which policy or measure underpins it — not filled in from memory, but read from a file. That makes it less a question of "who may complete this" and more of "who has the underlying facts at hand". That same person is often also the one who can assess whether the company uses AI systems in its service provision, because it relates to the same technical inventory. If there is doubt about who internally owns an answer, it is often the same person who also business continuity plan in the event of a serious disruption manages — the two subjects overlap in their source material.

Where this follows from: Article 21(2) and Annex A

Article 21(2) NIS2 lists ten categories of measures, including risk management, incident handling and access policy — the directive governs the content of those measures, not who reports them internally. ISO/IEC 27001 Annex A elaborates this into concrete control measures, and organisations that are certified typically already have a responsible person designated in their management system. That existing role assignment is the most obvious source to fall back on when completing a security questionnaire.