NIS 2 Penalties and Enforcement: What You Need to Know

Key Takeaways

Point	Summary
Essential entity fines	Up to 10,000,000 or 2% of worldwide annual turnover, whichever is higher
Important entity fines	Up to 7,000,000 or 1.4% of worldwide annual turnover, whichever is higher
Management liability	Senior management can be held personally accountable for non-compliance
Non-financial sanctions	Suspension of certifications, temporary management bans, compliance orders
Harmonized framework	Minimum penalty levels across all EU member states

Quick Answer: NIS 2 penalties can reach 10 million or 2% of global turnover for essential entities and 7 million or 1.4% for important entities. Beyond fines, enforcement includes personal management liability, suspension of certifications, and even temporary bans on individuals exercising management functions.

Administrative Fines

NIS 2 establishes minimum thresholds for maximum fines, meaning member states can impose higher penalties but not lower ones:

Essential Entities

Metric	Amount
Fixed maximum	10,000,000
Revenue-based maximum	2% of worldwide annual turnover (preceding financial year)
Applied maximum	Whichever of the above is higher

Important Entities

Metric	Amount
Fixed maximum	7,000,000
Revenue-based maximum	1.4% of worldwide annual turnover (preceding financial year)
Applied maximum	Whichever of the above is higher

Factors Affecting Fine Amounts

When determining the amount of a fine, authorities consider:

• The gravity and duration of the infringement
• Previous infringements by the entity
• The degree of responsibility of natural or legal persons held accountable
• Whether the entity cooperated with supervisory authorities
• The financial impact on the entity, including revenues lost or gains made
• Any mitigating or aggravating circumstances

Management Liability

One of the most impactful aspects of NIS 2 enforcement is the personal liability of management bodies.

What Management Must Do

Obligation	Description
Approve measures	Formally approve the cybersecurity risk-management measures adopted under Article 21
Oversee implementation	Actively supervise the implementation of these measures
Undergo training	Participate in regular cybersecurity training
Offer training	Ensure similar training is available to employees

Consequences for Management

If the entity infringes NIS 2 requirements, members of the management body can be held personally liable for the breach. This includes:

• Individual fines and sanctions
• Temporary prohibition from exercising management functions (for essential entities)
• Public disclosure of the non-compliance and the individuals responsible

This is particularly significant because it shifts cybersecurity from a purely technical concern to a boardroom-level responsibility.

Non-Financial Enforcement Measures

Beyond fines, NIS 2 equips supervisory authorities with a range of enforcement tools:

For All Entities

Measure	Description
Binding instructions	Specific directives on measures to take and deadlines
Compliance orders	Orders to bring practices into compliance
Information requests	Demands for data, documentation, or evidence
Warning notices	Formal warnings about identified deficiencies
Security audit orders	Mandatory security audits at the entity's expense

Additional Powers for Essential Entities

Measure	Description
Certification suspension	Temporary suspension of certifications or authorizations
Management ban	Temporary prohibition of responsible individuals from exercising management functions
Monitoring officer	Appointment of a monitoring officer to oversee compliance
Unannounced inspections	On-site inspections without prior notice

Supervisory Framework

Essential Entities: Proactive Supervision

Competent authorities may at any time:

• Conduct on-site inspections, including unannounced visits
• Carry out regular and targeted security audits or request third-party audits
• Perform security scans based on objective, non-discriminatory criteria
• Request information, evidence of cybersecurity policies
• Request evidence of implementation of cybersecurity measures

Important Entities: Reactive Supervision

For important entities, supervisory action is triggered by evidence of non-compliance:

• Actions are based on evidence, information, or complaints
• Authorities can request documentation and information
• Security audits can be ordered when non-compliance is identified
• On-site inspections can be conducted when justified by evidence

Comparison with Other EU Regulation Penalties

Regulation	Maximum Fine	Management Liability
NIS 2 (essential)	10M / 2% global turnover	Yes, personal accountability
NIS 2 (important)	7M / 1.4% global turnover	Yes, personal accountability
GDPR	20M / 4% global turnover	Indirect (through DPO role)
DORA	Varies by member state	Yes, for financial entities
AI Act	35M / 7% global turnover	Limited

How to Minimize Enforcement Risk

Demonstrate Good Faith

• Document your compliance efforts thoroughly
• Maintain evidence of risk assessments, policy approvals, and training records
• Show a pattern of continuous improvement in cybersecurity practices
• Cooperate fully with supervisory authorities during inspections

Build a Strong Compliance Foundation

• Implement a recognized framework like ISO 27001
• Conduct regular internal audits of cybersecurity measures
• Test incident response procedures including reporting timelines
• Maintain up-to-date documentation of all security measures

Engage Management

• Brief the board regularly on cybersecurity risks and compliance status
• Ensure management training is documented and current
• Have management formally approve cybersecurity policies and measures
• Include cybersecurity on the regular board agenda

Common Questions

Can management really be personally fined?

Yes. NIS 2 explicitly provides for the liability of natural persons, including members of management bodies. While the specifics of personal liability may vary based on national transposition, the directive establishes a clear expectation that management takes active responsibility for cybersecurity compliance.

Are the penalties cumulative?

Yes, penalties can be applied for each infringement. Multiple violations of different NIS 2 requirements could result in separate penalties. Additionally, ongoing non-compliance may result in escalating enforcement measures, including periodic penalty payments.

What if our member state has not transposed NIS 2 yet?

Even if a member state has not yet transposed NIS 2 into national law by the October 2024 deadline, organizations should prepare for compliance. Late transposition does not eliminate the obligation, and organizations that delay may face a compressed compliance timeline once national law is enacted.