customer wants us to sign a statement about security is that allowed

Signing is allowed, but read what it says first

Yes, a client may ask for it — a security statement is not a legal obligation but a contractual requirement, and a client is free to impose it. The point is not whether they may ask for it, but whether the statement covers what you actually do. A signature under "we comply with the ten measures of Article 21(2) NIS2" or under "we are ISO 27001-compliant" is a commitment with contractual value, not a tick on a questionnaire. If a dispute arises — an incident at the client that traces back to you — that statement is the first document that will be pulled out.

So first look at the format. Does the statement ask for a yes/no per measure, or is it a single blank statement "we are NIS2-compliant"? The first you can substantiate per point; the second is often broader than what you can support, especially if you are not yourself subject to the directive but are a supplier to an entity that is — whether the organisation itself falls under the NIS2 directive is then the first question you answer for yourself. Never sign off on a claim about a measure you cannot point to, for example or whether there is a process for identifying vulnerabilities — if you do not have that, then write that down or request a specified version.

Where the liability comes from

The statement itself does not derive its weight from the Cybersecurity Act — that only obliges the designated entities themselves, not their suppliers directly — but from the contract you sign. NIS2 works through Article 21(2), which obliges entities to manage risks in the supply chain; that is the reason why that entity is asking you about this, not the reason why you are bound by it. What you undertake therefore stands in the text of the statement itself, not in the directive.