Article 34General conditions for imposing administrative fines on essential and important entities
1. Member States shall ensure that the administrative fines imposed on essential and important entities pursuant to this Article in respect of infringements of this Directive are effective, proportionate and dissuasive, taking into account the circumstances of each individual case.
2. Administrative fines shall be imposed in addition to any of the measures referred to in Article 32(4), points (a) to (h), Article 32(5) and Article 33(4), points (a) to (g).
3. When deciding whether to impose an administrative fine and deciding on its amount in each individual case, due regard shall be given, as a minimum, to the elements provided for in Article 32(7).
4. Member States shall ensure that where they infringe Article 21 or 23, essential entities are subject, in accordance with paragraphs 2 and 3 of this Article, to administrative fines of a maximum of at least EUR 10 000 000 or of a maximum of at least 2 % of the total worldwide annual turnover in the preceding financial year of the undertaking to which the essential entity belongs, whichever is higher.
5. Member States shall ensure that where they infringe Article 21 or 23, important entities are subject, in accordance with paragraphs 2 and 3 of this Article, to administrative fines of a maximum of at least EUR 7 000 000 or of a maximum of at least 1,4 % of the total worldwide annual turnover in the preceding financial year of the undertaking to which the important entity belongs, whichever is higher.
6. Member States may provide for the power to impose periodic penalty payments in order to compel an essential or important entity to cease an infringement of this Directive in accordance with a prior decision of the competent authority.
7. Without prejudice to the powers of the competent authorities pursuant to Articles 32 and 33, each Member State may lay down the rules on whether and to what extent administrative fines may be imposed on public administration entities.
8. Where the legal system of a Member State does not provide for administrative fines, that Member State shall ensure that this Article is applied in such a manner that the fine is initiated by the competent authority and imposed by competent national courts or tribunals, while ensuring that those legal remedies are effective and have an equivalent effect to the administrative fines imposed by the competent authorities. In any event, the fines imposed shall be effective, proportionate and dissuasive. The Member State shall notify to the Commission the provisions of the laws which it adopts pursuant to this paragraph by 17 October 2024 and, without delay, any subsequent amendment law or amendment affecting them.
NIS2, the European Union directive on network and information security, Article 34
The fine ceilings. For infringements of Article 21 or 23, Member States must provide that essential entities can be fined up to a maximum of at least EUR 10 000 000 or at least 2 % of the total worldwide annual turnover of the undertaking they belong to in the preceding financial year, whichever is higher. For important entities the figures are EUR 7 000 000 and 1,4 %. These are floors on the maximum a State must make available, not standard fines, and national law may set higher ceilings.
Turnover is that of the undertaking to which the entity belongs, not of the entity alone, and it is the worldwide figure for the preceding financial year.
Fines come in addition to the measures in Articles 32 and 33. In deciding whether to fine and how much, authorities must give due regard at least to the factors in Article 32(7), such as seriousness, duration, intent or negligence, and cooperation. Member States may provide for periodic penalty payments to compel an entity to stop an infringement in line with a prior decision of the authority, and may decide whether and how far fines apply to public administration entities. Where a legal system has no administrative fines, the fine is initiated by the authority and imposed by a national court or tribunal.
The Directive sets these figures only for Articles 21 and 23. Article 36 leaves other penalties to national law.
What is in the packs for this
NIS2 Management Briefing DeckPowerPoint
Helps with this requirementin NIS2 Implementation & Readiness
Slide 7 and its speaker notes put the administrative fines for essential and important entities before the management body.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.