Article 36Penalties
Member States shall lay down rules on penalties applicable to infringements of national measures adopted pursuant to this Directive and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive. Member States shall, by 17 January 2025, notify the Commission of those rules and of those measures and shall notify it, without delay of any subsequent amendment affecting them.
NIS2, the European Union directive on network and information security, Article 36
Member States must lay down rules on penalties for infringements of the national measures that transpose the Directive and take the steps needed to ensure those rules are applied. Penalties must be effective, proportionate and dissuasive. States had to notify the Commission of the rules and measures by 17 January 2025, and must notify later amendments without delay.
The article sets no amounts and no types of penalty. The Directive’s administrative fine figures are in Article 34, and only for infringements of Articles 21 and 23. What other infringements attract, and in what form, is left to national law, so the penalty rules an entity faces are those of its own Member State.
Text: Directive (EU) 2022/2555, OJ L 333, 27.12.2022, p. 80, as corrected by Corrigendum OJ L, 2023/90206, 22.12.2023 (Article 19(1): “by 17 January 2025”, replacing “on”), from EUR-Lex. Only the Official Journal text is authentic.