NIS2 Supervision and Enforcement: Ex-Ante vs Ex-Post, Audits, Inspections and Orders

Chapter VII of the Directive (Articles 31 to 37) is addressed to the Member States (Article 46) and reaches organisations only through the national law, which Member States had to apply from 18 October 2024 (Article 41(1)). How the rest of the NIS2 Directive is built is explained on the home page.

This page compares the two regimes, gives every power and measure with its article and point, and covers the monitoring officer, preliminary findings, mutual assistance, three national approaches and the status as of 23 October 2026.

What Is NIS2 Supervision and Enforcement?

NIS2 supervision and enforcement is the set of powers that Articles 31 to 37 of the Directive require Member States to give their competent authorities so that they can check compliance with the risk-management and reporting duties and correct infringements. Supervision covers checks such as inspections, audits and information requests; enforcement covers the measures that follow an infringement, such as binding instructions and fines.

Article 31(2) lets Member States allow their competent authorities to prioritise supervisory tasks on a risk basis (recital 124).

Essential and important entities carry the same obligations under Articles 20, 21 and 23. They differ in two points only: the supervisory regime and the maximum fine. Every power on this page belongs to a national competent authority.

Ex-Ante vs Ex-Post Supervision Compared

Essential entities are subject to comprehensive supervision before and after any incident (ex ante and ex post, Article 32), while important entities are supervised only ex post, when the authority receives evidence, indication or information that they do not comply (Article 33(1), recital 122). Table 1 sets the two regimes side by side.

Light supervision is not the absence of supervision. Once a trigger reaches the authority, an important entity faces inspections, targeted audits and enforcement measures. The regime follows the entity's category under the national rules that transpose Article 3, so the authority does not pick a regime case by case.

Ex-Ante Supervision under Article 32: Inspections, Audits and Scans

Under Article 32(2), the competent authority can supervise an essential entity at any time through on-site inspections and off-site supervision including random checks, regular, targeted and ad hoc security audits, security scans, and requests for information, data access and evidence. No incident or suspicion has to come first.

Regular and targeted audits under Article 32(2)(b) are carried out by an independent body or by a competent authority. Ad hoc audits under point (c) include audits justified by a significant incident or an infringement. Information requests under point (e) include documented cybersecurity policies and evidence of compliance with the Article 27 registration duty, and evidence requests under point (g) include the results of audits by a qualified auditor with the underlying evidence. Which organisations count as essential entities is set out on their own page.

The costs of a targeted security audit carried out by an independent body are paid by the audited entity, except in duly substantiated cases when the competent authority decides otherwise (Article 32(2), third subparagraph).

Ex-Post Supervision under Article 33: Evidence-Triggered Checks

Article 33(1) obliges the competent authority to act against an important entity where it is provided with evidence, indication or information that the entity does not comply, through ex post supervisory measures only.

The powers of Article 33(2) are on-site inspections and off-site ex post supervision, targeted security audits only (point (b)), information requests including evidence of compliance with Article 27 (point (d)) and requests for evidence (point (f)). Regular and ad hoc audits are not available. Article 33(5) applies Article 32(6), (7) and (8) mutatis mutandis. The size thresholds and sectors of important entities are explained separately.

Enforcement Measures: Warnings, Binding Instructions and Orders

Once an infringement is established, Article 32(4) lets the authority issue warnings, binding instructions and orders, appoint a monitoring officer and make the infringement public, and Article 33(4) gives it the same set for important entities except the monitoring officer. Under Articles 32(4)(d) and 33(4)(d), the authority can order an entity to meet its Article 23 reporting obligations in a specified manner and period, and under Article 32(4)(f) it can order an essential entity to implement audit recommendations within a reasonable deadline.

Article 32(7)(a) names five infringements that count as serious in any event, listed below.

• repeated violations;
• failure to notify or remedy significant incidents;
• failure to remedy deficiencies after binding instructions;
• obstruction of audits or monitoring activities;
• false or grossly inaccurate information on the Article 21 measures or Article 23 reporting.

Escalation under Article 32(5) exists for essential entities only. Where measures under Article 32(4)(a) to (d) and (f) fail and the authority's deadline has passed, it can request the suspension of a certification or authorisation and a temporary ban on managerial functions at chief executive officer or legal representative level. Bodies, courts or tribunals impose these measures, which last only until the entity remedies the infringement and are a last resort (recital 133). Fines can be imposed in addition to all of these measures (Article 34(2)).

The Monitoring Officer

A monitoring officer is a person the competent authority may designate, as an enforcement measure under Article 32(4)(g), to oversee an essential entity's compliance after an infringement. Article 33(4) has no equivalent, so an important entity is never assigned one under the Directive. The officer follows an infringement and is not a standing supervisor.

Preliminary Findings and the Right to Be Heard

Before it takes an enforcement decision, the authority notifies the entity of its preliminary findings and gives it reasonable time to submit observations, unless immediate action is needed to prevent or respond to incidents (Article 32(8)). Important entities have the same right through Article 33(5).

Further Consequences for Entities and Managers

Beyond orders, an infringement can lead to an administrative fine, an audit order and, for essential entities only, a temporary management ban, each explained on its own page. For infringements of Article 21 or 23, the maximum fine is at least EUR 10,000,000 or 2 % of total worldwide annual turnover for essential entities (Article 34(4)) and at least EUR 7,000,000 or 1.4 % for important entities (Article 34(5)), whichever is higher in each case. Other infringements, such as a failure to register, fall under the national penalties of Article 36. Table 2 lists the three consequences.

Cross-Border Supervision and Mutual Assistance

Where an entity provides services in more than one Member State, or in one Member State with network and information systems in another, Article 37(1) requires the competent authorities concerned to cooperate and assist each other. Assistance covers information requests, on-site inspections, off-site supervision and targeted audits. A request may be refused only for lack of competence, disproportionality, or essential national security, public security or defence interests, and joint supervisory actions need common agreement (Article 37(2)).

Under Article 26(5), a Member State that receives a mutual-assistance request about one of the 11 types of Article 26(1)(b) may take supervisory and enforcement measures within the limits of the request where the entity provides services or has a network and information system on its territory. The pending proposal COM(2026) 13 would give ENISA a reinforced coordinating role in cross-border supervision. Jurisdiction under NIS2 follows Article 26(1), and the rules on NIS2 jurisdiction decide which authority leads.

Three National Approaches to Ex-Ante and Ex-Post Supervision

National laws keep the two regimes but set their own timing: Germany lets the BSI order essential entities to obtain independent audits, Austria allows the first request for independent proof only two years after its law entered into force, and the Dutch supervisor RDI describes its supervision of essential entities as proactive and of important entities as reactive. Table 3 covers these three laws only. In Germany, essential entities are called besonders wichtige Einrichtungen (particularly important entities) and important entities wichtige Einrichtungen.

Supervision rules in three national NIS2 laws, as read on 23 October 2026.

Supervision and Enforcement Status on 2026-10-23

As of 23 October 2026, Articles 31 to 37 have been due for application through national law since 18 October 2024, and the Commission has enforced transposition itself: letters of formal notice to 23 Member States on 28 November 2024, reasoned opinions to 19 on 7 May 2025, and the referral of Ireland, Spain, France and the Netherlands to the Court of Justice on 8 July 2026 with a request for a lump sum and daily penalties. The referrals concern the failure to notify measures transposing NIS2 (Commission press release IP/26/1499), and the letters of formal notice are listed in the infringement package INF/24/5988.

An entity is supervised under these articles only once the law of its Member State applies, and each country's status is tracked in the NIS2 transposition tracker.

COM(2026) 13 (procedure 2026/0012(COD)), proposed by the Commission on 20 January 2026, is pending at "Awaiting committee decision" in the European Parliament's ITRE committee as of 23 October 2026, after the draft report of 24 September 2026. It would introduce a cyber posture certificate that would remove additional supervisory audits for the requirements it covers.

What NIS2 Supervision Does Not Cover

NIS2 supervision does not come from an EU agency, does not reach financial entities that DORA covers, and treats public bodies with two specific limits.

Does an EU Agency Supervise Companies?

No: ENISA has no supervisory or fining powers over entities under NIS2, and supervision lies with the national competent authorities (Articles 31 to 33). The NIS2 authorities of each Member State, its competent authority, single point of contact and CSIRT, are listed under NIS2 authorities.

Are Public Bodies Supervised Differently?

Yes, in the two points listed below.

• Authorities need operational independence from the public administration entities they supervise (Article 31(4)).
• The Article 32(5) suspensions and management bans do not apply to public administration entities.

Whether administrative fines apply to them is a national choice (Article 34(7)).

Who Supervises Financial Entities and Their ICT Providers?

Financial entities covered by DORA (Regulation (EU) 2022/2554) fall outside NIS2 supervision: as the sector-specific act under Article 4, DORA displaces NIS2 Articles 20, 21, 23 and Chapter VII for them, while Articles 7, 9 and 16 still apply.

NIS2 authorities inform the DORA Oversight Forum when they supervise an entity designated as a critical ICT third-party service provider (Articles 32(10) and 33(6)). The overlaps are compared under NIS2 vs DORA.