NIS2 fines and penalties: how much, for what, and what else regulators can do

NIS2 fines apply when an entity infringes Article 21 (cybersecurity risk-management measures) or Article 23 (incident reporting). National law must allow fines with a maximum of at least €10 million or 2% of worldwide annual turnover for essential entities, and at least €7 million or 1.4% for important entities, whichever is higher. There is no higher NIS2 tier: €20 million or 4% is GDPR.

This guide covers the ceilings, group turnover, what is fined, how amounts are set, other enforcement powers, personal liability, GDPR, national laws and a checklist.

	Essential entities	Important entities
Fine ceiling for Art. 21 or 23 (Art. 34)	At least €10M or 2% of worldwide turnover	At least €7M or 1.4%
When supervision starts	Any time, including random checks (Art. 32)	Ex post, on evidence or indication (Art. 33)
Audits	Regular, targeted and ad hoc	Targeted only
Warnings, binding instructions, orders, publication	Yes	Yes
Monitoring officer	Yes (Art. 32(4)(g))	No
Suspension of certification, temporary management ban	Last resort (Art. 32(5))	No
Personal liability of representatives	Art. 32(6)	Art. 32(6), via Art. 33(5)
GDPR fine for the same conduct	No NIS2 fine (Art. 35(2))	No NIS2 fine (Art. 35(2))

How much are NIS2 fines?

Article 34 sets a floor for the national ceiling, not the fine itself. For infringements of Article 21 or 23:

• Essential entities: “a maximum of at least EUR 10 000 000 or of a maximum of at least 2 %” of total worldwide annual turnover in the preceding financial year, whichever is higher (Article 34(4)).
• Important entities: a maximum of at least €7 million or 1.4% of that turnover, whichever is higher (Article 34(5)).

“Maximum of at least” works both ways. National law may set a higher ceiling, and a fine can be anything up to it. It must be “effective, proportionate and dissuasive” (Article 34(1)).

Both pairs of figures cross at €500 million of turnover: 2% of it is €10 million, 1.4% is €7 million. Below that, the fixed amount sets the ceiling; above it, the percentage does. For a group with €2 billion of turnover, the national maximum must be at least €40 million for an essential entity and €28 million for an important one.

Whose turnover counts?

It is the turnover of the undertaking to which the entity belongs (Article 34(4) and (5)). Recital 130 reads undertaking as in Articles 101 and 102 TFEU: the competition law concept of an economic unit, which can include a parent company and its subsidiaries. A small subsidiary of a large group should assume the percentage may be calculated on group turnover.

Is there a €20 million or 4% NIS2 fine?

No. That is the higher GDPR tier (Article 83(5) GDPR). NIS2 has no tier for repeated or systematic infringement either: repetition affects the amount, not the ceiling.

What can you be fined for under NIS2?

The Article 34 floors apply to two obligations:

• Article 21, the cybersecurity risk-management measures: the ten minimum measures, applied proportionately, with corrective action when you find a gap.
• Article 23, incident reporting: an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report within one month of the notification.

Other infringements, such as failing to register or to answer a request for information, are outside those floors. National law sets their penalties, which Article 36 requires to be “effective, proportionate and dissuasive”, with no EU minimum amount.

Member States decide whether public administration entities can be fined (Article 34(7)). Where a legal system has no administrative fines, the authority initiates the fine and a court imposes it (Article 34(8)).

How do authorities decide the amount of a NIS2 fine?

Article 34(3) requires authorities to give due regard, as a minimum, to the elements in Article 32(7):

• the seriousness of the infringement and the importance of the provisions breached;
• its duration;
• relevant previous infringements;
• any material or non-material damage, including financial or economic loss;
• intent or negligence;
• measures taken to prevent or mitigate the damage;
• adherence to approved codes of conduct or approved certification mechanisms;
• the level of cooperation with the competent authorities.

Article 32(7)(a) names, among others, five cases that are “serious infringement in any event”:

• repeated violations;
• a failure to notify or remedy significant incidents;
• a failure to remedy deficiencies following binding instructions;
• obstruction of audits or monitoring ordered after an infringement was found;
• false or grossly inaccurate information on Article 21 measures or Article 23 reporting.

Member States may also allow periodic penalty payments to compel an entity to stop an infringement, following an earlier decision (Article 34(6)).

What else can NIS2 regulators do?

Fines are imposed in addition to any of the other measures, so the two can be combined (Article 34(2)).

How do authorities find infringements?

Essential entities can be supervised without any trigger (Article 32(2)). The powers include on-site inspections and off-site supervision with random checks; regular, targeted and ad hoc security audits; security scans; requests for information and access to data; and requests for “evidence of implementation of cybersecurity policies”. The entity pays for a targeted audit by an independent body unless the authority decides otherwise.

Important entities are supervised ex post: the authority acts “when provided with evidence, indication or information” of non-compliance (Article 33(1)). The toolkit is similar, but audits are targeted only. A request for information must state its purpose and what is requested (Articles 32(3) and 33(3)).

What enforcement measures are there?

Against both classes (Articles 32(4) and 33(4)), authorities can:

• issue warnings;
• adopt binding instructions, or order the entity to remedy deficiencies;
• order it to stop infringing conduct and not repeat it;
• order it to bring its measures into line with Article 21, or meet Article 23 reporting, in a specified manner and period;
• order it to tell customers potentially affected by a significant cyber threat about the threat and the protective measures they can take;
• order it to implement security audit recommendations within a reasonable deadline;
• order it to make aspects of the infringement public;
• impose a fine, or ask a court or other body to impose one.

For essential entities only, the authority can also designate a monitoring officer to oversee compliance with Articles 21 and 23 for a set period (Article 32(4)(g)).

Before acting, the authority must give detailed reasons, share preliminary findings and allow time for observations, unless immediate action is needed to prevent or respond to incidents (Article 32(8), applied to important entities by Article 33(5)).

What is the last resort?

Article 32(5) applies only to essential entities, and only when warnings, instructions and orders have been ineffective. The authority sets a deadline. If it passes, it can:

1. suspend temporarily, or have a certification body or court suspend, a certification or authorisation for part or all of the entity’s services;
2. ask a court or other relevant body to bar temporarily a person at chief executive officer or legal representative level from managerial functions in the entity.

Both last only until the entity remedies the deficiencies. Neither applies to public administration.

Can managers be held personally liable under NIS2?

Yes, but the form of liability is set by national law. Two provisions matter:

• Article 20(1): management bodies approve the Article 21 measures, oversee their implementation and “can be held liable for infringements by the entities of that Article”. Their members must follow training.
• Article 32(6): any person who represents the entity, takes decisions for it or controls it must have the power to ensure compliance, and it must be possible “to hold such natural persons liable for breach of their duties to ensure compliance”. Article 33(5) applies this to important entities.

The directive does not say what that liability looks like. Recital 128 says it does not require criminal or civil liability of these persons for damage to third parties. The only personal measure it names is the temporary management ban in Article 32(5). What management should document is in NIS2 board accountability.

What if the security incident is also a personal data breach?

This is the case behind searches about a cloud or telecom provider’s incident that exposes customer data. Article 35 sets the order:

1. When an infringement of Article 21 or 23 may entail a personal data breach, the NIS2 authority informs the GDPR supervisory authority without undue delay (Article 35(1)).
2. If that authority fines under Article 58(2)(i) GDPR, the NIS2 authority “shall not impose an administrative fine pursuant to Article 34” for the same conduct (Article 35(2)).
3. The NIS2 authority keeps its other measures: warnings, orders, publication and, for essential entities, Article 32(5).

For a security failure, the relevant GDPR tier is not the one people quote. Security of processing and breach notification (GDPR Articles 32 to 34) sit in the €10 million or 2% tier of Article 83(4) GDPR. The full overlap is in NIS2 and GDPR.

Which NIS2 authority acts depends on the service. Public electronic communications providers fall under each Member State where they provide services; cloud, data centre, managed service and similar providers under the Member State of their main establishment (Article 26). Telecom providers are essential from medium size upwards; cloud providers, as a rule, are essential above the medium-sized ceilings and important if medium-sized. See essential vs important entities.

What do national NIS2 laws set?

Amounts, authorities and procedures come from national law; the directive sets minimums. Two examples:

• Luxembourg. The Law of 5 May 2026, in force since 10 May 2026, sets maximum fines of €10 million or 2% for essential entities and €7 million or 1.4% for important ones. It also provides warnings, reprimands and fines of up to €250,000 for registration and certain other duties (Article 25(1)), and periodic penalty payments of up to €1,250 a day, capped at €25,000. See NIS2 in Luxembourg.
• Belgium. Essential entities had until 18 April 2026 to show a CyberFundamentals verification, an ISO/IEC 27001 route or a self-assessment with a request for inspection. The CCB warned that failing to submit complete or timely information “may result in administrative measures or financial penalties”. See NIS2 in Belgium.

Where does NIS2 enforcement stand in 2026?

The directive has applied since 18 October 2024, but fines need a national law, and not every Member State had adopted one by mid-2026. On 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify transposition measures. Across borders, authorities must assist each other and may carry out joint supervisory actions (Article 37).

What the fine rules leave open in practice

Article 32(7) tells authorities what to weigh, not what counts as evidence for it. Three factors turn largely on records you either have or do not:

• Duration. When did the gap open and when did you close it? Without dated records you cannot show either.
• Mitigation. What did you do in the first hours of an incident, and can you prove it?
• Cooperation. How quickly and completely you produce “evidence of implementation of cybersecurity policies”.

Two of the serious infringements, not notifying a significant incident and not remedying after a binding instruction, come down to whether someone decided on time and wrote it down.

The usual gap is not the policy. It is showing the state of a control on a given date. Evidence gathered by hand before an audit shows the day it was gathered; after an incident, the authority asks what was true before it. In practice, closing that gap means collecting evidence continuously from identity, endpoint, cloud and ticketing systems, keeping it dated, and having a person review exceptions and significance decisions. That is how the CloudSoul platform works: automated collection with human-in-the-loop review. A security audit against Articles 21 and 23 shows where you stand. The wider programme is on the NIS2 compliance page.

A sensible approach is to keep one pack ready for the day an authority writes:

NIS2 AUTHORITY REQUEST PACK (keep current, date every item)

1. Entity
   - Classification (essential / important) and its basis
   - Registration record; group structure; last group turnover
2. Governance (Article 20)
   - Management body approval of the measures, with date
   - Management training records
3. Measures (Article 21)
   - Risk register, security policy, control set
   - Evidence per control, dated, with the system it came from
   - Open gaps: owner, deadline, corrective action
4. Incidents (Article 23)
   - Incident log with each significance decision and reason
   - Early warning, notification and final report, timestamps
5. Supervision history
   - Requests received, answers sent, dates
   - Instructions or orders, and evidence of completion
6. Contacts
   - Who answers the authority, who signs, who advises

NIS2 fines checklist

• Confirm whether you are essential or important, and in which Member States.
• Read the fine ceilings and other penalties in each national law that applies to you.
• Work out which turnover a percentage fine would use: the group, not only the entity.
• Record management body approval of the Article 21 measures and members’ training.
• Test incident reporting against 24 hours, 72 hours and one month, and keep the significance decisions.
• Keep dated evidence for each measure, and a gap list with owners and deadlines.
• Name one owner and one process for answering authority requests.
• Agree with your data protection lead how an incident that is both NIS2 and GDPR is handled.

Sources

• Directive (EU) 2022/2555 (NIS2), Articles 20, 21, 23, 26, 32, 33, 34, 35, 36 and 37 and recitals 128 and 130, EUR-Lex.
• Regulation (EU) 2016/679 (GDPR), Articles 58(2)(i) and 83, EUR-Lex.
• Luxembourg, Law of 5 May 2026 on measures to ensure a high level of cybersecurity, Legilux.
• Centre for Cybersecurity Belgium, “NIS2: 18 April 2026 deadline, what essential entities must have in place”, updated 16 April 2026, CCB.
• European Commission, referral of Ireland, Spain, France and the Netherlands to the Court of Justice over NIS2 transposition, 8 July 2026, Shaping Europe’s digital future.

Frequently asked questions