they ask for our complete security policy as a document

Sharing the complete policy document is usually not necessary

No, in most cases that is not necessary, and it is not what the customer actually wants to know. A question like "send your security policy" is almost always a translation of something more specific: the customer wants to know whether a policy exists for risk analysis, whether there is an incident procedure, or whether access is properly regulated. Those are the ten measures from Article 21(2) of NIS2, and you see the same breakdown reflected in the control measures of Annex A of ISO/IEC 27001. A questionnaire that asks for "complete policy" usually still breaks that down into sub-questions — so first check whether that is the case before you upload a complete document.

The risk of sending an entire policy document is not legal but practical: it often contains more than the customer needs — names of tools, internal procedures, contact details of staff. Those who prefer to answer per question instead of sharing a document can use the confidentiality button to limit it to what is actually being asked. If the question is nonetheless specifically about a sub-topic, the answer is often already to be found elsewhere: or access policy is documented, or whether there is a procedure for incidents, or whether testing is carried out periodically. That is usually more concrete to answer than with a complete document.

Where this follows from: Article 21(2) and Annex A

Article 21(2) of NIS2 lists ten concrete measures — risk analysis, incident handling, business continuity, vulnerability management, access policy and more — without requiring that a third party sees the underlying document itself. ISO/IEC 27001 Annex A works with the same logic: the control measures are auditable per item, not as one undivided policy document. Also consider that the question of whether your own undertaking falls under NIS2 or its national transposition is separate from what a customer asks for in a questionnaire — those two things are often confused.