customer wants to know if I report incidents within 24 hours

24 hours is a warning, not a full report

No, not in the sense of a complete incident report within 24 hours — but there is an obligation that comes close. Article 21(2) of the NIS2 Directive requires "important" and "essential" entities to report significant incidents in phases: an early warning within 24 hours, followed by a full report within 72 hours, and a final report later. This obligation applies directly to the entity that falls under NIS2 — this is usually the customer who sends the questionnaire, not automatically the supplier who fills it in. Whether that 24-hour obligation also rests on your own undertaking depends on whether you yourself fall as an entity under the Directive; this is described at whether the undertaking itself falls under NIS2.

What a customer usually wants to know with this question is not whether you comply with the statutory reporting obligation to a supervisory authority, but whether you inform him quickly enough if something goes wrong at your place that affects his service provision. This is a contractual arrangement, not a statutory deadline from the Directive itself — the 24 hours from NIS2 is an obligation between entity and supervisory authority, not automatically between supplier and customer. If you have an incident procedure with your own internal reporting timelines, that is usually the supporting document that fits here; that procedure is described at the question about a procedure for security incidents. If you have no established timeline, then "no" with a brief explanation is more honest than a "yes" that you cannot support.

Where this appears in the directive: Article 21(2)

The phased reporting obligation — early warning within 24 hours, report within 72 hours, final report — is set out in Article 21(2) of Directive (EU) 2022/2555, as part of the ten measures listed there. This obligation is directed at the relationship between the entity and the competent supervisory authority or the CSIRT, not at the relationship between supplier and customer. The Dutch Cybersecurity Act implements this Directive into national legislation; who exactly falls under the reporting obligation and from what point, follows from that Act once it comes into force.