NIS2 Fines & Penalties 2026
NIS2 introduces some of the highest cybersecurity fines in EU history — up to 10 million EUR or 2% of global annual turnover, plus personal liability for management. Here's everything you need to know.
Fine structure at a glance
EUR 10M
or 2% of global annual turnover — whichever is higher
EUR 7M
or 1.4% of global annual turnover — whichever is higher
How NIS2 fines are calculated
The headline numbers are maximums, not flat fees, and they are national. Article 34(4) and (5) of the directive set no fine: they require each member state to provide a maximum of at least these amounts, and most national acts adopted them as their own. For each class the maximum is the figure that is higher, the fixed amount or the percentage of turnover. The percentage is calculated on the total worldwide annual turnover, in the preceding financial year, of the undertaking to which the entity belongs. The directive uses that word in its competition-law sense (recital 130), so for a company that belongs to a group it can mean the group's turnover. National acts word that base differently: read yours.
Below the national maximum, Article 34(1) requires each fine to be effective, proportionate and dissuasive, and Article 34(3) requires due regard, as a minimum, to the elements of Article 32(7), among them:
- Seriousness and duration of the infringement
- Whether it was intentional or merely negligent
- Actual damage caused and number of users affected
- Steps taken to prevent or mitigate the harm
- Degree of cooperation with the authority
- Any previous infringements by the entity
Crucially, administrative fines can be imposed in addition to other enforcement measures — binding instructions, security audits at the entity's expense, public disclosure of the breach, and, for essential entities, temporary management bans.
Has anyone actually been fined yet?
Short answer, as of this page's last review: no NIS2 fine has been published by a competent authority that we can verify against an official source. Anyone telling you otherwise should be able to name the decision.
Administrative fines are rarely announced. Competent authorities are not obliged to publish them, and companies do not volunteer them. "No reported fine" means the public record is empty, not that the regime is dormant.
The German BSIG is explicit about the sequence. Under § 61 Abs. 1 BSIG the BSI does not run audits itself, it orders them from independent bodies. And under § 61 Abs. 3 it may require evidence from other especially important entities only three years after the law entered into force. That is a deliberate ramp, not an amnesty: the registration and reporting duties bite immediately.
The first duty enforced in practice is the cheapest one to miss. Registration under § 33 Abs. 1 BSIG runs on a rolling three-month clock from the day an entity first falls in scope, through a portal operated jointly by the BSI and the BBK.
Directors are personally liable to their own company. § 38 Abs. 2 BSIG routes the management body's breach of its § 30 duties back through company law, so the exposure is not only the entity's fine. This is why NIS2 reaches the board agenda in Germany and not only the IT budget.
A GDPR fine blocks a second fine on the same conduct. § 65 Abs. 11 BSIG prevents cumulation where a supervisory authority has already fined the same behaviour under Article 58(2)(i) GDPR. An incident that is both a personal-data breach and a NIS2 reportable incident still carries both notification duties, but not two fines for one act.
Sources: BSIG §§ 33, 38, 61 and 65, as published in the Bundesgesetzblatt. Where this page states an amount or a deadline, it is quoted from the statute, not from secondary reporting.
NIS2 fines by country: who enforces them
The directive sets the level each national maximum must at least reach. Each EU member state transposes NIS2 into national law, sets its own amounts and names its own competent authority, so the amounts, the enforcement regime and the procedure differ by country.
Germany's transposition law (the NIS2UmsuCG, in force since December 2025) re-enacts the BSIG and is administered by the BSI (Bundesamt für Sicherheit in der Informationstechnik). German fines (Bußgelder) are graduated in six bands by type of breach (§ 65 BSIG). The top band reaches EUR 10M or 2% of turnover for essential entities and EUR 7M or 1.4% for important entities, the level the directive requires. There is no transitional grace period: obligations apply from entry into force, with an estimated ~29,500 entities now in scope.
Italy transposed NIS2 with D.Lgs. 138/2024, enforced by the ACN (Agenzia per la Cybersicurezza Nazionale). The fine ceilings match the EU minimums (€10M/2% for soggetti essenziali, €7M/1.4% for soggetti importanti), with technical measures and notification timelines set progressively through ACN determinazioni.
France's transposition is being finalised through the “Loi Résilience” bill, with ANSSI as the competent authority. The bill sets its maxima at the level the directive requires (EUR 10M or 2%, EUR 7M or 1.4%) and has a commission des sanctions impose them; entities should track the final text and ANSSI guidance via MesServicesCyber.
Reglyze ships country-specific NIS2 transposition data and authority-formatted incident reports for Germany, France, Italy, Portugal, Belgium and more — so the fine framework you see matches your jurisdiction.
Full country guides: NIS2 in Germany, NIS2 in Italy and NIS2 in the Netherlands.
Personal liability for directors
NIS2 Article 20 makes the management body answerable.
The management body approves the cybersecurity risk-management measures, oversees their implementation and can be held liable for the entity's infringements of Article 21 (Article 20(1)). The directive puts no fine on a director: what a person risks beyond that is set by national law.
- A temporary ban from managerial functions, in an essential entity, once a remedy deadline is missed (Article 32(5)(b))
- Liability for breach of duty, which member states must make possible (Article 32(6)); in Germany it is owed to the entity itself, under company law (§ 38 Abs. 2 BSIG)
- A fine on the person, only where the national act provides one: Poland does (art. 73a KSC), Italy does not (art. 38 c. 6 D.lgs. 138/2024)
What triggers fines?
Failure to implement the 10 minimum security measures (NIS2 Article 21)
Missing the 24-hour early warning deadline for significant incidents
Missing the 72-hour incident notification deadline
Missing the 1-month final report deadline
Failure to register with the competent authority, where the national act fines it (Germany: § 65 Abs. 2 Nr. 6 BSIG)
Failure to notify the recipients of your services, where appropriate, of a significant incident likely to affect them (NIS2 Article 23(1))
Failure to provide cybersecurity training and basic cyber hygiene practices (NIS2 Article 21(2)(g))
Failure to conduct regular risk assessments
Failure to maintain business continuity and incident response plans
NIS2 fines — frequently asked questions
How much are NIS2 fines?
In most member states, up to EUR 10 million or 2% of total worldwide annual turnover, whichever is higher, for essential entities, and up to EUR 7 million or 1.4% for important entities. Those are national maxima. The directive sets no fine itself: Article 34 requires each member state to provide a maximum of at least those amounts. Some national acts go higher, so the amount that applies to you is the one your country's act sets.
Can company directors be personally fined under NIS2?
Not under the directive itself: the administrative fines of Article 34 are imposed on the entity. The management body answers in other ways. It approves the risk-management measures, oversees their implementation and can be held liable for the entity's infringements of Article 21 (Article 20(1)). In an essential entity, once a remedy deadline is missed, the authority can request a temporary prohibition from managerial functions at chief executive or legal-representative level (Article 32(5)(b)). National acts differ on the person: in Poland the head of the entity can be fined up to 300% of their remuneration, on top of the entity's fine (art. 73a KSC); in Italy there is no fine on the person, only an accessory incapacity to hold management functions (art. 38 c. 6 D.lgs. 138/2024).
What is the difference between essential and important entity fines?
Essential entities face the higher maximum, at least EUR 10M or 2% of worldwide turnover under Article 34(4), and proactive, ex-ante supervision: authorities can audit without prior suspicion. Important entities face a maximum of at least EUR 7M or 1.4% under Article 34(5) and reactive, ex-post supervision: authorities act on evidence of a breach. Your category depends on your sector and company size.
Has anyone been fined under NIS2 yet?
Not that we can verify. No NIS2 fine has been confirmed by a competent authority against an official source, and we will not cite one we cannot name. That is weaker evidence than it looks: administrative fines are rarely announced, authorities are under no duty to publish them, and companies do not volunteer them. What is certain is that the duties are already live. Germany transposed NIS2 through the NIS2UmsuCG (in force since December 2025), administered by the BSI: registration runs on a rolling three-month clock (§ 33 Abs. 1 BSIG) and the 24-hour and 72-hour reporting deadlines apply from the day an entity falls in scope.
How can I avoid NIS2 fines?
Most penalties come from three failures: not implementing the 10 minimum security measures in NIS2 Article 21, missing the incident-reporting deadlines (24-hour early warning, 72-hour notification, one-month final report), and failing to register with your national authority. Run a scoping check, close your Article 21 gaps, and put an incident-reporting process in place before an incident — not after.
Want to estimate your own exposure? Try the NIS2 fine calculator.