NIS2 Penalties: Fines, Supervision and Enforcement Explained
NIS2 fines get the headlines, but enforcement is broader: warnings, binding orders, audits, monitoring officers and, for essential entities, temporary bans on managers. Here is the full picture, and how NIS2 interacts with GDPR fines.
The fine levels
| Entity | Maximum fine of at least | Article |
|---|---|---|
| Essential | €10 million or 2% of total worldwide annual turnover of the undertaking, whichever is higher | 34(4) |
| Important | €7 million or 1.4% of total worldwide annual turnover, whichever is higher | 34(5) |
These apply to infringements of Article 21 (risk-management measures) and Article 23 (incident reporting). They are minimums for the maximum: national law can set higher ceilings. Turnover is that of the undertaking the entity belongs to, which can mean the group. Member states may also provide for periodic penalty payments to force an entity to stop an infringement (Article 34(6)), and set penalties for other infringements of national law (Article 36).
What authorities must weigh
When deciding on a fine or other enforcement measure, authorities must at least take into account (Articles 32(7) and 34(3)):
- the seriousness of the infringement and the importance of the provisions breached;
- its duration, and any relevant previous infringements;
- material or non-material damage caused, including financial loss, effects on other services and the number of users affected;
- intent or negligence;
- measures taken to prevent or mitigate the damage;
- adherence to approved codes of conduct or certification mechanisms;
- the level of cooperation with the authority.
Always serious: repeated violations; failing to notify or remedy significant incidents; failing to remedy deficiencies after binding instructions; obstructing ordered audits or monitoring; and providing false or grossly inaccurate information about risk-management measures or reporting (Article 32(7)(a)).
Supervision before enforcement
| Essential entities (Art. 32) | Important entities (Art. 33) | |
|---|---|---|
| When | Proactive (ex ante) supervision | Reactive (ex post): when there is evidence, indication or information of non-compliance |
| Tools | On-site inspections and off-site supervision including random checks, regular and targeted audits, ad hoc audits, security scans, requests for information and evidence | On-site inspections and off-site ex post supervision, targeted audits, security scans, requests for information and evidence |
Enforcement measures besides fines
- warnings about infringements;
- binding instructions and orders to remedy deficiencies, with deadlines;
- orders to bring Article 21 measures or Article 23 reporting into compliance;
- orders to inform affected service recipients about a significant cyber threat;
- orders to implement audit recommendations;
- for essential entities, a monitoring officer to oversee compliance for a set period;
- orders to make aspects of the infringement public;
- for essential entities, if earlier measures fail: temporary suspension of a certification or authorisation, and a temporary ban on managers at chief executive or legal representative level (Article 32(5)).
Fines can be imposed in addition to these measures (Article 34(2)). See NIS2 and the board for the personal liability side.
NIS2 and GDPR: no double fine for the same conduct
A security failure can breach both NIS2 and GDPR. Under Article 35, when a NIS2 authority finds that an infringement of Article 21 or 23 may involve a personal data breach to be notified under GDPR, it must inform the data protection authority. If the data protection authority then fines the entity under GDPR for the same conduct, the NIS2 authority may not also impose a NIS2 fine for it, though it can still use its other enforcement measures.
What reduces exposure
- Documented Article 21 measures approved by management, with evidence they operate.
- Incident reporting that meets the 24-hour, 72-hour and one-month deadlines.
- Quick remediation of findings and full cooperation with the authority.
- Approved certification or codes of conduct, where they exist.
Know your gaps before the authority does. The NIS2 Compliance Starter Kit includes a gap-assessment workbook, an incident response plan template, a supply chain security policy template and a board briefing deck.
Sources
Related tools
Further reading: NIS2 and the Board · NIS2 Compliance Checklist
ClevSec
Compliance & security tools for modern businesses
We build practical tools and templates that help startups and SMBs stay compliant with NIS2, GDPR, and DORA. Explore our free tools →
This article is for informational purposes only and does not constitute legal advice. Last updated: October 2026.