NIS2 Fines & Penalties Explained: How Much Non-Compliance Costs

The Nisura Team · 24 July 2026

NIS2 sets maximum fines of at least €10 million or 2% of total worldwide annual turnover — whichever is higher — for essential entities, and at least €7 million or 1.4% of turnover for important entities. But the fines are only half the story. NIS2 also makes senior management personally accountable, and can suspend executives or a company’s authorisation to operate. This is what turns cyber risk from an IT line item into board-level legal exposure.

How much are NIS2 fines?

NIS2 deliberately mirrors the GDPR’s turnover-based model so that penalties bite regardless of company size. The Directive splits maximum administrative fines by entity classification:

Note the “whichever is higher” wording: for a large enterprise, 2% of global turnover can dwarf the €10M floor. A group with €5 billion in turnover faces a theoretical ceiling of €100 million. Not sure which category you fall into? Check with our 2-part scope test.

The state of NIS2 enforcement

Enforcement is real but early — and, importantly, no EU authority publishes a central register of NIS2 fines, so the specific penalty figures circulating online are largely unverified. What is documented is the shift from guidance to supervision: national CSIRTs and competent authorities have moved into active audit programmes, especially for essential entities in energy, health and digital infrastructure.

The authorities have published their sanctioning frameworks, even where individual fines aren’t disclosed. Belgium’s CCB details its administrative measures and fines under NIS2; Italy’s ACN publishes its authorities-and-sanctions regime; and France’s ANSSI has signalled a “support before sanctions” approach, giving entities time to comply before penalties. The statutory ceilings remain the anchor: up to €10M or 2% of global turnover for essential entities, €7M or 1.4% for important ones.

We keep a live, verified-only NIS2 enforcement tracker — we add sanctions only when they can be cited to a primary source.

Beyond fines: the enforcement powers that hurt more

Fixating on the euro figure misses the point. NIS2 gives national authorities a graduated set of enforcement measures that can be more damaging to a business than a one-off fine:

• Binding instructions and orders to remedy deficiencies within a set deadline
• Public disclosure — authorities can require the entity to make aspects of its non-compliance public, and even inform affected customers
• Suspension of certification or authorisation for the services concerned (for essential entities)
• Temporary bans on management — prohibiting a CEO or other senior manager from exercising managerial functions until the issue is fixed (for essential entities)

A temporary suspension of your authorisation to operate, or a public notice that your organisation failed its cybersecurity obligations, can cost far more in lost revenue and reputation than the fine itself.

Personal liability: why NIS2 is a boardroom issue

The single biggest change from the old NIS Directive is management accountability. Under NIS2, the management bodies of in-scope entities must:

• Approve the cybersecurity risk-management measures
• Oversee their implementation
• Undergo training to identify and assess cyber risks

Crucially, management bodies can be held liable for the entity’s infringements. Cybersecurity is no longer something a board can delegate down to the CISO and forget — the legal responsibility sits at the top. This is why NIS2 is discussed in audit committees, not just security stand-ups.

What determines the size of a fine?

Authorities don’t jump straight to the maximum. When setting a penalty, they weigh factors such as:

• The seriousness, duration and recurrence of the infringement
• Whether it was negligent or intentional
• The actual damage caused — financial loss, disruption of service, harm to others
• Steps taken to prevent or mitigate the incident, and cooperation with authorities
• Whether the entity had implemented the required Article 21 measures

That last point is the practical lever companies can pull: being able to demonstrate that you had appropriate, documented risk-management measures in place — before an incident — is what separates a warning from a headline-making fine.

How to reduce your NIS2 penalty exposure

You can’t opt out of the fines, but you can materially change how a regulator treats you after an incident. The path is the same as compliance itself: implement the Article 21 measures, run 24/72-hour incident reporting, and — decisively — keep continuous, timestamped evidence that your controls were live and effective. A static annual audit doesn’t prove that on the day of a breach; continuous monitoring does. Weighing the spend? See what NIS2 compliance actually costs against these fines.

This is exactly where Cyber Risk Quantification helps. Instead of a binder that goes stale the day it’s signed, it translates your live posture into a defensible figure and generates on-demand evidence for regulators and enterprise buyers alike. See how the Nisura framework automates NIS2 Article 21 evidence, or run a free simulation to see your projected exposure and NIS2 liability in minutes.

Sources & official references

• Directive (EU) 2022/2555 (EUR-Lex) — Articles 32–34 (supervisory and enforcement measures, administrative fines) and Article 20 (governance / management accountability).
• European Commission — NIS2 Directive FAQs and ENISA implementation guidance.