NIS2 Fines: Maximums of at Least EUR 10 Million or 2 % of Turnover, and How Member States Apply Them

They cover non-compliance with Article 21 (risk-management measures) and Article 23 (reporting).

The Directive is addressed to the Member States (Article 46), so an organisation faces the fine its national law sets, within the limits the NIS2 Directive obliges every Member State to provide.

Article 34 writes its figures as minimum ceilings, counts the percentage on the undertaking's turnover and leaves the amount to the circumstances of Article 32(7). Member States add periodic penalty payments and penalties for other breaches and set their own maximums, while Article 35 rules out a second fine after a GDPR fine. The table below summarises the rules.

What Maximum Fines Does Article 34 Set?

Article 34 sets two maximums: for essential entities a maximum of at least EUR 10,000,000 or at least 2 % of the total worldwide annual turnover in the preceding financial year of the undertaking, whichever is higher (Article 34(4)), and for important entities a maximum of at least EUR 7,000,000 or at least 1.4 %, whichever is higher (Article 34(5)). Both categories carry the same duties under Articles 20, 21 and 23; they differ in supervision and fine level, not in lighter obligations. Both paragraphs are in the Directive text on EUR-Lex, and the table below compares the categories.

Why the Figures Are Minimum Ceilings, Not Fixed Amounts

The words "maximum of at least" set a floor for the national maximum, not a fine amount: each Member State must allow fines at least this high, and the amount in an actual case is set below that ceiling. A national law may provide a higher maximum, never a lower one. EUR 10,000,000 or 2 %, whichever is higher, is therefore neither a standard fine nor an EU-wide upper limit.

Which Infringements the Harmonised Maximums Cover

The Article 34 maximums apply only to infringements of Article 21 (cybersecurity risk-management measures) and Article 23 (reporting obligations). A failure to take the ten measures of Article 21(2), points (a) to (j), falls within them, and so does a missed 24-hour early warning, 72-hour notification or final report one month after the notification. Other duties, such as registration under Article 3(4) or Article 27, sit outside these caps. Article 36 requires Member States to lay down penalty rules for those infringements and to notify them by 17 January 2025.

How Worldwide Turnover Is Counted for the Undertaking

The percentage applies to the total worldwide annual turnover of the undertaking the entity belongs to, in the sense of Articles 101 and 102 TFEU (recital 130), for the preceding financial year. For an entity inside a group, the reference figure is the undertaking's turnover, not only its own. The break-even point is EUR 500 million (calculated): 2 % of it equals EUR 10,000,000 and 1.4 % equals EUR 7,000,000, so the fixed amount is higher below that turnover and the percentage above it. Germany uses the same figure differently: § 65(6) and (7) BSIG apply the percentages only where total turnover exceeds EUR 500 million. The six cases below compare both rules.

How Do Authorities Decide Whether to Fine and How Much?

Authorities decide case by case: Article 34(3) requires them to take the circumstances listed in Article 32(7) into account before they decide whether to impose a fine and how high it is. NIS2 non-compliance therefore does not lead to a fine automatically. Fines sit in the supervision and enforcement toolkit of Articles 32 and 33, beside audits, inspections and orders, explained under NIS2 supervision and enforcement.

Serious Infringements and the Weighing Factors

Article 32(7)(a) names the infringements that count as serious in any event, whatever the facts of the case. The five serious infringements of Article 32(7)(a) are listed below.

• Repeated violations.
• Failure to notify or remedy significant incidents.
• Failure to remedy deficiencies after binding instructions from the competent authority.
• Obstruction of audits or monitoring activities.
• False or grossly inaccurate information on the risk-management measures (Article 21) or the reporting obligations (Article 23).

The authority weighs point (a) together with the further circumstances of Article 32(7), so an entity that has ignored a binding instruction enters any fine decision with an infringement the Directive classes as serious.

Fines in Addition to Other Enforcement Measures

A fine comes on top of the other enforcement measures, not instead of them: Article 34(2) imposes fines in addition to the measures in Article 32(4)(a) to (h), Article 32(5) and Article 33(4)(a) to (g). Those measures include warnings, binding instructions, orders and publication; a monitoring officer exists for essential entities only (Article 32(4)(g)). Article 32(5) adds two steps for essential entities alone, the suspension of a certification or authorisation and a temporary ban at chief executive officer or legal-representative level, after measures under Article 32(4)(a) to (d) and (f) have failed and a deadline was missed.

Which Other Penalties Can Member States Impose?

Beyond the Article 34 fines, Member States can add periodic penalty payments (Article 34(6)), must set penalties for all other breaches (Article 36), and decide how public administration entities are fined (Article 34(7)). Article 34(8) adds a court route for legal systems without administrative fines.

Periodic Penalty Payments

Periodic penalty payments are optional under Article 34(6): a Member State may provide for them to compel an entity to end an infringement. Germany allows a Zwangsgeld (coercive fine) of up to EUR 100,000 under § 63 BSIG. Luxembourg's law of 5 May 2026 sets an astreinte of up to EUR 1,250 per day, with the total capped at EUR 25,000 per established breach (Article 26(7)). At the daily maximum, the Luxembourg cap is reached after 20 days of continued non-compliance (calculated).

National Penalties for Other Breaches

For breaches outside Articles 21 and 23 the national law sets its own penalties under Article 36, and in the five laws below they are far lower than the Article 34 caps. Germany fines a failure to register at up to EUR 500,000 (§ 65(2) Nos. 6 and 8, (5) No. 5 BSIG) and obstruction of on-site checks at up to EUR 100,000 (§ 65(2) No. 17, (5) No. 6). Austria fines late registration, a missing self-declaration or audit report and obstruction at up to EUR 50,000, or EUR 100,000 for a repeat (§ 45(4) NISG 2026). Registration duties are set out under NIS2 registration.

Italy sets registration-type breaches at up to 0.1 % of worldwide turnover (essential) and 0.07 % (important) (Article 38(10) and (11) d.lgs. 138/2024), and a missing or late registration raises the most serious sanction up to threefold (Article 38(13)). The Netherlands caps violations outside Articles 21, 21a and 25 to 30 Cbw at EUR 1,000,000 (Articles 80(3), 87(3)). Romania fines registration and notification breaches at RON 1,500 to 500,000 (essential) and RON 1,000 to 300,000 (important) (Article 60(2)(c), (d) OUG 155/2024).

Public Administration and Court-Imposed Fines

Each Member State decides whether and to what extent public administration entities can be fined (Article 34(7)). Austria imposes no fines on the public sector: the authority establishes the breach by decision with a deadline and publishes it if the breach is not cured (§ 46 NISG 2026). The Dutch fine provisions contain no public-body exemption (Article 79 Cbw). Sweden caps the sanction fee for public operators at SEK 10,000,000 (4 kap. 10 § Cybersäkerhetslag).

Under Article 34(8), the competent authority initiates the fine and the national courts impose it, and Member States had to notify those provisions by 17 October 2024. Denmark follows this route: NIS 2-loven § 32 provides for fines (bøde) under criminal procedure, with no amounts fixed in the Act.

How Do National Laws Set Their Fine Maximums?

The 18 national laws in the table below express the Article 34 maximums in five ways: 13 restate EUR 10,000,000 or 2 % and EUR 7,000,000 or 1.4 % in euro, Hungary and Sweden use the forint and krona equivalent, Czechia sets its own koruna amounts, Germany applies the percentage only above EUR 500 million of total turnover, and Denmark leaves the amount to the courts. The transposition status of every Member State, including those without a row here, is tracked in the NIS2 transposition tracker.

National maximums as of 23 October 2026; the national act decides.

As of 23 October 2026, Ireland has not transposed NIS2 or published its National Cyber Security Bill, and France has not adopted its NIS2 law, so neither has a national fine rule to compare.

Where National Caps Depart from the Directive

Four kinds of national deviation matter for the amount: a turnover threshold, minimum fines, currency, and reductions or increases. Germany sets EUR 10,000,000 for besonders wichtige Einrichtungen (essential entities) and EUR 7,000,000 for wichtige Einrichtungen (important entities), and adds 2 % or 1.4 % only where total turnover exceeds EUR 500 million, so an entity below that turnover faces the fixed amount alone (case E; § 65 BSIG on gesetze-im-internet.de). Czechia sets its own amounts, CZK 250,000,000 and CZK 175,000,000, and measures the percentage on net worldwide turnover.

Minimum fines set a lower end in eight of the laws in the table: Belgium, Bulgaria, Croatia (with percentage minimums of 0.5 % and 0.2 %), Italy, Portugal, Romania, Slovakia and Sweden. In Italy, one twentieth of a EUR 10,000,000 maximum is a minimum fine of EUR 500,000 (calculated). Three laws change the amount in other ways: Belgium doubles the fine for a repeat within three years, Bulgaria halves fines for breaches before 1 June 2026, and Finland requires an intentional or grossly negligent breach (§ 35 Kyberturvallisuuslaki).

How Does the No-Double-Fine Rule Work for Personal Data Breaches?

An entity cannot receive an Article 34 fine for conduct that a data protection authority has already fined under Article 58(2)(i) of Regulation (EU) 2016/679, although the other NIS2 enforcement measures stay available (Article 35(2)). The rule starts with an information duty: where an infringement of Article 21 or 23 can entail a personal data breach, the NIS2 authority informs the data protection authority without undue delay (Article 35(1)). An incident that exposes customer data can breach both regimes; a GDPR fine for that conduct then rules out the Article 34 fine, while the measures of Articles 32(4), 32(5) and 33(4) remain. Article 58(2)(i) is in the GDPR text on EUR-Lex, and the overlap is compared in NIS2 vs the GDPR.

Finland writes the rule into its own act with another reference point: no sanction fee is imposed where a fine under Article 83 GDPR was imposed for the same act (§ 39 Kyberturvallisuuslaki 124/2025).

Where Do NIS2 Fines Stand as of October 2026?

As of 23 October 2026, no fine at the level of Article 34 has been found in any primary source, so the caps describe exposure, not enforcement practice. The fine articles of the Directive are unchanged, because no amending act has been adopted.

Two proposals are pending. COM(2026) 13 of 20 January 2026 (procedure 2026/0012(COD)) is with the European Parliament, marked "Awaiting committee decision" by the EP Legislative Observatory, and the Digital Omnibus COM(2025) 837 is pending after Coreper agreed the Council mandate on 21 October 2026. Both are tracked under NIS2 amendments and review.

How to Reduce the Risk of a NIS2 Fine

Exposure to a NIS2 fine falls when an entity can show its classification, its Article 21 measures and its reporting record, so prepare these five things in this order. The five steps are listed below.

1. Confirm whether and how NIS2 applies with the NIS2 scope check; the category decides which Article 34 maximum applies.
2. Register with the national authority (NIS2 registration).
3. Close gaps against the ten Article 21 risk-management measures with a NIS2 gap analysis.
4. Set up the process for the 24-hour early warning, the 72-hour notification and the final report one month after the notification (NIS2 incident reporting).
5. Keep evidence for audits and of the management body's approval (Article 20(1)), as listed in the NIS2 compliance requirements.

Penalties on Managers and on Member States

Article 34 fines the entity, not its managers and not the Member State: the Directive sets no personal fine on managers, and penalties on Member States follow a separate procedure before the Court of Justice. On 8 July 2026 the European Commission decided to refer Ireland, Spain, France and the Netherlands to the Court of Justice of the EU for failing to notify measures transposing NIS2, with a request for a lump sum and daily penalties under Articles 258 and 260(3) TFEU (Commission press release IP/26/1499).

For managers, recital 128 sets no EU requirement of civil or criminal liability towards third parties, and Article 32(5)(b) allows a temporary ban for essential entities only. The Netherlands goes further and fines a board member up to EUR 25,000 for breaching Article 24(2) to (6) Cbw (Article 93 Cbw), as covered under NIS2 management liability.

NIS2 Fines Questions

Five questions recur about NIS2 fines.

Is EUR 10 million the upper limit in every Member State?

No: EUR 10,000,000 or 2 % of worldwide turnover, whichever is higher, is the minimum each Member State must allow as its maximum for essential entities, and 2 % of a large undertaking's turnover can exceed it; Germany applies the percentage only above EUR 500 million of turnover.

Is the 2 % calculated on the entity's or the group's turnover?

On the undertaking's: Article 34(4) and (5) and recital 130 use the total worldwide annual turnover of the undertaking the entity belongs to, in the sense of Articles 101 and 102 TFEU.

Does late registration lead to a fine of EUR 10 million?

No: registration breaches fall under national penalties (Article 36), for example up to EUR 500,000 in Germany and up to EUR 50,000 in Austria.

Can an important entity be fined as much as an essential entity?

The Directive sets a lower floor for important entities (EUR 7,000,000 or 1.4 %, whichever is higher), while their Article 21 and 23 duties are the same as for essential entities.

When could national NIS2 fines first be imposed?

Only once the national law applies: Member States had to apply their measures from 18 October 2024 (Article 41(1)), and each national act sets its own start, for example 6 December 2025 for the BSIG 2025 in Germany and 1 October 2026 for the NISG 2026 in Austria.