we are not ISO 27001 certified but we do a lot for security, what do I enter

No on certificate, yes in practice can both be true

Yes, you may — provided you treat it separately from the question about the certificate itself. An ISO 27001 question in a questionnaire is usually a closed yes/no about possession of the certificate. If you don't have it, then "no" is the factually correct answer to that specific question, and no explanation will change that. What can work: many questionnaires ask after or alongside the certificate question also separate questions about the underlying measures — risk analysis, access control, incident handling. You answer those on their own merits, with their own evidence, regardless of the certificate.

The confusion arises because certification and measures touch the same content but are not synonymous. An auditor working through Annex A and a company that has "simply" implemented MFA, backups and an incident process can materially have the same controls — the difference is that one has an independent assessment and a certificate, the other does not. In the chain dossier you therefore enter two separate answers: on the certificate question "no", and on the question about for example multi-factor authentication or the handling of security incidents the factual answer with the supporting document you have for it — a policy document, a configuration export, a process description. Never enter one as evidence for the other.

Annex A and Article 21(2) overlap, but are not interchangeable

ISO/IEC 27001 Annex A describes the control measures that a certified management system must cover; Directive (EU) 2022/2555 Article 21(2) lists the ten measures that are mandatory under NIS2 for entities falling under that directive. Both lists mention risk management, access, crypto and incident response, but one is a certification standard with an auditor who assesses, the other is legislation without a certification requirement. A "no" on the certificate thus says nothing about whether someone complies with Article 21(2) — that is a separate question, which only becomes relevant once it is established whether the enterprise itself falls under the NIS2 Directive or the Cybersecurity Act.