my customer asks if we fall under NIS2 what should I fill in

Usually you fill in "no" or "not directly", unless you yourself are a designated sector

Most suppliers do not fall directly under NIS2 — they feel the directive indirectly, because their customer (who does fall under NIS2) imposes requirements through the contract. If your company is not in one of the designated sectors (energy, transport, digital infrastructure, healthcare, and a number of others listed in annexes I and II of the directive) and does not fall above the size category that the directive uses, you usually fill in "no" or "not applicable". Doubt about your own status is not something you should decide yourself based on a guess: is the enterprise covered by the NIS2 directive or its national implementation set out how you verify this, including the Cybersecurity Act which forms the Dutch transposition and enters into force on 15 August 2026.

More important than the question "do we fall under NIS2" is often the question hidden behind it: your customer wants to know whether you also apply the ten measures of Article 21(2) of the directive, even if you do not fall under the law yourself. Many questionnaires phrase this loosely as "are you NIS2-compliant", while they are actually asking about risk policy, incident response, continuity and access control. So answer not only the status question, but also check whether the list asks follow-up questions that you can already cover with existing answers, for example on policy for risk analysis and the security of information systems.

Basis: Article 21(2) and the status of your company

Article 21(2) of Directive (EU) 2022/2555 lists the ten measures that an "essential" or "important" entity under NIS2 must take; whether you have that status follows from the sector lists in annexes I and II of that same directive and, for the Netherlands, from the Cybersecurity Act. ISO/IEC 27001 Annex A is not a legal source but a commonly used practical implementation of the same measures — if you are certified for it, that is relevant evidence, not an answer to the status question itself.