NIS2 penalties and fines

For an essential entity that infringes Article 21 or 23, Member States must provide for an administrative-fine maximum of at least EUR 10,000,000 or at least 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher.

For an important entity, the corresponding maximum must be at least EUR 7,000,000 or at least 1.4% of that undertaking's total worldwide annual turnover in the preceding financial year, whichever is higher. These figures set a floor for the maximum available under national law. They are not an automatic fine, a harmonised penalty for every case, or a statement that national law cannot set a higher maximum.

Article 34 points specifically to infringements of Article 21 and Article 23. Article 21 requires appropriate and proportionate technical, operational, and organisational cybersecurity risk-management measures. Article 23 covers significant-incident notification to the CSIRT or competent authority and, where applicable, communication to affected service recipients.

Useful evidence shows both the decision and the facts behind it: how the entity assessed proportionality, operated and tested its controls, determined whether an incident was significant, recorded when awareness began, met each reporting stage, communicated with the authority, and corrected deficiencies without undue delay.

Essential entities are subject to proactive and reactive supervision. Competent authorities can use on-site inspections, off-site supervision and random checks, regular and targeted audits, ad hoc audits after a significant incident or suspected infringement, security scans, information requests, and requests for implementation evidence.

Important entities are subject to ex post supervision when the authority receives evidence, indications, or information of alleged non-compliance. Both categories can face warnings, binding instructions or orders, remediation requirements, orders to publicise aspects of an infringement, and Article 34 fines. For an essential entity, ineffective corrective measures can also lead, subject to national process and safeguards, to temporary suspension of a certification or authorisation or a temporary prohibition on certain managers until the deficiency is remedied; those measures do not apply to public administration entities.

The headline maximum does not decide the fine. Under Articles 34(3) and 32(7), the authority must consider at least the seriousness and duration of the infringement, previous infringements, material and non-material damage, intent or negligence, mitigation, adherence to approved codes or certification mechanisms, and cooperation. Repeated violations, failure to notify or remedy significant incidents, failure to follow binding instructions, obstruction of audits, and false or grossly inaccurate information are identified as serious infringements.

NIS2 is a directive, so Member States implement the penalty rules. Article 36 requires national penalties for infringements of measures adopted under the Directive, while Article 34 addresses administrative fines for Article 21 and 23 infringements. A Member State may also allow periodic penalty payments to compel an entity to stop an infringement, and it decides whether and to what extent Article 34 fines apply to public administration entities.

The GDPR overlap rule is narrower than a general ban on parallel enforcement. If a GDPR supervisory authority imposes an administrative fine for a personal data breach arising from the same conduct as the relevant Article 21 or 23 infringement, the NIS2 authority must not impose an Article 34 fine for that same conduct. It may still use the other NIS2 enforcement measures.

Use this checklist before an incident, audit, authority request, or management-body review. It cannot predict a fine, but it keeps the facts needed to show classification, obligation coverage, incident decisions, authority interactions, remediation, and the Article 32(7) factors.

Keep the country-specific legal position separate from the EU Article 34 baseline so later reviewers can see which claims come from the Directive and which come from national implementation.