NIS2 sets the minimum levels that national administrative-fine maximums must reach for Article 21 or 23 infringements by essential and important entities.
Separate the EU baseline from Member State penalty rules, enforcement measures, public administration treatment, GDPR overlap, and case-specific factors.
NIS2 does not impose one flat EU fine or say that every infringement receives the headline amount. requires each Member State's law to make Article 21 and 23 infringements subject to a maximum of at least the stated fixed amount or turnover percentage, whichever is higher. The authority must then consider the circumstances of the case. Check the applicable national law for the available penalties, procedure, authority, turnover calculation, and treatment of public administration entities.
For an essential entity that infringes Article 21 or 23, Member States must provide for an administrative-fine maximum of at least EUR 10,000,000 or at least 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs, whichever is higher.
For an important entity, the corresponding maximum must be at least EUR 7,000,000 or at least 1.4% of that undertaking's total worldwide annual turnover in the preceding financial year, whichever is higher. These figures set a floor for the maximum available under national law. They are not an automatic fine, a harmonised penalty for every case, or a statement that national law cannot set a higher maximum.
Sources (2)
Article 34 sets the administrative fine conditions and the minimum maximum fine levels for essential and important entities.
whichever is higher
Commission FAQ context for the NIS2 framework, entity categories, and cybersecurity obligations.
NIS2 Directive
points specifically to infringements of Article 21 and Article 23. Article 21 requires appropriate and proportionate technical, operational, and organisational cybersecurity risk-management measures. Article 23 covers significant-incident notification to the CSIRT or competent authority and, where applicable, communication to affected service recipients.
Useful evidence shows both the decision and the facts behind it: how the entity assessed proportionality, operated and tested its controls, determined whether an incident was significant, recorded when awareness began, met each reporting stage, communicated with the authority, and corrected deficiencies without undue delay.
Sources (3)
Articles 20, 21, 23, and 34 connect governance, risk-management measures, reporting obligations, and administrative fine exposure.
Articles 21 and 23
Implements technical and methodological requirements for Article 21 measures for specified digital and ICT service entities.
technical and methodological requirements
ENISA guidance provides implementation context and evidence examples for entities subject to the NIS2 implementing regulation.
Technical Implementation Guidance
Essential entities are subject to proactive and reactive supervision. Competent authorities can use on-site inspections, off-site supervision and random checks, regular and targeted audits, ad hoc audits after a significant incident or suspected infringement, security scans, information requests, and requests for implementation evidence.
Important entities are subject to ex post supervision when the authority receives evidence, indications, or information of alleged non-compliance. Both categories can face warnings, binding instructions or orders, remediation requirements, orders to publicise aspects of an infringement, and fines. For an essential entity, ineffective corrective measures can also lead, subject to national process and safeguards, to temporary suspension of a certification or authorisation or a temporary prohibition on certain managers until the deficiency is remedied; those measures do not apply to public administration entities.
Sources (2)
Articles 32 and 33 describe supervisory and enforcement powers for essential and important entities, including the ability to impose or request Article 34 fines.
pursuant to Article 34
Commission FAQ context for the NIS2 entity model and the move from NIS1 to a broader cybersecurity regime.
NIS2 Directive
The headline maximum does not decide the fine. Under Articles 34(3) and 32(7), the authority must consider at least the seriousness and duration of the infringement, previous infringements, material and non-material damage, intent or negligence, mitigation, adherence to approved codes or certification mechanisms, and cooperation. Repeated violations, failure to notify or remedy significant incidents, failure to follow binding instructions, obstruction of audits, and false or grossly inaccurate information are identified as serious infringements.
NIS2 is a directive, so Member States implement the penalty rules. Article 36 requires national penalties for infringements of measures adopted under the Directive, while addresses administrative fines for Article 21 and 23 infringements. A Member State may also allow periodic penalty payments to compel an entity to stop an infringement, and it decides whether and to what extent Article 34 fines apply to public administration entities.
The GDPR overlap rule is narrower than a general ban on parallel enforcement. If a GDPR supervisory authority imposes an administrative fine for a personal data breach arising from the same conduct as the relevant Article 21 or 23 infringement, the NIS2 authority must not impose an fine for that same conduct. It may still use the other NIS2 enforcement measures.
Sources (2)
Articles 32(7), 34, 35, and 36 cover fine factors, periodic penalty payments, GDPR overlap, public administration treatment, and national penalty rules.
same conduct
Commission transposition tracker for checking Member State implementation status and country-specific NIS2 sources.
transposition
Use this checklist before an incident, audit, authority request, or management-body review. It cannot predict a fine, but it keeps the facts needed to show classification, obligation coverage, incident decisions, authority interactions, remediation, and the Article 32(7) factors.
Keep the country-specific legal position separate from the EU baseline so later reviewers can see which claims come from the Directive and which come from national implementation.
For an Article 21 or Article 23 infringement, Member State law must allow an administrative-fine maximum of at least EUR 10,000,000 or at least 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the essential entity belongs, whichever is higher. This is a minimum level for the available maximum, not an automatic fine.
For an Article 21 or Article 23 infringement, Member State law must allow an administrative-fine maximum of at least EUR 7,000,000 or at least 1.4% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the important entity belongs, whichever is higher. This is a minimum level for the available maximum, not an automatic fine.
Yes. requires administrative fines to be imposed in addition to the listed enforcement measures in Articles 32 and 33. Depending on the entity category and national process, those measures include warnings, binding instructions, orders to remedy deficiencies, implementation of audit recommendations, and orders to make aspects of an infringement public.
No. leaves each Member State to lay down whether and to what extent administrative fines may be imposed on public administration entities, without prejudice to competent-authority powers under Articles 32 and 33.
The authority must consider at least the infringement's seriousness and duration, previous infringements, material and non-material damage, intent or negligence, mitigation, adherence to approved codes or certification mechanisms, and cooperation. NIS2 identifies repeated violations, failure to notify or remedy significant incidents, failure to follow binding instructions, obstruction of audits, and false or grossly inaccurate information as serious infringements. National law governs the procedure and may add relevant rules.
Yes, but Article 35 restricts duplicate administrative fines for the same conduct. If a GDPR supervisory authority imposes an administrative fine for a personal data breach arising from the same conduct as the Article 21 or 23 infringement, the NIS2 authority must not impose an fine for that same conduct. The NIS2 authority may still use the other enforcement measures listed in Articles 32 and 33.
Sources (3)
Primary source for Article 34 fine ceilings, Article 35 GDPR-overlap treatment, and Article 36 national penalties.
effective, proportionate and dissuasive
Country transposition tracker for validating national penalty implementation and authority context.
EU countries
Use for technical evidence where Article 21 implementation is assessed for covered digital and ICT service entities.
technical and methodological requirements
Sorena can help connect NIS2 Article 21 controls, Article 23 incident records, management-body approvals, and Member State transposition sources in an enforcement-readiness file.
Ask questions tied to cited sources about Article 34 fine ceilings, Article 21 controls, Article 23 reporting, and national transposition sources.
Review your NIS2 penalty evidence, authority-response workflow, and source gaps with Sorena.
"effective, proportionate and dissuasive"
"whichever is higher"
"Articles 21 and 23"
"pursuant to Article 34"
"same conduct"
"transposition"
"EU countries"
"technical and methodological requirements"
"Technical Implementation Guidance"
"NIS2 Directive"
Stepwise NIS2 applicability test for Annex I and Annex II sectors, medium and large entities, size-independent cases, essential or important classification, jurisdiction, and evidence.
NIS2 compliance calendar for EU transposition, Article 3 and 27 registration updates, Article 23 incident reports, technical measures, and the 2027 review.
Map NIS2 Annex I and Annex II sectors, entity types, size-cap rules, and essential versus important entity classification with official EU sources.
Build a NIS2 Article 21 control baseline from the Directive's minimum cybersecurity risk-management measures, proportionality test, supplier duties, and evidence expectations.
Map NIS2 Article 21 risk-management measures to evidence records for governance, incident handling, continuity, supply chain, testing, cyber hygiene, cryptography, access, assets, and authentication.
Assess NIS2 Article 21 cybersecurity risk-management gaps by mapping current controls to Article 21(2), ownership, evidence, supplier risk, and management review.
Map NIS2 Article 23 reporting duties for significant incidents: 24-hour early warning, 72-hour notification, intermediate reports, final report, recipients, and evidence.
This NIS2 compliance checklist helps confirm scope, entity classification, management-body duties, Article 21 controls, Article 23 reporting, and evidence.
A practical NIS2 compliance guide for mapping entity scope, Article 21 risk measures, Article 23 incident reporting, management accountability, and evidence records.
Build an operational NIS2 country matrix for applicable national law, competent authorities, registration, incident portals, local implementation deltas, evidence, and review dates.
Classify whether an EU service is out of scope, an important entity, an essential entity, or needs national-authority review under the NIS2 Directive.
Compare NIS2 essential and important entities by scope, Article 21 and 23 duties, Article 32 and 33 supervision, evidence, jurisdiction, and penalties.
Classify NIS2 essential and important entities using Article 3, Annex I and II sector scope, size-cap rules, registration evidence, and the Article 32/33 supervision split.
NIS2 FAQ on entity scope, essential and important classification, Article 21 measures, Article 23 reporting, national implementation, and evidence.
Triage a possible NIS2 significant incident by recording awareness time, severity, impact, authority route, recipient communications, and Article 23 reporting clocks.
Build a NIS2 Article 23 incident reporting workflow with significance triage, CSIRT or authority notification steps, recipient communication, cross-border checks, and evidence records.
A guide to NIS2 Article 20 management body accountability: approval of Article 21 measures, oversight, national liability rules, training, reporting lines, and evidence.
Track NIS2 national transposition with Commission country pages, Article 41 dates, reasoned-opinion flags, source wording, authority contacts, and legal review triggers.
Map NIS2 Article 3 entity lists, Article 27 registry submissions, competent authorities, national filing routes, required data, and change-notification deadlines.
Map NIS2 requirements for essential and important entities: scope classification, management-body duties, Article 21 cybersecurity measures, Article 23 incident reporting, and evidence records.
Apply the NIS2 medium-size test, group-data rules, regardless-of-size cases, exclusions, and essential-versus-important classification.
Apply NIS2 Article 21 to direct suppliers and service providers, and distinguish its general duty from Regulation 2024/2690's digital-entity controls.
Compare NIS2 and the CER Directive using cited rows for scope, triggers, evidence, incident handling, supervision, and shared critical-entity work.
Compare NIS2 and DORA for EU cyber compliance: covered entities, when DORA replaces NIS2 duties for financial entities, incident reporting, evidence, and supervisory handoffs.
Compare NIS2 significant-incident reporting with GDPR personal-data-breach reporting, including scope, 24-hour and 72-hour clocks, evidence, and overlap.
Compare NIS2 legal obligations with ISO/IEC 27001 ISMS requirements: scope, Article 21 controls, incident clocks, SoA evidence, audits, and certification reuse.
Compare NIS2 legal obligations with ISO/IEC 27017 cloud-service controls: entity scope, Article 21 measures, incident clocks, shared responsibility, evidence, and assurance limits.
Compare NIS2 with the repealed NIS1 Directive: expanded sectors, essential and important entities, management-body duties, Article 21 controls, Article 23 reporting, and supervision.
NIS2 scope answer for managed service providers and managed security service providers, including service definition, size-cap checks, entity status, and jurisdiction evidence.
Under NIS2 Article 23, covered essential and important entities submit an early warning within 24 hours of becoming aware of a significant incident.
NIS2 incident-notification deadline, required initial assessment, evidence, follow-up, and the 24-hour trust-service-provider exception.
Plain-English FAQ comparing NIS2 essential entities and important entities, with Article 3 classification rules, shared Article 21 and 23 duties, supervision differences, and evidence to keep.
How to handle NIS2 Member State transposition: use Article 41 as the EU baseline, then verify national law, authority routing, registration, and incident-reporting details.
Plain-language FAQ on the NIS2 size-cap rule: medium and large Annex I or II entities, SME thresholds, regardless-of-size exceptions, and evidence to keep.