What are the fines under NIS2?
Under NIS2 Article 34, essential entities face a maximum fine of at least €10 million or 2% of total worldwide annual turnover, whichever is higher. For important entities the maximum is at least €7 million or 1.4%. These are minimum caps: national law can set them higher and add periodic penalty payments.
Last updated: 2026-09-30
Fine caps at a glance
| Entity type | Maximum fine (at least) | Supervision style |
|---|---|---|
| Essential entity | €10M or 2% of worldwide turnover, whichever is higher | Proactive (ex ante) — Article 32 |
| Important entity | €7M or 1.4% of worldwide turnover, whichever is higher | Reactive (ex post) — Article 33 |
What typically triggers enforcement
- ▸Missing or inadequate Article 21 risk-management measures
- ▸Late or missing incident reports under Article 23 (24h / 72h / 1 month)
- ▸Failure to register with, or cooperate with, the national authority
Beyond fines
Authorities can also issue binding instructions, order audits and require public disclosure. For essential entities, Article 32 additionally allows temporary suspension of certifications and a temporary ban on managers at CEO or legal-representative level.
Depends on national law: Actual fine scales, periodic penalty payments and whether public bodies can be fined are set by national law.
Related question
Are NIS2 fines the same in every EU country?
The directive sets minimum levels for the maximum fine. Each member state's transposition law sets the actual fine scale and may go higher, so exact amounts and enforcement priorities differ by country.
Next steps
- NIS2 fines in detail →
- Management liability under NIS2 →
- Check whether you are essential or important →
More answers:
For decision-support purposes only, not legal advice. Exact obligations depend on national transposition — use our free scope checker for a personalised assessment.