customer asks for pentest results but we have never done a pentest

No pentest done is not an automatic no

A pentest — a penetration test, where someone actively tries to break into your systems to find weak spots — is one possible test of effectiveness, but not the only one. Article 21(2) of NIS2 asks for "policies and procedures to assess the effectiveness of measures", without prescribing a pentest. Annex A of ISO/IEC 27001 also mentions technical vulnerability management and testing, but does not mandate a specific test method. You can often honestly fill in "no, not yet" without this being a blocking answer — it is one of the ten measures, not the only one.

What does count as alternative evidence: automated vulnerability scans, a patch process, or a risk analysis showing that a pentest was not yet deemed necessary given the scope of your systems. Check with the process for identifying and remediating vulnerabilities whether you already have something running there — often you do, even if it is not called a "pentest". If your file does not have that supporting document, the system will not suggest a "yes": you will then get a question with an empty answer, and you decide yourself whether to fill in "no" or first run a scan. Some customers accept a commitment ("scheduled for Q-whatever") as an interim answer; you only know that after submitting to their portal.

What this is based on: Article 21(2) and Annex A

The obligation to conduct periodic testing derives from Article 21(2) of Directive (EU) 2022/2555, which names "policies and procedures for assessing the effectiveness of cybersecurity risk management measures" as one of the ten measures, alongside — not in place of — vulnerability management. ISO/IEC 27001 Annex A elaborates on this in control measures around technical vulnerabilities and assessment, without naming a pentest as a mandatory instrument. Whether your organisation falls directly under the NIS2 obligations depends on sector and size — you determine that separately from this question, for example via whether the undertaking itself falls under NIS2.