When a vendor questionnaire asks about certification: what to do first
The direct answer
Stop before you answer. First identify exactly which certification the questionnaire names, then check your own file for that certificate: issuing body, scope, and expiry date. Do not answer from memory or from a marketing page. A wrong answer here becomes a contractual representation, not a formality, and it is read that way later.
Legal basis
Two EU acts explain why this question exists. Directive (EU) 2022/2555 (NIS2) pushes organisations within its scope to check the cybersecurity posture of their suppliers, which is why security certification turns up in due-diligence packs. Regulation (EU) 2024/1689 (AI Act), in force from 2 August 2026, adds a separate driver where the product itself is an AI system: conformity marking, not a general security badge, is the relevant proof there. Neither act names a specific commercial certificate such as ISO 27001; both explain why a counterparty is asking at all.
| What the questionnaire is really asking | Legal driver, if any | What determines the answer |
|---|---|---|
| Security or cybersecurity posture certification | Directive (EU) 2022/2555 (NIS2) | Whether your organisation or the counterparty falls within NIS2 supply-chain risk-management duties |
| Conformity marking for an AI system you supply | Regulation (EU) 2024/1689 (AI Act) | Whether the system is high-risk under the Act, in force from 2 August 2026 |
| A named commercial standard (ISO, SOC, an industry scheme) | No EU act names it | What the contract, not a statute, requires you to hold |
What changes in practice
Once an answer is sent, the clock attached to it starts running. Most questionnaires carry a stated response deadline, and a late or vague reply is read as a missing control, not as a scheduling delay. The same intake often bundles an adjacent question about component licensing; that question is answered separately, in When open source terms conflict with the licence step, and should not be folded into the certification answer.
What to do, in order
- Locate the actual certificate file — issuing body, scope, expiry — before answering. Do not rely on a sales deck.
- Decide whether the question is driven by a statutory duty, such as NIS2 or the AI Act, or by the counterparty's own commercial checklist.
- If the certificate does not exist, say so plainly and name the compensating control rather than guessing at a status.
- Route the answer through whoever owns your security or compliance programme, not through sales alone.
- Answer inside the stated deadline, in writing, with a named contact for follow-up questions.
- Keep a copy of the exact wording sent — it becomes the record if the claim is checked later.
Where the same questionnaire also asks about scope creep in an ongoing engagement, treat it as a separate track — see When professional services drift out of scope in detail.
Who decides
Internally, the decision sits with whoever holds the compliance or security mandate, not with whoever first received the form. Where NIS2 status is genuinely in question, the relevant national competent authority can request evidence directly. Where the product is a high-risk AI system, a notified body carries out the conformity assessment under the AI Act, and its finding — not an internal assurance — is what a customer is entitled to rely on. A related but distinct problem, a co-development partner filing a patent alone, follows its own decision path, described in When a joint development partner files alone and the.
If your situation differs
- If your organisation falls within NIS2 as an essential or important entity, answer by pointing to your own compliance programme, not to a general assurance.
- If the product under review is a high-risk AI system, point to the conformity assessment route under the AI Act rather than to a security certificate.
- If neither act applies, treat the question as ordinary commercial due diligence: there is no statutory certificate to cite, only the list the contract itself sets out.
What this page does not cover
This material does not draft the questionnaire response for you, and it does not resolve a dispute over whether a certificate was ever valid — that sits with the issuing body, not with this page. It also does not cover certification questions tied to digital-asset supply mechanics; a structurally similar first-step sequence for that context sits at When a burn changes the supply step by step.
Verified
Checked on 4 March 2025 against the cited texts. Sources: Directive (EU) 2022/2555 (NIS2), as published on the European Commission's digital strategy site; Regulation (EU) 2024/1689 (AI Act), consolidated text on EUR-Lex.
Related situations
A neighbouring intake question, arising after signature rather than before it, is set out in When cloud region changes after signature: what to do.
FAQ
What is the first step when a vendor questionnaire asks about certification?
Find the actual certificate — scope, issuer, expiry — before writing any answer. Do not answer from a marketing claim or from memory.
Which deadline is already running?
The response deadline stated in the questionnaire itself starts on receipt, not on the day you begin drafting. A late or vague answer is read as a missing control.
Who decides, and on what evidence?
Internally, whoever holds the compliance or security mandate decides the wording. Where NIS2 or the AI Act genuinely applies, the competent authority's request or the notified body's assessment is the evidence that counts, not an internal assurance.