Free tool
NIS2 Fine Calculator
Estimate your maximum NIS2 penalty exposure based on your turnover, entity classification, and country. Updated for 2026 enforcement.
Disclaimer: This is an indicative estimate of the legal maximum. Actual fines depend on the severity of the breach and national authority discretion. Not legal advice.
Global annual turnover. For groups, use consolidated turnover.
How NIS2 fines work
The NIS2 Directive (EU 2022/2555) sets no fine itself. For infringements of Articles 21 and 23, Article 34 requires each EU member state to provide a maximum of at least:
- Essential Entities: EUR 10 million or 2% of total worldwide annual turnover, whichever is higher.
- Important Entities: EUR 7 million or 1.4% of total worldwide annual turnover, whichever is higher.
Because the formula uses "whichever is higher", the maximum scales with revenue for the largest companies. For an Essential Entity with EUR 1 billion of turnover, a national maximum set at that level is EUR 20 million (2% of EUR 1B), not EUR 10M.
The management body: under Article 20(1) it can be held liable for the entity's infringements of Article 21. In an Essential Entity, once a remedy deadline is missed, the authority can request a temporary prohibition from managerial functions at chief executive or legal-representative level (Article 32(5)(b)). The directive puts no fine on a director: what a person risks beyond that is set by national law.
For the full picture — recent enforcement, the country-by-country authorities and how to avoid penalties — read our guide to NIS2 fines and penalties.
How the maximum is calculated — three worked examples
The "whichever is higher" rule means the turnover percentage only beats the fixed amount once a company is large enough. For an Essential Entity (10M / 2%):
- EUR 8M turnover: 2% = EUR 160,000, well below the EUR 10M fixed amount → maximum is EUR 10 million.
- EUR 500M turnover: 2% = EUR 10 million, exactly the fixed amount → maximum is EUR 10 million.
- EUR 1 billion turnover: 2% = EUR 20 million, above the fixed amount → maximum is EUR 20 million.
The crossover point is EUR 500M turnover for Essential Entities and EUR 500M for Important Entities (1.4% of EUR 500M = EUR 7M). Below it, almost every SME's maximum is the fixed amount, not a percentage, which is why the headline 10M / 7M figures matter most for small and medium organisations.
What makes a real fine bigger or smaller
The calculator shows the legal maximum. Actual fines are set by national authorities, and Article 34(3) requires them to have regard, as a minimum, to the elements of Article 32(7):
- The seriousness of the infringement and the importance of the provisions breached. Repeated violations, a failure to notify or remedy a significant incident, a failure to remedy deficiencies after binding instructions, the obstruction of an audit and false or grossly inaccurate information always count as serious.
- The duration of the infringement, and any relevant previous infringements by the entity.
- The damage caused, material or not: financial or economic loss, effects on other services and the number of users affected.
- Any intent or negligence.
- The measures the entity took to prevent or mitigate the damage, and any adherence to approved codes of conduct or certification mechanisms.
- The level of cooperation with the competent authorities.
The practical takeaway: the maximum is the limit of the exposure, not a forecast. What these elements let an authority credit is what you can show: the measures you took to prevent or limit the damage, how long the infringement lasted and how you cooperated.
Who sets and collects the fine
Each EU member state enforces NIS2 through its own authority, under its own act and with its own amounts:
- Germany: the BSI, under the NIS2UmsuCG / BSIG 2025. The fine schedule (§ 65 Abs. 5) lays out six bands by type of breach, from EUR 100,000 up to EUR 10 million, with a percentage of turnover above EUR 500 million of turnover (§ 65 Abs. 6 and 7). See NIS2 in Germany.
- Italy: the ACN, under D.Lgs 138/2024. The fine hits the entity, not its directors: for them the decree provides an accessory incapacity to hold management functions (art. 38 c. 6). See NIS2 in Italy.
- France: a dedicated commission des sanctions (not ANSSI directly) imposes the fine, after ANSSI's graduated warnings and orders.
For recent enforcement cases and the full country-by-country breakdown, read our guide to NIS2 fines and penalties.
Recent enforcement reality
No NIS2 fine has been published yet, and that is not reassurance
We can find no NIS2 fine confirmed by a competent authority against an official source. Administrative fines are rarely announced: authorities are not obliged to publish them and companies do not volunteer them, so an empty public record says nothing about how many files are open. What is already in force is the duty: registration runs on a rolling three-month clock (§ 33 Abs. 1 BSIG) and the reporting deadlines apply from day one.
Treat the figure above as exposure, not as a forecast. The calculator applies the amounts of Article 34(4) and (5), which each national maximum must at least reach; Poland goes higher, up to PLN 100 million in aggravated cases (art. 73 ust. 5 KSC). What an authority actually imposes depends on the elements of Article 32(7) of the directive, to which Article 34(3) refers, and the German BSIG sets six bands under § 65 rather than a single maximum.