Our customer is in NIS2 scope. Do we have to comply too?
Not with the law directly, unless you are in scope yourself, but you will have to meet your customer's requirements in practice. Article 21(2)(d) obliges entities in scope to address supply-chain security, including security-related aspects of their relationships with direct suppliers and service providers, and Article 21(3) asks them to consider each direct supplier's vulnerabilities and cybersecurity practices. Your customer will therefore send questionnaires, ask for evidence and write security and incident-notification clauses into the contract. Answer truthfully, document what you have, and negotiate duties that fit your size. Contract terms bind you even when the directive does not. NetSenX helps with one recurring question, intrusion detection: it gives you network detection on every plan, Free included, an alert history and an audit log you can show, with customer data stored in the EU.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.