How high can NIS2 fines go?
Every country with a law uses the Directive ceilings: EUR 10 million or 2% of worldwide turnover for essential entities, EUR 7 million or 1.4% for important ones. The higher amount applies.
EUR m
- Essential entity
- EUR 10,000,000Fixed amount. The 2% passes it above EUR 500m.
- Important entity
- EUR 7,000,000Fixed amount. The 1.4% passes it above EUR 500m.
National details
| Country | Provision | % of which turnover | Also in the law |
|---|---|---|---|
| Austria | § 45 NISG 2026 | Worldwide, of the group | The Directive ceilings only. |
| Belgium | NIS2 Law | Worldwide, of the group | The minimum fine is EUR 500. Fines can double for a repeat breach within 3 years. |
| Bulgaria | Art. 29 Cybersecurity Act | Worldwide, of the group | The floor is EUR 25,000 for essential and EUR 12,500 for important entities. The higher amount applies. The % applies to the undertaking the entity belongs to. Violations up to 2026-06-01 carry fines cut by 50%. A manager who breaks Art. 21 pays EUR 500-5,000. Failure to obey an enforcement measure costs EUR 2,500-12,000. Public bodies are exempt from the essential-entity ceiling. |
| Croatia | Art. 101 and 102 Cybersecurity Act | The entity's own | The Act sets a range with a floor. Essential entities pay EUR 10,000 to 10,000,000 or 0.5-2%. Important entities pay EUR 5,000 to 7,000,000 or 0.2-1.4%. The higher amount applies. The % applies to the turnover of the entity concerned. The responsible person can also pay EUR 1,000-6,000 (essential) or EUR 500-3,000 (important). Failure to send data costs EUR 2,000-20,000. |
| Cyprus | Art. 43A NIS Law 89(I)/2020 | Worldwide, of the group | The Law uses the wording of the Directive: a maximum of at least EUR 10,000,000 or 2% (essential) and EUR 7,000,000 or 1.4% (important). The higher amount applies. The % applies to the undertaking the entity belongs to. Fines come on top of enforcement measures. The Authority can set other sanctions by Decision. |
| Czechia | § 59(4) Cybersecurity Act | Worldwide, of the group | The Act sets the fixed ceilings in CZK: 250,000,000 for the higher regime and 175,000,000 for the lower regime. The EUR figures shown are the Directive amounts. A failure to report contact data costs up to CZK 100,000,000 in the higher regime. The % applies to the turnover of the undertaking, as in the Directive. |
| Denmark | § 32 NIS 2 Act; explanatory notes to the bill | The entity's own | The Act sets no ceiling: the figures come from the explanatory notes to the bill, which expect the Directive minimum of EUR 10 million or 2% and EUR 7 million or 1.4%. The Act says only "bøde", and courts impose fines in the criminal system. The notes name the entity's total global turnover. The Act sets no ceiling for other breaches. |
| Estonia | Sections 18(2) and 18(3) KüTS | Worldwide, of the group | The Directive ceilings only. |
| Finland | Section 38 Kyberturvallisuuslaki | Worldwide, of the group | A fine needs intent or gross negligence. The Act bars fines on state authorities. |
| France Bill, not law yet | Art. 37 of the bill (committee text n° 1779) | Worldwide, of the group | The sanctions committee sets the fine. It cannot fine an entity when the same breach already led to a GDPR fine from the data protection authority. |
| Germany | § 65 BSIG | Worldwide, of the group | The % ceiling applies when total worldwide turnover is above EUR 500 million. |
| Greece | Article 26 of Law 5160/2024 | Worldwide, of the group | The Law applies the percentage to the worldwide turnover of the undertaking and takes the higher amount. The Authority head decides each fine after a hearing. Breaches of management duties carry a fine of up to EUR 200,000, and breaches of Article 19 up to EUR 200,000. Article 19 covers DNS, cloud, data centre and similar providers. |
| Hungary | Section 42(2) of Decree 418/2024 | The entity's own | The Decree sets the euro ceiling and says the higher amount applies. It converts euro to forint at the MNB rate on the decision day. Lower fixed amounts apply to single breaches. Missing registration data costs up to 2% of the entity's net revenue or HUF 150,000,000, and a missed incident report costs up to HUF 5,000,000. A manager who fails a legal duty risks a fine of up to HUF 15,000,000. |
| Ireland Bill, not law yet | Head 44AG of the General Scheme | The entity's own | An adjudicator sets financial penalties. The General Scheme takes the greater of the euro amount and the percentage. It applies the percentage to the turnover of the entity. |
| Italy | Art. 38 D.Lgs. 138/2024 | Worldwide, of the group | The minimum is 1/20 of the maximum for essential entities and 1/30 for important entities. |
| Latvia | Art. 46 NKDL | The entity's own | The percentage applies only when the entity own net turnover exceeds EUR 500,000,000. Below that, the cap is the fixed amount. The percentage uses the entity itself, not the group. |
| Lithuania | Art. 30 KSĮ | The entity's own | The law applies the percentage to the total worldwide annual turnover of the legal person. The higher amount applies. The fine depends on the violation. A dangerous violation can reach 100% of the maximum, a medium one 50%, a minor one 10%. A budgetary body pays at most EUR 60,000 (essential) or EUR 30,000 (important). The head of the NKSC sets the fine. |
| Luxembourg | Art. 26(4)-(5) NIS 2 Act | Worldwide, of the group | Breaches of some duties carry a lower ceiling of EUR 250,000. Periodic penalties reach EUR 1,250 per day, with a total cap of EUR 25,000. |
| Malta | Art. 32(3)-(4) of the order | Worldwide, of the group | The Enforcement Committee imposes the fines on a report from the CIP Department or the sector authority. |
| Netherlands | Articles 80 and 87 Cbw | Worldwide, of the group | Other breaches carry a ceiling of EUR 1,000,000. |
| Poland | Art. 73 KSC Act | The entity's own | The % applies to the revenue of the entity itself, not to the group. Minimum fines are PLN 20,000 (key) and PLN 15,000 (important). A breach that causes a serious threat can cost up to PLN 100 million. The head of the entity can be fined up to 300% of their salary. |
| Portugal | Art. 61(2) DL 125/2025 | The entity's own | The percentage applies to the turnover "da entidade essencial em causa" (the entity itself). The minimum fine is EUR 2,000 for essential and EUR 1,250 for important entities. Serious breaches in art. 62 carry up to EUR 5,000,000 or 1% (essential) and EUR 3,500,000 or 0.7% (important). Natural persons face EUR 350 to EUR 200,000. A reasoned request can waive fines for 12 months after entry into force, until 2027-04-03. |
| Romania | Art. 60 OUG 155/2024 | Worldwide, of the group | Minimum fines are RON 10,000 (essential) and RON 5,000 (important). |
| Slovakia | § 31(2)-(3) Act 69/2018 | Worldwide, of the group | The 2% ceiling applies to operators of a critical essential service. Minimum fines are EUR 500 (critical) and EUR 300. Lesser breaches, for example a late notice of registration, carry a ceiling of EUR 500,000. |
| Slovenia | Articles 52 and 53 ZInfV-1 | The entity's own | The % applies to the annual turnover of the legal person itself. The range starts at 0.5% (essential) and 0.3% (important), with a minimum of EUR 10,000 and EUR 7,000. A responsible person can be fined EUR 1,000-10,000. |
| Spain Bill, not law yet | Art. 42 of the draft | Worldwide, of the group | The top fines apply to very serious breaches under art. 39(a) and (b), which are failure to apply the measures after an incident and repeated failure to report. Other very serious breaches cost EUR 500,001-2,000,000. Serious breaches cost EUR 100,001-500,000. Minor breaches cost EUR 10,000-100,000. |
| Sweden | 4 kap. 10 § Cybersäkerhetslagen | Worldwide, of the group | The minimum is SEK 5,000. The % applies to total worldwide annual turnover. A public entity pays at most SEK 10,000,000. |
Who pays, and what comes first
- Who pays
- The entity.
- Turnover
- The worldwide turnover of the group the entity belongs to. Croatia, Denmark, Hungary, Latvia, Lithuania, Poland, Portugal and Slovenia apply the % to the turnover of the entity itself.
- Managers
- In Germany, managers who breach their duties are liable to the company for the damage. In Poland, the head of the entity can be fined personally, up to 300% of their salary.
- Before a fine
- Binding instructions, an audit at your cost, or publication of the breach. For essential entities, some countries can suspend a certification or a manager's functions.