You have received a questionnaire from a customer about sustainability, cybersecurity or your business structure, and it has been sitting on your desk for a while. The question that often follows: what actually happens if you don't fill it in? The answer is that you will not face a fine or sanction from a regulator, because the questionnaire itself is not a legal obligation that rests on you. The possible consequences lie in your relationship with your customer: they may suspend the order, not renew the contract, or remove you from the supplier list.
Whether this actually happens depends on why your customer is sending the list and what has been agreed about it. Large buyers have their own obligations towards their own regulators, banks or insurers, and they pass that obligation on to their suppliers. If your answer is missing, their own process stalls, and that quickly affects the business relationship. In practice, the consequence is therefore usually a commercial consequence, not a legal consequence that is directly imposed on you.
Why customers ask this
A procurement department rarely sends a questionnaire just like that. Often there is an underlying obligation behind it, for example from sustainability legislation, rules on cybersecurity in the supply chain, or the checks that banks and insurers themselves must carry out on their customers. Your customer must be able to demonstrate that they know their own suppliers and have mapped them, and for that they need your answers. If you don't respond, your customer cannot complete their own file. That is the core reason why these kinds of questionnaires keep coming back, even if it feels like a formality.
What happens in practice
Usually it starts with a reminder: a notice, followed by a second and sometimes a third. If no response comes, this escalates within your customer's organisation to the procurement department or to the department responsible for the relevant legislation. From that point on, the business relationship may come under pressure: a new order is delayed, a framework contract is not renewed, or you are temporarily no longer treated as a preferred supplier. With a bank or insurer it works slightly differently: as part of an ongoing review of your business, an incomplete file can delay the assessment of a credit application or policy, simply because the process cannot proceed without the missing information.
It is important to make a distinction between two things that are often confused. The first is the questionnaire itself, which is a commercial tool of your customer. The second are the underlying legal obligations, such as rules on data protection, labour law or product safety, that apply to your business anyway, regardless of whether a questionnaire is sent about them. Not completing a questionnaire does not change those underlying obligations, and vice versa: a completed questionnaire is not proof that you comply with everything. For an explanation of commonly used concepts that appear in such questionnaires, such as scope 1, 2 and 3 or the ten measures of NIS2, you can consult the knowledge bank with explanations by topic.
What you can influence
The biggest risk usually does not lie in the content of the questions, but in the time it takes to answer them over and over again. The same question about your security policy or your ultimate beneficial owners comes back at almost every customer, in a different format. Whoever has to figure that out each time is more likely to miss a deadline than someone who already has the answers ready in one overview. Whether a questionnaire is relevant for your business and what it roughly involves can be shown beforehand with the recognition check of a few questions.
If you want to know how such an overview is built up in practice and where the information comes from, this is described on the page how it works. If you have doubts about a specific situation, for example about what you do and do not need to share with a customer, it is advisable to discuss this with a lawyer or with the customer concerned; we do not assess or explain anything on your behalf. Common cases of doubt are listed together in the frequently asked questions.
If you first want to see whether this applies to your business and how much time it normally takes you, then the free quick-scan is a logical starting point. In just a few minutes you will see where you stand, without having to fill in a list immediately.