my customer sends an extensive nis2 questionnaire while that wasn't the case before what should I do with it

Your client is passing on their supply chain obligation

This usually means that your client falls under the Cybersecurity Act themselves, and that as an essential or important entity they are obliged to assess the security of their own suppliers. This obligation comes from the ten measures in Article 21(2) of the NIS2 Directive, and one of them specifically concerns supply chain security: the organisation must know how secure their suppliers are, and must be able to demonstrate this. Your client is therefore not passing on this question arbitrarily — they are bound to do so themselves, and at that point you are part of their "supply chain". That is why the list is coming now, even though you have been supplying for years without this ever being requested: the obligation is new for them, not for your relationship.

What you can expect is a combination of questions that previously fell under access control and asset management questions about the procedure for handling security incidents and questions about resilience following a disruption. If you do not have an ISO 27001 certificate, that in itself is usually not a problem — the directive does not require that every supplier is certified, it requires that the client knows how you are positioned. A description of your own measures, with supporting documentation where you have it, is then a valid answer. Where you have nothing, you answer that there is nothing; a list with nothing but "yes" without underlying documentation creates more risk in a later audit of your client than an honest "no, not yet".

Why this is reaching you now: Article 21(2)

The obligation to assess suppliers is set out in Article 21(2) of Directive (EU) 2022/2555, and is implemented for Dutch entities in the Cybersecurity Act, which enters into force on 15 August 2026. Whether your client themselves falls under that act, and is therefore obliged to ask these questions, you can usually determine based on the size and sector of their business — something that is also relevant to know whether you yourself fall as an entity under the directive.