Short answer
Essential entities: up to €10 million or 2% of worldwide annual turnover, whichever is higher. Important entities: up to €7 million or 1.4% of worldwide annual turnover, whichever is higher. A fine is not automatic; the supervisor weighs severity, duration, impact, negligence and cooperation, and can also issue warnings, binding instructions and remediation orders.
Fine caps
| Entity type | Maximum |
|---|---|
| Essential | €10M or 2% of worldwide annual turnover |
| Important | €7M or 1.4% of worldwide annual turnover |
The cap is a ceiling, not a tariff. The actual outcome depends on the facts and national procedural law.
Maximum-fine calculator
Enter the entity type and annual turnover. The calculation is local and is not a legal assessment.
What the supervisor assesses
- Severity and duration of the breach.
- Impact on services, customers and other entities.
- Whether the entity was negligent or acted deliberately.
- Cooperation, notification and remediation speed.
- Repeat breaches and prior warnings.
Documenting decisions and fixes is not paperwork for its own sake; it is the evidence that the entity took the duty seriously.
Management accountability
NIS2 requires management bodies to approve and oversee cyber-risk measures. National law determines personal or board-level consequences. The practical lesson: board minutes, risk appetite, budget decisions and remediation deadlines should be traceable, not reconstructed after an incident.
Read the full NIS2 guide for the ten duties and incident reporting.
How to reduce exposure
- Confirm scope and register with RIA on time.
- Keep a risk register with owners and treatment dates.
- Test backup restore, MFA and incident contact routes.
- Collect supplier and technical evidence.
- Record board decisions and remediation progress.
- Run a tabletop exercise and document lessons.
Need a second pair of eyes? Review the audit scope or request a scoping call.
Frequently asked questions
What is the maximum NIS2 fine?
For essential entities, up to €10 million or 2% of worldwide annual turnover, whichever is higher. For important entities, up to €7 million or 1.4% of worldwide annual turnover, whichever is higher.
Is a NIS2 fine automatic?
No. The supervisor assesses severity, duration, impact, negligence and cooperation. A fine is one possible measure, alongside warnings, binding instructions and remediation orders.
Can management be held liable?
NIS2 requires management accountability and approval of risk measures. National law determines personal or board-level consequences; do not assume a fine is the only risk.
Does a small company avoid NIS2 fines?
Size affects scope and obligations, but not automatically immunity. If the entity is in scope, the duties apply; check the size and sector rules carefully.
Sources
- NIS2 Directive (EU) 2022/2555, Article 34.
- Cybersecurity Act (KüTS).
- RIA.