NIS2 guide

NIS2 fines and management liability

NIS2, Directive (EU) 2022/2555, sets the minimum penalties every EU country must be able to impose on an organisation that fails its security or reporting duties: fines, orders, audits, and, for the worst cases, a ban on the person running the business. It also makes the management body personally answerable for the security measures. This guide explains what the Directive requires, how two countries have written it into their own law, and what a small organisation should do first.

Article numbers refer to the Directive unless the text says otherwise. Each EU country sets its own figures within these minimums, so check the law of the country whose authority supervises you.

Last checked 9 November 2026 against the Directive's text on EUR-Lex, the German BSI Act as published on gesetze-im-internet.de, and the Belgian law of 26 April 2024 on ejustice.just.fgov.be. This is general information, not legal advice.

1. The short answer

2. The fines: Article 34

Article 34 sets "general conditions for imposing administrative fines on essential and important entities". Fines must be "effective, proportionate and dissuasive, taking into account the circumstances of each individual case" (Article 34(1)), and they are imposed "in addition to" the supervisory measures in Articles 32 and 33 (Article 34(2)).

The two ceilings are minimums that every country's law must reach; a country may go higher:

EntityMaximum fine for breaking Article 21 or 23Where
Essential"a maximum of at least EUR 10 000 000 or of a maximum of at least 2 % of the total worldwide annual turnover in the preceding financial year of the undertaking to which the essential entity belongs, whichever is higher"Article 34(4)
Important"a maximum of at least EUR 7 000 000 or of a maximum of at least 1,4 % of the total worldwide annual turnover in the preceding financial year of the undertaking to which the important entity belongs, whichever is higher"Article 34(5)

Two points matter for a small organisation. First, the turnover is that of the "undertaking to which the entity belongs", so a small subsidiary of a large group is measured against the group's turnover. Second, the figures are ceilings, not tariffs: in deciding whether to fine and how much, the authority must take into account the factors in Article 32(7), which include the seriousness and duration of the breach, previous breaches, the damage caused, intent or negligence, what the entity did to limit the damage, and how far it cooperated (Article 34(3)). Repeated violations, failing to report or remedy significant incidents, ignoring binding instructions, obstructing an audit and giving false information count as serious in any event (Article 32(7)(a)).

Countries may also allow periodic penalty payments, a daily or weekly sum to force an entity to stop a continuing breach (Article 34(6)), and each decides whether public bodies can be fined at all (Article 34(7)). Whether to apply the Directive's enforcement at all to a given organisation depends on whether it is in scope; our guide Does NIS2 apply to your business? covers that.

3. Supervision and orders: Articles 32 and 33

The Directive treats the two groups differently. Essential entities are supervised ex ante: the authority can check them at any time. Important entities are supervised ex post: the authority acts "when provided with evidence, indication or information" that the entity is not complying (Article 33(1)), typically after an incident or a complaint.

What the authority can do to find out. For essential entities, Article 32(2) lists on-site inspections and off-site supervision including random checks, regular and targeted security audits by an independent body or the authority, ad hoc audits after a significant incident, security scans, requests for information including "documented cybersecurity policies", requests for access to data and documents, and requests for evidence that policies are implemented, "such as the results of security audits carried out by a qualified auditor". For important entities, Article 33(2) gives the same list without the regular audits and the ad hoc audits. In both cases the entity pays for a targeted audit by an independent body unless the authority decides otherwise.

What the authority can order. Articles 32(4) and 33(4) give it the power to issue warnings; adopt binding instructions or an order to remedy deficiencies; order the entity to stop the conduct; order it to bring its measures into line with Article 21 or meet the reporting duties in Article 23 "in a specified manner and within a specified period"; order it to inform the people it serves about a significant cyber threat and what they can do about it; order it to implement audit recommendations within a reasonable deadline; order it to make aspects of the breach public; and impose or request a fine under Article 34. For essential entities the authority can also appoint a monitoring officer for a set period to oversee compliance (Article 32(4)(g)).

The last resort for essential entities. If those orders do not work, the authority sets a deadline. If the deadline passes, it can suspend, or ask a court or certification body to suspend, a certification or authorisation for the relevant services, and can ask a court to "prohibit temporarily any natural person who is responsible for discharging managerial responsibilities at chief executive officer or legal representative level" from exercising managerial functions in that entity. Both last only until the entity complies, and both come with the rights of the defence (Article 32(5)). Neither applies to public administration entities.

Before any enforcement measure, the authority must give its reasons, notify the entity of its preliminary findings, and allow a reasonable time for observations, except where immediate action is needed to deal with an incident (Article 32(8)).

4. Management liability: Article 20

Article 20(1) is short and worth reading in full: "Member States shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article."

Three duties follow for the board, the directors or the owner-manager, whatever the legal form:

  1. Approve the measures. In practice, a dated decision adopting the security policy and the risk assessment that supports it.
  2. Oversee their implementation: receive reports, check that what was approved is actually done, and act when it is not.
  3. Train. Article 20(2) requires the members of the management body "to follow training", and encourages the entity to offer similar training to its employees regularly, "in order that they gain sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity".

The liability itself is left to national law. Article 20(1) requires that managers "can be held liable"; Article 32(6) adds, for essential entities, that any natural person who represents the entity, takes decisions for it or controls it must have "the power to ensure its compliance" and that it must be "possible to hold such natural persons liable for breach of their duties to ensure compliance". Liability of public servants and elected officials stays with national rules. How far this goes, whether it means a personal fine, a civil claim by the company against its directors, or disqualification, is decided country by country, as the two examples below show.

5. Germany: the NIS2UmsuCG

Germany transposed NIS2 through the NIS-2-Umsetzungs- und Cybersicherheitsstärkungsgesetz (NIS2UmsuCG), which rewrote the BSI Act (BSI-Gesetz, BSIG). The Bundestag passed it on 13 November 2025; it was published in the Federal Law Gazette (Bundesgesetzblatt 2025 I Nr. 301) on 5 December 2025 and came into force the next day, 6 December 2025, with no transition period. German law calls essential entities besonders wichtige Einrichtungen (particularly important entities) and important entities wichtige Einrichtungen.

Fines (§ 65 BSIG). The maximum fine depends on which duty was broken. For the core breaches, which include the risk-management measures, incident reporting and several other duties, the ceiling is €10,000,000 for particularly important entities and €7,000,000 for important entities (§ 65(5)). Where the undertaking's worldwide turnover exceeds €500,000,000, the ceiling for those same breaches becomes 2% of turnover for particularly important entities (§ 65(6)) and 1.4% for important entities (§ 65(7)). Turnover is the worldwide revenue of the undertaking the entity belongs to in the financial year before the decision, and may be estimated (§ 65(8)). Lesser breaches carry lower ceilings: €5,000,000, €2,000,000, €1,000,000, €500,000 or €100,000 depending on the provision. A fine already imposed for the same conduct under Article 58(2)(i) GDPR rules out a further fine under the BSIG (§ 65(11)).

Management (§ 38 BSIG). The managing bodies (Geschäftsleitungen) of both kinds of entity must implement the risk-management measures required by § 30 and monitor their implementation (§ 38(1)). A manager who breaches that duty is liable to the entity for damage caused by fault, under the company-law rules that apply to the entity's legal form; the BSIG itself creates liability only where company law has no equivalent rule (§ 38(2)). Managers must attend training regularly to gain sufficient knowledge to recognise and assess risks and risk-management practices and their effect on the entity's services (§ 38(3)). So in Germany the Article 20 liability is a civil liability to the company, not a personal fine.

6. Belgium: the law of 26 April 2024

Belgium was among the first to transpose. The law of 26 April 2024 "establishing a framework for the cybersecurity of networks and information systems of general interest for public security" was published in the Belgian Official Journal (Moniteur belge) on 17 May 2024 and, by its Article 98, entered into force on 18 October 2024, the Directive's transposition deadline. A Royal Decree of 9 June 2024 supplies the detail. The supervisory authority is the Centre for Cybersecurity Belgium (CCB).

Fines (Article 59). An essential entity "is punished with a fine of 500 to 10,000,000 euros or 2 per cent of total worldwide annual turnover"; an important entity "of 500 to 7,000,000 euros or 1.4 per cent", in each case "the higher amount being retained". The law adds something the Directive does not require: "the administrative fine is doubled in the event of a repeat offence for the same facts within a period of three years".

Orders and bans (Articles 58 and 60). Article 58 lists the administrative measures that can accompany a fine. Article 60 carries over the Directive's last resort for essential entities only: temporary suspension of a certification or authorisation, and a temporary ban on senior management, if the required measures are not taken by the deadline, lasting until the entity puts things right. Supervision follows the Directive's split: for important entities, Article 48 says checks "are carried out ex post, on the basis of evidence".

Management (Articles 31 and 61). Article 31 § 1 says the management bodies of essential and important entities approve the risk-management measures, supervise their implementation and "are responsible for the breach of that article by those entities"; § 2 requires their members to follow training. Article 61 adds that the natural persons who represent, decide for or control an entity "are responsible for failures in their duty to ensure compliance with this law". Belgian commentators note that the law does not spell out what that responsibility means in practice, so the extent of personal exposure will be settled by the CCB's practice and the courts.

Belgium also offers a route to show compliance: the CCB's CyberFundamentals framework, with a verified implementation giving a presumption of conformity. Our NIS2 kit maps its documents to CyberFundamentals as well as to the Directive.

7. Overlap with GDPR fines

A security failure that leaks personal data can break both NIS2 and the GDPR. Article 35 deals with this. The NIS2 authority must tell the data protection authority without undue delay when it finds a breach of Article 21 or 23 that may involve a personal data breach notifiable under Article 33 GDPR (Article 35(1)). If the data protection authority then fines the entity under Article 58(2)(i) GDPR, the NIS2 authority may not impose an Article 34 fine "for an infringement ... arising from the same conduct", though it may still use the orders in Articles 32 and 33 (Article 35(2)). The GDPR ceilings are higher, €20,000,000 or 4% of turnover, so for a data breach the GDPR fine is the one to expect. Our guide to NIS2 incident reporting explains how the two reporting duties run side by side.

8. What a small entity should do first

The fines are designed to be severe enough to matter to large operators. For a small or medium-sized entity, the more likely consequences are an order with a deadline, an audit at your own cost, and personal questions to whoever runs the business. The aggravating factors in Article 32(7) are the practical guide to staying out of trouble, so start there.

  1. Know which list you are on. Essential or important decides whether you are inspected at any time or only after something goes wrong, and which fine ceiling applies. The size and sector tests are in our scope guide.
  2. Get management on record. A signed, dated approval of the security policy and risk assessment by the board or owner, and a note of the training they have had. This is the Article 20 evidence and the first thing an auditor asks for.
  3. Be able to report an incident in 24 hours. Failing to notify a significant incident is a serious breach "in any event". Write down who decides, who sends the early warning and where it goes.
  4. Document the ten Article 21 measures, briefly. The authority can ask for "documented cybersecurity policies" and evidence they are followed. Short policies with records beat long ones with none. The Article 21 checklist says what each measure needs.
  5. Register with your national authority where its law requires it (Germany and Belgium both require in-scope entities to register, and the digital types register under Article 27 everywhere) and keep the details current.
  6. Answer the authority. Obstructing an audit or giving inaccurate information turns a minor matter into a serious one. Cooperation is itself a mitigating factor (Article 32(7)(h)).

Our NIS2 Small-Entity Compliance Kit gives you the management approval record, the policies, the incident procedure and the registers that these steps call for, sized for an organisation with one part-time IT owner.

Related guides: Does NIS2 apply to your business? · NIS2 Article 21: the ten measures in plain English · NIS2 incident reporting: 24 hours, 72 hours, one month · NIS2 and UK businesses

9. Sources