Resource
NIS2 Enforcement Tracker
A verified-only record of NIS2 sanctions across the EU. We list only actions we can cite to a primary source — no rumours, no recycled figures.
NIS2 enforcement tracker · verified only
We list only NIS2 sanctions we can cite to a primary source — the competent authority’s own decision, an official gazette, or a court record. The specific fine figures circulating online proved unverifiable, so we exclude them. This is a reference you can trust, not a rumour list.
As of August 2026, no individually-confirmed NIS2 sanction has been published that we can verify against a primary source. Enforcement has shifted from guidance to active audits, but most authorities do not disclose individual fines and there is no central EU register. We add rows here the moment an action is officially confirmed.
Last reviewed August 2026. Statutory ceilings: up to €10M or 2% of global turnover (essential entities), €7M or 1.4% (important). Know of a primary-sourced action we’re missing? Tell us.
Why this tracker is (deliberately) conservative
Plenty of sites publish tables of “NIS2 fines issued.” When we tried to verify those figures against the competent authorities, we couldn’t — most trace back to secondary reporting that no regulator confirms. There is no central EU register of NIS2 fines, and many authorities do not disclose individual sanctions at all.
So we made a choice: this tracker lists an action only when it can be cited to a primary source — the authority’s own decision, an official gazette, or a court record. That keeps it trustworthy, even if it means it’s shorter than the lists you’ll find elsewhere.
What we do know
Enforcement has moved from guidance to active supervision — national CSIRTs and competent authorities are running audit programmes, particularly for essential entities in energy, health and digital infrastructure. The statutory ceilings remain the anchor: up to €10M or 2% of global turnover for essential entities, €7M or 1.4% for important ones. Read the full breakdown in our guide to NIS2 fines & penalties, or check whether NIS2 applies to you.
Enforcement is also happening at the EU level: in July 2026 the European Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to fully transpose NIS2 into national law — a reminder that the pressure runs top-down as well as toward individual entities.
See your real financial exposure today.
Run the free simulation on your external perimeter — no login, no integration, in minutes.