customer wants to know how often we have our systems tested

No fixed frequency prescribed

There is no number in the legal text. Article 21(2) NIS2 mentions under point f "policies and procedures to assess the effectiveness of measures addressing cybersecurity risk management" — a pentest is the most concrete implementation of this, but how often it must occur is left open by the directive. The Cybersecurity Act, which will shortly transpose this article into Dutch law, is expected not to add a fixed interval to it either. Your client's questionnaire fills this gap itself: many formats specifically ask for "at least annually" or "upon significant changes", but that is your client's standard, not the law's.

What you can implement in practice is therefore your own rhythm, not a mandatory rhythm. Do you test annually, after every major release, or only ad hoc after an incident? That answer is usually documented, with date and scope of the last test, as a separate document in the chain file — look for the pentest report or its executive summary. If you don't yet have a fixed frequency, then "ad hoc, last performed on [date]" is a more honest answer than inventing a frequency you don't maintain. This question often appears in the same section as the process for identifying and remediating vulnerabilities — a pentest is one way to identify vulnerabilities, scanning and patch management are the others.

ISO 27001 as an indirect reference point

Those certified to ISO 27001 will generally have established an internal policy for periodic testing through Annex A measures, including the frequency that the organization itself chose during risk assessment. This makes the question about the ISO 27001 certificate relevant as supporting evidence: not because the certificate prescribes a pentest frequency, but because it demonstrates that an established testing policy exists from which that frequency can be derived.