NIS2 Article 34 requires member states to set maximum fines of at least EUR 10 000 000 or 2 % of worldwide annual turnover, whichever is higher, for essential entities. For important entities the floor is EUR 7 000 000 or 1.4 %. These are minimum ceilings, and national law decides actual amounts.
Reading the numbers correctly
The wording is "a maximum of at least". That means each country must make sure its top fine is no lower than these amounts. A country may set higher. It does not mean every breach costs that much. Article 34(1) says fines must be effective, proportionate and dissuasive, considering the circumstances of each case.
The turnover figure refers to the undertaking to which the entity belongs, meaning group turnover can matter.
Fines apply to breaches of Article 21 (risk management) and Article 23 (reporting).
Fines are not the only tool
Articles 32 and 33 list other powers. For essential entities these include on-site inspections, regular and targeted security audits, ad hoc audits after incidents, security scans, and requests for evidence of implemented policies. Enforcement powers include warnings, binding instructions, orders to remedy deficiencies, orders to inform affected users of a threat, and orders to make aspects of an infringement public.
Article 34(2) says fines come in addition to those measures. Article 34(6) lets states add periodic penalty payments to compel an entity to stop an infringement.
Essential versus important supervision
Supervision differs. Essential entities can face proactive checks and regular audits. For important entities, Article 33 describes action "ex post", meaning when there is evidence, indication or information of non-compliance. The cost of a targeted audit by an independent body is normally paid by the audited entity.
How to use this in planning
- Find out which category you are likely to fall in under your national law.
- Treat reporting (Article 23) as a process risk and test it. Missed deadlines are easy to avoid with a rehearsal.
- Treat Article 21 as an evidence problem. The first supervisory request is usually for documents and results.
- Record corrective action. Article 21(4) requires "without undue delay" corrective measures when non-compliance is found.
- Check your national authority's published enforcement approach.
A note on wording: avoid quoting the fine figures as certain outcomes in sales or board material. They are legal ceilings that national law implements.
Safeguard's compliance and evidence automation helps keep a dated record of controls and tests, which supports the evidence step.
What to put in front of leadership
A one page note works: your likely entity category, the reporting process and when it was last rehearsed, the three weakest Article 21 areas with owners and dates, and the evidence you could hand over this week. It keeps the fine figures in proportion and turns them into a work plan.
Quick check
Is the fine EUR 10 million for every NIS2 breach?
No. It is the minimum level at which a member state must set its maximum for essential entities. Actual fines depend on national law and the case.
Can management be targeted separately?
Article 20 says management bodies can be held liable for Article 21 infringements, subject to national law. Check your country's rules.
Sources
Last reviewed: 19 October 2026.
