NIS2 Penalties: Fines and Consequences of Non-Compliance

For organisations in scope of NIS2, penalties can reach €10 million or 2% of worldwide annual turnover for essential entities, whichever is higher. Important entities face €7 million or 1.4%, while national laws can set higher maximums.

However, financial penalties are only part of the exposure under the penalty regime. Regulators can require corrective action and, under defined conditions, pursue service-authorisation suspensions or temporary management bans.

For your leadership team, the priority is demonstrable compliance: approved controls, tested reporting arrangements and evidence that security measures work. Understanding your classification is the starting point.

How NIS2 penalties are calculated

Article 34 sets different fine thresholds for breaches of NIS2 requirements covering cybersecurity risk management and incident reporting.

The distinction depends on your organisation's classification.

Entity classification	Fixed threshold	Turnover threshold
Essential	€10 million	2% of worldwide annual turnover
Important	€7 million	1.4% of worldwide annual turnover

In each case, the higher figure determines the Directive's required fine ceiling.

These figures are ceilings, not automatic fines

Member states must provide maximum fines of at least these amounts under the Directive's penalty regime, while national law can set higher ceilings. They aren't minimum penalties imposed on every organisation.

The turnover calculation uses the preceding financial year's total worldwide annual turnover of the undertaking to which the entity belongs. Therefore, exposure may extend beyond an individual subsidiary's revenue.

Unlike the original NIS Directive, NIS2 establishes these common EU-level penalty thresholds. Nevertheless, national enforcement procedures still matter.

A worked turnover calculation

For a €1 billion turnover base, the essential-entity calculation is €1 billion multiplied by 2%, producing €20 million. Because this exceeds €10 million, €20 million is the applicable Directive-level ceiling.

For an important entity with the same turnover base, 1.4% produces €14 million, exceeding the €7 million threshold.

Both calculations cross over at €500 million turnover. Actual penalties depend on the infringement and applicable national law.

Which organisations fall within scope?

The NIS2 framework, set out in the NIS2 Directive, strengthens cybersecurity obligations across organisations and their supply chains. It replaces the original NIS Directive and expands coverage from seven sectors to eighteen, including critical sectors.

NIS2 affects an estimated 100,000 organisations across the EU, including businesses in energy, healthcare, transport, digital infrastructure and certain manufacturing activities.

Size and sector determine the starting position

In covered sectors, businesses generally enter scope at 50 employees, or when both annual turnover and balance-sheet total exceed €10 million. Group relationships can affect this calculation.

Some organisations fall within scope regardless of size. Their sector, service type and national designation, including whether they operate in critical sectors, can determine whether they are essential and important entities.

Large Annex I entities generally qualify as essential. Other covered organisations generally fall into the important category, subject to exceptions.

UK organisations can still face exposure

NIS2 doesn't automatically apply to every UK business trading with Europe. However, EU establishments and certain services offered into the EU can bring UK-based groups within its jurisdiction, with cross-border coordination between relevant authorities.

The Directive entered into force on 16 January 2023. Member states had to transpose it by 17 October 2024 and apply measures from 18 October 2024. National implementation has followed staggered timetables.

The ten cybersecurity measures behind compliance

Article 21 sets out NIS2 requirements for appropriate and proportionate technical, operational and organisational measures. These cybersecurity risk management measures should address your organisation's risks. A cyberattack alone doesn't establish non-compliance; regulators examine whether you met your obligations.

A risk management framework can organise your programme around these ten areas:

1. Establish policies for risk analysis and information-system security, supported by consistent assessment criteria for risk assessments.

2. Maintain incident-handling arrangements covering assessment, investigation, containment, recovery and lessons learned.

3. Prepare business continuity measures, including backup management, disaster recovery and crisis management, and define how business continuity will be maintained during disruption.

4. Manage supply chain security, including relationships with direct suppliers and service providers.

5. Secure system acquisition, development and maintenance, including vulnerability handling and disclosure.

6. Define policies and procedures for assessing whether cybersecurity measures operate effectively.

7. Apply basic cyber hygiene practices and provide cybersecurity training appropriate to staff responsibilities.

8. Establish policies for cryptography and, where appropriate, encryption.

9. Address human-resources security, access control policies and asset management.

10. Use multi-factor or continuous authentication, secure communications and emergency communications where appropriate.

Tailor these cybersecurity risk management measures to your risks, organisational size and potential incident impact. Businesses don't need identical implementations.

Our risk assessment guidance explains how to define scope, evaluate dependencies and document treatment decisions. That approach provides a practical foundation for prioritising NIS2 controls.

What regulators can do beyond imposing fines

The supervisory regime for essential entities is stronger, with on-site inspections, off-site reviews, security scans, audits and random checks. National authorities can request documents and operating evidence before an incident occurs.

By contrast, the supervisory regime for important entities generally starts when authorities receive evidence or indications of non-compliance. Important entities can still face inspections and binding corrective instructions.

Enforcement can involve information requests, investigation, identified deficiencies and orders to remedy them. Authorities may combine fines with corrective measures, and there's no universal requirement to exhaust warnings before imposing a financial penalty.

For essential entities, further powers apply when enforcement measures prove ineffective and required remediation remains outstanding. These include temporary suspension of relevant certification or authorisation concerning affected services.

Authorities can also seek a temporary prohibition on a CEO or legal representative exercising managerial functions, subject to the Directive's conditions.

When deciding penalties, regulators consider seriousness, duration, negligence or intent, previous infringements and resulting harm. Cooperation and corrective action also matter.

  Prompt remediation can influence a penalty decision, but it doesn't erase the original infringement.  

Reporting significant incidents within 24 and 72 hours

NIS2 requires staged incident reporting to the relevant competent authority or computer security incident response team. The clock starts when your organisation becomes aware of a significant incident.

An incident can qualify because it causes, or could cause, severe operational disruption or financial loss. Considerable harm to others can also trigger reporting.

The early warning and incident notification

Submit an early warning without undue delay and within 24 hours. This 24-hour incident reporting deadline applies to the early warning. Where applicable, indicate suspected malicious activity and possible cross-border effects.

Then submit the incident notification without undue delay and within 72 hours. It must update the warning and provide an initial assessment of severity and impact, plus available indicators of compromise. Trust service providers have a separate 24-hour incident-notification deadline.

Final reporting and operational preparation

The final report is generally due within one month of the incident notification. It covers the incident, likely cause, mitigation measures and relevant cross-border impact to support cross-border coordination. Ongoing incidents require a progress report followed by a final report.

Appoint an incident lead, deputy and out-of-hours contacts to support incident management. Define who can isolate systems or approve service suspension, and preserve evidence throughout.

Management accountability and personal liability

Article 20 requires management bodies to approve cybersecurity risk management measures and oversee implementation. Top management must review these cybersecurity risk management measures and complete cybersecurity training.

Delegating implementation to IT or external support doesn't transfer statutory responsibility or leadership accountability. Boards need records of informed decisions, approved resources and follow-up on unresolved risks.

Management liability depends on national implementation. In some jurisdictions, leadership negligence can create personal exposure, so directors should understand the local rules governing their responsibilities.

Practical evidence includes management-review minutes showing top management's informed oversight, training records, risk acceptance decisions and tracked corrective actions. A signed policy without operating evidence provides limited assurance.

Where a full-time security executive isn't practical, our vCISO support provides experienced security leadership and board reporting.

Reduce exposure through controls and evidence

Strengthen supplier obligations

Supplier contracts should define security responsibilities, incident-notification arrangements and proportionate audit rights. Include expectations for subcontractors and access to evidence where relevant to support supply chain security.

Use ISO 27001 or NIST controls to structure requirements. Relevant SOC 2 reports can support vendor risk reviews, but their scope and findings matter.

For automotive businesses, ENX's TISAX assessment process provides a structured mechanism for assessing and exchanging information-security results. TISAX training and consultancy can support preparation, while only approved providers conduct official assessments.

Assess third-party risk across dependencies and supplier relationships. Neither a supplier certificate nor a TISAX label removes your responsibility to assess those risks.

Reuse working controls without claiming equivalence

An ISO 27001 management system provides a useful structure for risk assessment, internal audit and continual improvement. However, certification doesn't automatically demonstrate NIS2 compliance.

ISO 27001 training develops capability, while consultancy and internal auditing can support implementation and testing.

Start with a focused readiness review:

• Record applicable entities, countries, services and reporting authorities.

• Assign each control an owner, deadline and evidence requirement.

• Test incident escalation and reporting through an exercise.

• Retain access reviews, restoration-test results, supplier assessments and completed remediation records.

Reuse evidence only where it covers the relevant systems and proves the required action occurred. Review scope after acquisitions, cloud migrations or major supplier changes.

Key takeaways for your leadership team

• Your entity classification determines the starting fine threshold, while worldwide undertaking turnover can increase exposure.

• Regulators assess governance and operating controls alongside incident reporting, so evidence must demonstrate implementation.

• Corrective orders, authorisation suspensions and management restrictions can create consequences beyond the financial penalty.

The practical priority is to identify material gaps early and give remediation clear ownership.

Frequently asked questions

What does NIS2 stand for?

NIS2 is the second Network and Information Security Directive. Its formal designation is Directive (EU) 2022/2555, which establishes cybersecurity obligations across specified sectors.

Can an organisation face penalties without suffering a breach?

Yes. Failure to implement required risk management measures can trigger enforcement without a successful cyberattack. Conversely, an incident doesn't automatically prove a compliance failure.

Do other certifications satisfy NIS2?

No framework provides automatic equivalence. ISO 27001, TISAX, CMMC and ISO 42001 address different scopes and purposes. Relevant controls can support compliance, but NIS2-specific obligations still require assessment.

Make compliance demonstrable before enforcement

NIS2 compliance depends on classification, national law and the circumstances of non-compliance. Your strongest practical response is documented implementation, supported by tested controls and accountable leadership.

Prioritise material gaps and reporting readiness before enforcement exposes weaknesses.

If you would like to find out more information or require any of our services please Contact Us and complete our contact form.