we are not certified but the questionnaire asks for it anyway

Do not fill in a certificate without making up supporting evidence

Without an ISO 27001 certificate you fill in "no" for the certification question, and that is not a problem — a certificate is not mandatory, not even under NIS2. What does matter is whether the underlying measures are in place. Your customer's questionnaire usually asks for the certificate as the shortest way to check whether your risk management is in order; without a certificate you must demonstrate that in another way.

Therefore do not look only at the yes/no question, but at what lies behind it. Often a follow-up question follows about concrete measures: access control, incident response, continuity. These are the same subjects as the Annex A control measures of ISO 27001, and also the same subjects as the ten measures in article 21(2) NIS2. If your supply chain file has answers to whether there is a policy for risk analysis and the protection of information systems and to whether there is a procedure for security incidentsthen you do fill in those follow-up questions with a substantiated answer, even though there is no certificate behind it. The system proposes that answer from your file; you confirm it per question with yes or no before it goes to your customer's portal.

Certification and measures are two separate questions

ISO/IEC 27001 awards the certificate on the basis of an audit against the control measures in Annex A; NIS2 (Directive (EU) 2022/2555, article 21(2)) requires those ten measures themselves, regardless of certification. The Dutch Cybersecurity Act transposes that obligation and enters into force on 15 August 2026. A customer asking for the certificate is thus actually testing whether you meet the underlying measures — the certificate is the means of proof, not the requirement itself. Whether you yourself fall under that obligation depends on whether the undertaking falls under the NIS2 directive or the national transposition; that determines how much weight the follow-up questions carry, even without a certificate.