NIS2 Penalties: Fines, Sanctions and Enforcement Powers

NIS2 introduces a substantially strengthened enforcement regime compared to its predecessor. The directive sets minimum maximum fines (meaning Member States can go higher but not lower), grants supervisory authorities broad investigative and corrective powers, and — critically — introduces personal liability for senior management. Understanding the enforcement landscape is essential for building a business case for your compliance programme.

How Fines Are Calculated

National competent authorities (NCAs) have discretion in setting the actual fine amount up to the maximum. The factors that influence fine levels under NIS2 and general EU administrative law include: the severity and duration of the violation; the intentional or negligent nature of the violation; prior violations; the degree of responsibility of the entity; the financial strength of the entity and the impact of the fine as a deterrent; cooperation with the authority during investigation; the category of personal data involved (for incidents involving data breaches); and actions taken to mitigate harm. Authorities must ensure fines are effective, proportionate, and dissuasive.

Additional Sanctions

Beyond financial fines, NIS2 gives supervisory authorities a broad toolkit of corrective measures and sanctions:

• Binding instructions — authorities can issue binding instructions requiring specific actions within set timeframes
• Suspension of certifications — temporary suspension of certifications or authorisations required to operate services
• Prohibition from management roles — temporary ban on persons who are held responsible for a violation from exercising managerial functions
• Mandatory compliance reports — requiring regular reporting to the authority on remediation progress
• Mandatory security audits — requiring external security audits at the entity's expense
• Public disclosure — the authority may publicly name the entity and the nature of the violation
• On-site inspections — unannounced visits for Essential Entities

Who Enforces NIS2

Each EU Member State must designate one or more National Competent Authorities (NCAs) responsible for NIS2 supervision and enforcement. Many Member States are designating sector-specific authorities (e.g., energy regulators for the energy sector) alongside a cross-sector cybersecurity authority. The NCAs have investigative powers including access to information, conducting security audits, requesting security scan data, and inspecting facilities. For Essential Entities, supervision is proactive — the NCA can investigate without waiting for an incident. ENISA (the EU Agency for Cybersecurity) plays a coordination and advisory role but does not itself have enforcement powers.

Management Personal Liability

This is one of the most significant new developments in NIS2. Article 20(2) requires Member States to ensure that the management bodies of Essential and Important Entities can be held personally liable for infringements resulting from their failure to comply with Article 20 obligations (governance, oversight, and training). For Essential Entities, authorities can temporarily prohibit individuals from exercising management functions if they are found responsible for a serious NIS2 violation. This means that ignoring NIS2 compliance is no longer just a corporate risk — it is a personal career risk for every board member and C-suite executive.

First Enforcement Actions in the EU

As of early 2025, enforcement activity is beginning to materialise across the EU. Several Member States have opened supervisory dialogues with entities that were already covered by NIS1 but have not substantially upgraded their security measures. Entities in the energy, banking, and digital infrastructure sectors are receiving the earliest regulatory attention. Organisations that can demonstrate a documented, evidence-based compliance programme — even if not 100% complete — are in a significantly stronger position than those with no programme at all. Regulators have consistently indicated that they will consider good-faith compliance efforts as a mitigating factor.