is filling in this questionnaire the same as complying with NIS2

No, the questionnaire is an assessment, not a legal obligation

No, these two are not the same. The questionnaire you receive from a customer is a procurement instrument: that customer wants to know whether you as a supplier pose a risk in its chain. NIS2 — in full Directive (EU) 2022/2555 — is a legal obligation that only applies to organisations that themselves fall under the directive as an entity, or under its Dutch transposition, the Cybersecurity Act. Whether that applies to your business depends on sector and size, and you determine that separately from which list you also receive. Check that separately at the question whether the organisation itself falls under the NIS2 directive, because that answer does not change anything about what you fill in here.

What is correct: many customers who themselves fall under NIS2 translate their own obligation to their suppliers. Article 21 paragraph 2 of the directive requires those entities to implement ten categories of measures, including supply chain security — and that is precisely why you as a sub-supplier receive questions about risk analysis, incident handling and continuity. The questionnaire is therefore the result of someone else's NIS2 obligation, not proof of your own obligation. You can complete the list fully and truthfully without thereby becoming "NIS2-compliant", and conversely: if you yourself do fall under the law, a completed list does not help you with those own obligations — those go through supervision, not through a customer portal.

Where that difference comes from: Article 21 versus the questions themselves

Article 21 paragraph 2 of Directive (EU) 2022/2555 lists ten measures that a NIS2 entity must itself take, including security requirements for own suppliers and about training in cyberhygiëne for employees. A questionnaire from a customer translates those measures into concrete questions to you as a supplier, but the legal standard itself is set out in the directive and, for the Netherlands, in the Cybersecurity Act — not in your customer's portal.