my customer asks whether I fall under NIS2 what should I answer

Direct NIS2 scope is usually not at issue

For most suppliers, the answer is no: you do not fall under the Cybersecurity Act yourself, the Dutch implementation of NIS2. That law focuses on organizations in specific sectors and above certain size thresholds — energy, transport, digital infrastructure, healthcare, and several others. If you don't fall under that, then "no" is a factually correct answer to the literal question. If you are in one of those sectors yourself, or if you are a medium-sized or large enterprise in such a chain, then the answer could be "yes" — you determine that based on the sector and size criteria, not based on what your customer asks.

What your customer is actually looking for in practice is not so much your legal status, but whether you as a link in their chain pose a risk. That is why this question often comes together with questions about the ten measures from article 21(2): access control policy, incident response, continuity, vulnerability management. Even if you yourself fall outside the scope of the law, your customer can still impose those requirements on you via the contract — that is then a contractual obligation, not a legal obligation for you. Check in that case whether the organisation itself falls under the NIS2 directive independent of what your customer asks, and answer alongside the underlying question of whether security requirements for own suppliers have been established — often that is the question that really lies behind it.

Legal basis: sector and size criteria of the Directive

The scope follows from the annexes to Directive (EU) 2022/2555, which indicate per sector which entities fall under "essential" or "important", combined with the size thresholds in article 2. The Dutch Cybersecurity Act implements this one-to-one and enters into force on 15 August 2026; until that date there is no national legal basis to fall outside the law as a non-designated sector. If in doubt about your own sector classification, the text of the Directive itself is the first source to consult, not your customer's questionnaire.