Penalty levels explained
NIS2 divides organisations into two categories: essential entities and important entities. The category determines not only which requirements apply, but also the intensity of supervision and the maximum penalties.
For essential entities, the ceiling is €10 million or 2 percent of global annual turnover, whichever is higher. For important entities, the ceiling is lower: €7 million or 1.4 percent of turnover.
These are maximum figures. In practice, the size of a sanction depends on the severity of the breach, whether it is repeated, and whether the organisation has actively worked to address it. But the numbers are large enough to get into a boardroom conversation, which is precisely the point.
One thing that directly affects how a compliance system needs to be configured: the classification as essential or important entity is not always straightforward. Guidance from national authorities varies across member states and sectors. This is a system question that needs to be managed on an ongoing basis, not just resolved at registration.
The supervisory model
NIS2 does not create a single pan-European supervisory body. Supervision is handled at national level, and in many member states, responsibility is further distributed across sector-specific authorities.
This matters for a practical reason: there is no uniform supervisory practice yet. Different authorities are at different stages of building their oversight capacity. The pressure varies by sector and country, but that does not mean the risk is low. It means the timeline is uncertain.
Personal liability: what actually changes boardroom behaviour
The fines are significant, but personal liability is usually what shifts the dynamic in a boardroom.
NIS2 requires that senior management actively participates in and approves the organisation's security work. Delegating entirely to the IT department is not sufficient. If an incident occurs and it can be shown that management lacked adequate oversight or had not approved relevant measures, individual members of management can be held personally liable.
This is a question that comes up regularly when organisations start configuring their compliance systems. How do you document management approval in a way that holds up under scrutiny? How do you ensure the right person has signed off on the right decision at the right time? That is not a legal question. It is a system design question.
Hy5 handles this by linking security measures and risk decisions directly to accountable roles within the organisation, with timestamped approvals that are traceable and audit-ready.
What supervisory authorities actually look at
Based on how similar supervisory regimes have operated in other EU contexts, and on how NIS2's requirements are framed, supervision is likely to focus on:
- Documentation: Are there written procedures and policies covering the ten security areas?
- Incident handling: Has the organisation reported incidents within the required timeframes?
- Management engagement: Is there evidence that senior management has actively participated in security governance?
- Supply chain assessment: Has the organisation evaluated risks across its supplier and service chain?
This is not a random audit of technical systems. It is a review of whether the organisation can demonstrate a structured and documented approach to security. That distinction matters enormously for how a compliance system needs to be built.
Proactive compliance is cheaper than reactive compliance
It sounds like a cliché, but it is a straightforward calculation. A penalty of 2 percent of global turnover is, in most cases, a multiple of the cost of building a functioning compliance system from the outset.
What we see in our customer dialogues is that organisations that delay structuring their compliance work often end up doing everything at once, under time pressure, with manual processes that do not hold up under scrutiny.
Want to understand how Hy5 supports documentation, traceability and management accountability under NIS2?
Hy5 automates compliance monitoring and creates audit-ready records across all NIS2 security areas. Used by organisations to operationalise NIS2 requirements without manual administration.
Curious about automating compliance?
