In brief
Under NIS2, maximum fines must be at least EUR 10 million or 2% of total worldwide annual turnover for essential entities and EUR 7 million or 1.4% for important entities – whichever is higher (Article 34). Supervisory measures and the accountability of management add to the risk.
What are the NIS2 penalties?
For essential entities, Member States must set the maximum fine at at least EUR 10,000,000 or at least 2% of total worldwide annual turnover in the preceding financial year, whichever is higher.
For important entities, the maximum fine must be at least EUR 7,000,000 or at least 1.4% of total worldwide annual turnover in the preceding financial year, whichever is higher.
In addition, the management body can be held liable for infringements (Article 20), and the supervisory authority can order measures to remedy irregularities. In Slovenia, fines for responsible persons go up to EUR 10,000 for essential and EUR 7,000 for important entities.
The practical reality: the biggest risk is not only the amount of the fine, but the combination of supervision, deadlines for remedying irregularities, decisions, mandatory corrective action and management accountability.
Fines for essential and important entities
NIS2 distinguishes between essential and important entities. The amounts below are the maximum fines Member States must provide at least for infringements of Articles 21 and 23; the actual fine depends on the category of entity, the type of infringement and the circumstances.
| Criterion | Essential entity | Important entity |
|---|---|---|
| Maximum fine for a legal person | at least EUR 10,000,000 or 2% of total worldwide annual turnover – whichever is higher | at least EUR 7,000,000 or 1.4% of total worldwide annual turnover – whichever is higher |
| Fines for responsible persons (Slovenia) | up to EUR 10,000 | up to EUR 7,000 |
| National rules | Member States set the detailed penalty provisions, including lower ranges for less serious infringements and fines for individuals. | |
| Typical starting point | a stricter supervisory regime and higher penalty potential | lower upper limits, but still a materially significant risk |
Legal basis: Article 34 of Directive (EU) 2022/2555 (NIS2). The amounts are the minimum levels Member States must provide for the maximum fine; national rules may set higher maximums.
Important: the fine is not limited to a symbolic amount. For larger companies the percentage of total annual turnover can be relevant, so the actual exposure can be considerably higher than management often assumes.
What triggers a fine or a decision in practice?
The law does not only penalise an “incident”, but above all a failure to meet obligations that should have been in place beforehand.
Typical reasons for an offence
- no documented information security management system,
- risk management measures are not in place or not implemented,
- significant incidents are not reported properly,
- management does not support the area or include it in planning,
- no evidence of implemented measures, responsible persons and deadlines.
What we see in practice
- the organisation has documentation but no evidence,
- measures exist on paper but not in operations,
- there is no clear record of management decisions,
- roles, tasks and deadlines are not defined clearly enough,
- there is no preparation for supervision or for demonstrating the actual state.
The fine is not the only risk: supervisory measures
NIS2 also provides for supervisory and enforcement measures (Articles 32 and 33). For management, these are often more burdensome than the fine itself.
The inspector can
- order measures to remedy irregularities and deficiencies,
- set a deadline for implementing the measures,
- extend the deadline if the entity shows justified activities and objective circumstances,
- carry out random inspections of essential entities.
For essential entities, in certain cases also
- temporarily suspend a certification or authorisation concerning part or all of the services (Article 32(5)),
- request a temporary ban on exercising management functions for persons at chief executive or legal representative level,
- insist on additional measures if the original measures were not effective.
Key point: once supervision has started, your negotiating position is usually weaker. It is much cheaper and safer to put measures, records and a record of decisions in place in time than to fix things under the pressure of a decision.
Management accountability
Under Article 20, the management body must approve the risk management measures, oversee their implementation and follow training; it can be held liable for infringements.
What it means for the managing director or the board
- this is not just an IT topic,
- management must be involved in decisions, priorities and risk acceptance,
- management must ensure that measures are actually implemented,
- demonstrable support and oversight of the situation is expected.
Why it matters
- the management body can be held liable for infringements (Article 20),
- for essential entities, a temporary ban on exercising management functions may be requested,
- a lack of management involvement is very hard to defend during supervision.
In practice: the question is not only “how high is the fine”, but also “can management show that the area is governed, overseen and demonstrably supported”.
Why companies often underestimate the penalty
Most organisations do not fail on one big incident, but on a combination of several smaller shortcomings.
No clear ownership
It is not defined who leads the compliance programme and who coordinates activities between IT, legal and management.
No evidence
The document exists, but it is not clear who approved it, when it is used and with which related measures.
No traceability
There is no clear status of measures, deadlines, responsible persons and related management decisions.
No readiness for supervision
The organisation cannot quickly show the risk register, evidence, responsibilities and key procedures.
Action starts too late
The project starts only when supervision, a decision or a serious incident is already on the table.
The right approach – First check the status, then the gaps, prepare evidence and a programme of ongoing compliance.
How Regulus Ai reduces your exposure to penalties
The goal is not just “documentation”, but a state that can be defended during supervision and demonstrated in practice. More on the service: NIS2 compliance.
1. Scope and exposure assessment
We check whether you are an essential or important entity, which obligations apply to you and where the biggest regulatory risks are.
2. Gap analysis
We identify the gaps with the greatest impact on supervision, fines and demonstrability of implemented measures.
3. Evidence management and audit trail
We set up a trail of evidence, decisions, status of measures and responsible persons, so the organisation does not depend on improvisation.
4. Preparation for supervision
We prepare a structure with which you can quickly show the actual state, not just documentation.
The cheapest fine is the one you never get.
Book an initial consultationFrequently asked questions about NIS2 penalties
What is the maximum NIS2 fine?
NIS2 (Article 34) requires Member States to set maximum fines of at least EUR 10,000,000 or 2% of total worldwide annual turnover for essential entities and at least EUR 7,000,000 or 1.4% for important entities, whichever is higher.
Can the responsible person also be fined?
Under NIS2, the management body can be held liable for infringements (Article 20). In Slovenia, fines for responsible persons go up to EUR 10,000 for essential and EUR 7,000 for important entities, depending on the type of offence.
Is a fine the only consequence of non-compliance?
No. In addition to a fine, there may be supervisory measures, deadlines for remedying irregularities, decisions and, for essential entities, stricter measures if the situation is not corrected.
Can services be suspended?
For essential entities, NIS2 allows the temporary suspension of a certification or authorisation concerning part or all of the services, and a request for a temporary ban on exercising management functions (Article 32(5)).
What is the biggest risk for management?
The biggest risk is the combination: formal non-compliance, lack of evidence, ongoing supervision, accountability for decisions and the pressure of deadlines for remedying irregularities.
Does ISO 27001 by itself remove the risk of fines?
Not necessarily. ISO 27001 can be an important part of the system, but by itself it does not ensure that the organisation meets all NIS2 requirements and can demonstrate this during supervision.
Does Regulus Ai also help reduce regulatory risk?
Yes. We help with status assessment, gap analysis, documentation, registers, evidence, the audit trail and preparing the organisation for supervision and ongoing compliance.
Sources
- Directive (EU) 2022/2555 (NIS2), Article 34 – EUR-Lex
- URSIV – guidance on NIS2 implementation in Slovenia, version 1.4 (January 2026, in Slovenian)
Published: · Last updated: · Prepared by the Regulus Ai team
Don't wait for a decision or a fine
Regulus Ai offers a quick review of your regulatory exposure: status, risk level, biggest gaps and proposed priority measures.