our customer wants to know if we fall under NIS2, what do I fill in

Whether your own undertaking falls under NIS2 is a separate question from having to comply with it

Whether your undertaking is itself NIS2-obligated depends on sector and size — not on whether your customer asks for it. NIS2 operates with a sector list (annexes I and II of the directive) and size thresholds: medium-sized or large according to the EU definition. If you fall within that scope, you are an "essential" or "important entity" and the obligations of article 21 apply directly to you, irrespective of what a customer puts in a questionnaire. If you do not fall within that scope, you can simply fill in "no, not independently NIS2-obligated" — that is not an evasive answer, it is the correct answer if it is factually accurate.

Where things often go wrong: a supplier who is itself outside scope nonetheless has the requirements of article 21 imposed on them via contract, because their customer must assess this against their own security requirements for suppliers That is then not a NIS2 obligation for you, but a contractual transposition of it. So fill in the answer to the question as they ask it: "do you fall under NIS2" is a yes/no about your own status, not about whether you implement NIS2-like measures. Those two are often confused separately, and filling in "yes" because you are already working towards ISO 27001 or certifiedis factually incorrect if you are not yourself in scope.

Dutch transposition via the Cybersecurity Act

The directive itself (2022/2555) defines the sectors and the size threshold for essential and important entities; the Dutch implementation — who is designated, and with which supervisory deadlines — runs via the Cybersecurity Act, which enters into force on 15 August 2026. Until that date there is no national designation on which you can base a "yes"; thereafter, to the extent your undertaking is on the final list. As long as that act is not in force, "not yet applicable" or "yet to be determined" is the factually correct answer, not "no" — that suggests a definitive exclusion that does not yet exist.