What Are the Penalties for Non-Compliance with the NIS2 Directive? Guide to Consequences of Violating New Cybersecurity Regulations

The NIS2 Directive introduces severe penalties for non-compliance with cybersecurity regulations. Financial penalties can reach up to 10 million euros or 2% of annual turnover for essential entities, and 7 million euros or 1.4% for important entities. The rules also provide for supervisory measures that have nothing to do with an amount at all: orders, an obligation to publish the violation and — as a last resort — a temporary ban on exercising managerial functions. Penalties are imposed by the competent national authority, and decisions can be appealed.

Key facts at a glance:

• Essential entities: a fine of up to EUR 10 million or 2% of worldwide annual turnover (whichever is higher).
• Important entities: a fine of up to EUR 7 million or 1.4% of annual turnover (whichever is higher).
• Non-financial sanctions: orders, publication of the violation, suspension of certification, a temporary ban on exercising managerial functions.
• Management liability: the management body approves the measures, oversees their implementation and is liable for violations (Article 20(1) NIS2).
• Poland: the amendment to the National Cybersecurity System Act (Journal of Laws 2026 item 252) has been in force since 3 April 2026; penalties under it may be imposed no earlier than after 3 April 2028.

Every amount in this article comes from the directive and from the Polish act — we do not convert them “roughly” into zlotys and we do not cite examples of penalties that have not yet been imposed in Poland.

What Types of Penalties Does the NIS2 Directive Provide?

The directive separates three things that conversations collapse into the single word “penalty”: supervisory measures, enforcement measures and administrative fines. Chapter VII of Directive (EU) 2022/2555 devotes a separate article to each of them, and Article 34(2) settles that fines are imposed in addition to the measures under Article 32(4)(a)-(h), Article 32(5) and Article 33(4)(a)-(g). In other words: a fine is not an alternative to an order, it is a supplement to it.

Supervisory measures are tools for establishing the facts. For essential entities, Article 32(2) lists on-site inspections and off-site supervision, regular and targeted security audits, ad hoc audits, security scans, and requests for information, for access to data and for evidence of the implementation of cybersecurity policies. One detail tends to surprise boards: the cost of a targeted audit carried out by an independent body is borne by the entity being audited, unless the competent authority decides otherwise.

The practical conclusion from this division is that an organization can incur a real regulatory cost — an audit at its own expense, an order to implement recommendations, an obligation to inform customers — before the word “fine” is even spoken, and before the deadlines pass after which Polish financial penalties become admissible at all.

📚 Read the complete guide: Cybersecurity: What is cybersecurity — a complete guide

Who Is Subject to Penalties for Non-Compliance with the NIS2 Directive?

Penalties apply to essential entities and important entities and — separately — to the natural persons who manage them. The catalogue of sectors (Annexes I and II to the directive) covers, among others, energy, transport, banking, financial market infrastructure, health, drinking water, waste water, digital infrastructure, ICT service management and public administration, and on the important-entity side also postal and courier services, waste management, chemicals, food, the manufacture of medical devices and machinery, digital providers and research.

The directive draws a clear line between the liability of the entity and the liability of the person. Article 32(6) requires Member States to ensure that any natural person responsible for an essential entity, or acting as its legal representative — on the basis of the power to represent it, to take decisions on its behalf or to exercise control over it — has the power to ensure compliance with the directive and can be held liable for a failure to comply with that duty. Article 33(5) extends the rule to important entities. For public administration entities the provision is without prejudice to national rules on the liability of public servants.

The directive does not differentiate penalties by industry — it differentiates them solely by whether an entity is essential or important. The industry affects the classification, and the classification affects the ceiling; there is no separate “energy tariff”.

What Is the Management Body Personally Liable for, and What Does “Approving Risk-Management Measures” Mean?

It is liable for approving the measures, for overseeing their implementation and for the entity’s infringement of Article 21 of the directive — and those are three distinct duties, not one. Article 20(1) of Directive (EU) 2022/2555 reads:

“Member States shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article.”

The verb “approve” does all the work here. This is not about noting a presentation at a board meeting, but about a decision that has an author and a date: what was approved (a specific document describing the measures under Article 21(2), not “the security policy” as a slogan), when and by whom. The absence of any of these elements looks in proceedings exactly like the absence of the measure itself, because the authority has nothing to work with but the evidence file.

The second paragraph of the same article imposes an obligation that is easy to forget, because it does not feel like a sanction. Article 20(2) requires Member States to ensure that members of the management bodies are required to follow training, so that they gain sufficient knowledge and skills to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity. The same provision merely encourages entities to offer similar training to their employees on a regular basis — towards the management body it speaks of an obligation, not of encouragement. The logic is consistent with paragraph 1: a person who is to approve the measures and answer for their adequacy has to understand what they are signing off on.

The Polish implementation of this obligation is more specific than the directive itself. Article 8e of the National Cybersecurity System Act, as amended by the Act of 23 January 2026 (Journal of Laws 2026 item 252), provides that the head of an essential or important entity, and the person entrusted with the head’s cybersecurity duties, must complete training once per calendar year, covering the performance of duties under Articles 8, 9-12b, 14 and 15 among others, and that participation in the training is documented. Failing to perform that duty is expressly listed among the grounds for a financial penalty on the head of the entity (Article 73a(1)(4)).

Personal liability is therefore not a theoretical construct in Polish law. Article 73a(1) lists fourteen points for which the head of an essential or important entity may be subject to a financial penalty — among them failing to perform the duties under Article 8, failing to designate at least two people for contact with the entities of the national cybersecurity system (point 6), and failing to provide users with the ability to report a cyber threat, incident or vulnerability (point 7). Paragraph 2 also covers a one-off omission, and paragraph 3 settles that the penalty on the head is independent of the penalty imposed on the entity itself.

How High Is the Maximum Penalty, and What Distinguishes an Essential Entity from an Important One?

The difference comes down to two things: the monetary ceiling and the mode in which the authority shows up at all. The ceilings are set by Article 34 of the directive. For essential entities infringing Article 21 or 23, Member States must provide for administrative fines “of a maximum of at least EUR 10 000 000 or of a maximum of at least 2 % of the total worldwide annual turnover in the preceding financial year of the undertaking to which the essential entity belongs, whichever is higher” (Article 34(4)). For important entities, Article 34(5) provides analogously for EUR 7 000 000 or 1,4 % of the same turnover.

Three details of this construction are skipped in summaries and yet decide the order of magnitude: the percentage base is the turnover of the undertaking to which the entity belongs, not of the penalised company alone (for a company inside a group that is a fundamental difference); the turnover is counted worldwide and for the preceding financial year, not for the year of the violation; and the phrase “a maximum of at least” allows a Member State to set a higher ceiling — which Poland has done.

The second difference is procedural and is often more important than the amount. For essential entities the authority conducts ongoing supervision: Article 32(2) gives it the power to run regular audits and random inspections regardless of whether anything has happened. For important entities, Article 33(1) provides for ex post supervision — authorities act “when provided with evidence, indication or information” that an entity allegedly does not comply with the directive. On top of that, the catalogue of enforcement measures for important entities (Article 33(4)) contains no counterpart to Article 32(5), that is, no suspension of certification and no ban on exercising managerial functions.

The Polish layer adds three numbers that are not in the directive. A penalty on an important entity may not exceed EUR 7 000 000 — expressed in zlotys at the average National Bank of Poland exchange rate in force on 31 December of the year preceding the year in which the decision is issued — or 1.4% of the revenue from business activity in the financial year preceding the imposition of the penalty, and may not be lower than PLN 15 000 (Article 73(4) of the National Cybersecurity System Act as amended by Journal of Laws 2026 item 252). For an essential entity, Article 73(3) provides a ceiling of EUR 10 000 000 or 2% of revenue, with a floor of PLN 20 000. The existence of a floor is a Polish specificity: the directive speaks only of a maximum.

The third number is the highest and the least frequently quoted. Where an essential or important entity infringes the act in a way that causes a direct and serious cyber threat to defence, state security, public safety and order, or human life and health, or a risk of serious material damage or serious disruption to the provision of services, the competent cybersecurity authority imposes a penalty of up to PLN 100 000 000 (Article 73(5)). That provision is not an alternative ceiling to Article 73(3)-(4); it is a separate basis for a qualified category of violations.

What Supervisory Measures Other Than a Fine Can the Authority Apply?

It can apply nine types of measures to an essential entity and eight to an important one, and most of them cost more work than money. Article 32(4) of the directive lists, for essential entities, the power to:

• issue warnings about infringements of the directive (point a);
• issue binding instructions — including on the measures necessary to prevent an incident or remedy its effects, with implementation deadlines and an obligation to report the implementation — or orders requiring the entity to remedy identified deficiencies (point b);
• order the entity to cease conduct that infringes the directive and not to repeat it (point c);
• order the entity to ensure, in a specified manner and within a specified deadline, that its cybersecurity risk-management measures comply with Article 21, or to fulfil the reporting obligations under Article 23 (point d);
• order the entity to inform the natural or legal persons to whom it provides services about the nature of a significant cyber threat, and about the possible protective or remedial measures available to them (point e);
• order the entity to implement, within a reasonable deadline, the recommendations issued as a result of a security audit (point f);
• designate a monitoring officer with well-defined tasks for a determined period, to oversee compliance with Articles 21 and 23 (point g);
• order the entity to make public, in a specified manner, information about infringements of the directive (point h);
• impose an administrative fine under Article 34, in addition to the measures under points (a) to (h) (point i).

Two of these reach the organization differently than an invoice does. The monitoring officer (point g) means the presence of an external supervisor inside the company’s processes for a determined period — not an audit that ends with a report, but ongoing compliance monitoring. The order to publish the violation (point h) shifts the cost onto the market: the information reaches customers from the entity’s own mouth, in the manner and within the deadline set by the authority.

Only once the measures under paragraph 4 points (a) to (d) and (f) have proved ineffective does Article 32(5) allow the authority to set a deadline for remedying the deficiencies, and — if that deadline passes without result — to temporarily suspend a certification or authorisation covering part or all of the activity (point a), or to request the competent bodies or courts to impose a temporary ban on exercising managerial functions in that entity on a person discharging managerial responsibilities at chief executive officer or legal representative level (point b). The directive adds three limits to this measure: it applies only until the deficiencies are remedied, it requires procedural safeguards consistent with the Charter of Fundamental Rights (the right to an effective remedy, the presumption of innocence, the rights of the defence), and it does not apply to public administration entities falling within the scope of the directive.

The catalogue for important entities in Article 33(4) is almost identical in points (a) to (g), with one difference in wording (binding instructions without the extension covering preventive measures) and with point (h) referring to the fine under Article 34. There is no counterpart to paragraph 5 there — which means that suspension of activity and the ban on exercising managerial functions are reserved for essential entities.

The directive provides for one more instrument that is almost never discussed: Article 34(6) allows Member States to introduce periodic penalty payments compelling an entity to bring an infringement to an end — accruing over time rather than one-off.

What Factors Influence the Amount of the Penalty Imposed?

It is influenced by a list of circumstances that Article 32(7) requires the authority, as a minimum, to “take due account of” — so not an exhaustive one — and Article 34(3) transfers that same list to the decision on the amount of the fine. The list has eight elements:

Point	Circumstance	What it means in practice
a	the seriousness of the infringement and the importance of the provisions breached	the directive itself names five infringements that must in any event be considered serious — see below
b	the duration of the infringement	counted from the moment the state of non-compliance arose, not from its discovery by the authority
c	relevant previous infringements by the entity	a history of proceedings is evidence in the next proceedings
d	material and non-material damage caused	including financial loss, the effect on other services and the number of users affected
e	the intentional or negligent character of the act	a distinction made on the side of the perpetrator of the infringement
f	measures taken to prevent or mitigate the damage	a documented response counts in the entity’s favour
g	adherence to approved codes of conduct or certification mechanisms	a certificate does not remove the obligation, but it is a circumstance
h	the degree of cooperation with the competent authorities	applies to legal and natural persons alike

Point (a) contains a list worth knowing verbatim, because it settles the classification before the effects are even assessed. Infringements to be considered serious in any event include: repeated infringements; a failure to notify or remedy significant incidents; a failure to remedy deficiencies pursuant to binding instructions from the authorities; obstruction of audits or monitoring activities ordered after an infringement has been established; and providing false or grossly inaccurate information about cybersecurity risk-management measures or about the reporting obligations under Articles 21 and 23.

Two of those items concern behaviour after the event, not the state of the defences before it. An organization with a technical gap that reported the incident on time and complied with the order stands somewhere else than an organization with a comparable gap that did neither. This is the most practical piece of information in any article about penalties: part of the exposure to a sanction arises in the hours and days after detection, not in the years before it.

What Non-Financial Consequences May an Organization Face for Non-Compliance with NIS2?

The most serious non-financial consequence is the loss of control over the communication about your own violation. It follows directly from the provision, not from market dynamics: Article 32(4)(h) allows the authority to order the entity to make information about the infringements public in a specified manner, and point (e) to inform the recipients of the service about a significant cyber threat. The message then goes out under the company’s name, within the deadline set by the authority.

On top of that come effects that the law merely makes possible and that the environment produces. Information about the measures imposed reaches counterparties assessing supply chain risk — and entities covered by NIS2 have their own duty to manage the security of that chain (Article 21(2)(d)), so they ask their suppliers about it. A violation that led to a personal data incident opens a parallel compensation regime and proceedings before the data protection authority.

The directive does not provide for “loss of reputation” as a sanction and it cannot be read out of the text of the act — the only predictable mechanism through which the matter becomes public consists of specific information obligations.

Who Imposes Penalties in Poland and Can They Be Appealed?

In Poland penalties are imposed by the competent cybersecurity authority designated for a given sector, and its decisions are subject to the appeal route provided for administrative decisions. The directive does not designate a single authority for an entire state, and the National Cybersecurity System Act designates one sector by sector — an example is Article 41(9k) of the act as amended, which designates the minister responsible for higher education and science for the research sector. For a business this means one practical question at the outset: which minister is my authority — because that is who conducts the proceedings, issues the orders and imposes the penalty.

An appeal operates within the general rules of administrative and administrative-court procedure, and the directive adds its own guarantees: the right to be informed of the authority’s preliminary findings and to submit observations before a measure is applied (Article 32(8)) and — for suspension and the ban on exercising managerial functions — safeguards consistent with the Charter of Fundamental Rights (Article 32(5)).

An appeal does not always defer the effects of a decision, however. An order to carry out an external audit is immediately enforceable (Article 15(1c) of the National Cybersecurity System Act), and the authority may give a penalty decision immediate enforceability where the protection of security or public order so requires (Article 74(4)). The penalty is paid within 14 days of service of a decision with immediate enforceability, or of the day on which the decision became final (Article 76a(5)). Planning a response around appeal deadlines alone is therefore risky — an order may remain binding while the dispute over its merits runs.

Where Does the Amendment to the Polish Cybersecurity Act Stand and When Do Penalties Become Real?

The amendment is already binding law, but its sanctions have a deferred start — and that distinction is the one most often confused in conversations about NIS2. The position as at the date this text was updated, 18 September 2026, is as follows:

Date	What happens	Legal basis
23 January 2026	adoption of the act amending the National Cybersecurity System Act	Journal of Laws 2026 item 252
3 April 2026	entry into force (one month after promulgation)	Article 49 of the amending act
3 April 2027	deadline for performing the obligations under Chapter 3 for entities that met the criteria on the date of entry into force (12 months)	Article 33(1) of the amending act
3 April 2028	deadline for the first audit of an essential entity under Article 15(1) (24 months)	Article 33(2) of the amending act
after 3 April 2028	the earliest point at which the financial penalties under Articles 73(1)-(4), 73a-73c and 76b may be imposed	Article 35 of the amending act

Article 35 of the amending act states expressly that the listed financial penalties “may be imposed for the first time after two years have elapsed from the date the act enters into force” (own translation from the Polish text). With an entry into force on 3 April 2026, that means no earlier than 3 April 2028. There is therefore no basis today for claiming that penalties under this regime are already being imposed in Poland — and no basis for invoking them as a current event.

The same provision, however, supports a conclusion that is the opposite of reassuring. The obligations are not deferred along with the penalties: the deadline in Article 33(1) of the amending act falls a year earlier than the moment a penalty becomes admissible. Anyone treating April 2028 as the start date for preparations will enter the sanction period a year behind on their obligations — and the duration of an infringement is counted from the moment the state of non-compliance arose, not from the first inspection (Article 32(7)(b)).

What Happens If You Fail to Respond to an Incident — What a Penalty Looks Like from the IT Department’s Perspective?

From the IT department’s perspective the most common route to a sanction is not a successful attack but a missed reporting deadline — and that is a conclusion drawn straight from how the provisions are built, not an observation. Article 23 of the directive and Article 11 of the National Cybersecurity System Act, which implements it, set out a sequence: an early warning within 24 hours of detecting a significant incident, an incident notification within 72 hours, and a final report within one month of the notification (Article 11(1)(4), (4a) and (4c)). Each of these deadlines is verifiable from records — and each is an independent basis for liability.

Three things follow from this for a technical team:

1. The clock is started by a human decision, not by an alert. The deadlines run from the detection of a significant incident, so the key artefact is a documented moment of classifying the event — and a procedure stating who makes that classification at three in the morning.
2. A failure to notify has a double effect. It is an independent breach of an obligation and at the same time a circumstance that Article 32(7)(a)(ii) requires to be considered serious in any event when measures for the remaining infringements are assessed.
3. The sanction reaches the head of the entity by name. Article 73a(1)(9) of the National Cybersecurity System Act covers with a financial penalty a head who fails to perform at least one of the obligations under Article 11, and point 11 separately covers a final report lacking the elements required by Article 12a. The penalty may not exceed 300% of the remuneration received, calculated on the basis used for holiday pay equivalent (Article 73a(4)); in public entities the ceiling is 100% (paragraph 5).

The practical conclusion for an IT department is therefore different from “buy better tools”: with an identical technical security posture, the largest difference in exposure to a sanction arises between an organization that has a rehearsed and documented reporting path and one that does not. If you cannot point today to the person responsible for starting the 24-hour clock and to the document where this is written down, that is where the cheapest gap to close is. Round-the-clock detection and classification of events is provided by SOC as a Service, and the formal requirements of both regimes are tied together by NIS2 compliance.

When Were Member States Required to Transpose the Directive and What Transitional Periods Follow from It?

The transposition deadline expired on 17 October 2024, but the transitional periods that actually apply to a business follow from national law, not from the directive itself. Directive (EU) 2022/2555 entered into force on 16 January 2023, on the twentieth day after its publication in the Official Journal of the EU of 27 December 2022 (OJ L 333/80), and set Member States a deadline of 17 October 2024 to adopt and publish the implementing provisions.

The expiry of the transposition deadline is not, however, the same as the activation of obligations for a specific company. An entity’s obligations follow from the national act and its transitional provisions — and in Poland, as the table in the previous section shows, these spread implementation over twelve and twenty-four months from 3 April 2026. The remaining deadlines in the directive are addressed to states, not to companies.

Mixing these two orders is the source of the most common planning error. The sentence “penalties have applied since October 2024” is true as a description of a state’s obligation and false as a description of a Polish company’s exposure.

How Can Companies Prepare to Avoid NIS2-Related Penalties?

Preparation starts by establishing the entity’s classification, not by buying a tool — because the classification determines the catalogue of obligations, the penalty ceiling, and whether the authority will come on its own initiative or only after a signal. The sequence that organizes the work and at the same time builds the evidence file for any proceedings looks as follows.

Step 1 — classification and authority. Establish whether you are an essential or an important entity, based on the sector listed in the annexes to the act and the size of the entity, and then establish your competent authority. This is a single decision that has to be written down with its reasoning, because everything downstream depends on it.

Step 2 — risk analysis and approval of measures. Carry out a risk assessment and obtain formal approval of the measures by the management body, in a form that has an author and a date (Article 20(1) NIS2). Without that document, the remaining evidence hangs in the air.

Step 3 — the measures under Article 21(2). Implement the measures from the directive’s catalogue: risk analysis policies, incident handling, business continuity, supply chain and development security, assessment of the effectiveness of the measures, cyber hygiene and training, cryptography and encryption, access control and multi-factor authentication. The catalogue is open-ended — the directive speaks of “at least” these areas.

Step 4 — incident reporting. Write and rehearse a procedure covering the 24 h / 72 h / one month sequence, with a named person deciding on the classification of an event.

Step 5 — contact points and a reporting channel. Designate at least two people for contact with the entities of the national cybersecurity system (Article 9(1)(1) of the National Cybersecurity System Act) and provide users of the service with the ability to report a cyber threat, incident or vulnerability. Both of these items have their own points in the catalogue of penalties for the head of the entity (Article 73a(1)(6) and (7)).

Step 6 — management training with evidence. Arrange annual training for the head of the entity and for the person entrusted with the head’s cybersecurity duties, and document attendance (Article 8e of the National Cybersecurity System Act).

Step 7 — supply chain and audit. Review supplier contracts against security requirements, and plan the audit so that it fits the statutory cycle — treating its findings as material to be remedied, not as an assessment to be defended. A security audit is a common starting point, and for entities operating in parallel under the National Cybersecurity System Act — KSC compliance.

The common denominator of all these steps is the evidence file. In proceedings there is no difference between a measure that does not exist and a measure whose existence cannot be demonstrated — the authority assesses documents and records, not the conviction of the person it is talking to.

How Do NIS2 Non-Compliance Penalties Compare to Other EU Regulations?

The NIS2 penalty ceilings are built on the model of the GDPR, but the scope, the addressee and the procedure are different — and on one point the two regimes expressly exclude each other. The similarity of construction is plain: an upper limit expressed as an amount or a percentage of worldwide turnover, whichever is higher, and a requirement that penalties be effective, proportionate and dissuasive (NIS2: Article 34(1), (4) and (5); GDPR: Article 83(1), (4) and (5)).

The differences, however, are fundamental. The GDPR protects personal data and addresses its obligations to the controller and the processor; NIS2 protects the continuity and security of services in designated sectors and addresses its obligations to an essential or important entity. The GDPR knows no ban on exercising managerial functions and no monitoring officer.

The point of contact matters most. Article 35(1) of the directive requires competent authorities which, in the course of supervision, become aware that an infringement of Article 21 or 23 may entail a personal data breach notifiable under Article 33 GDPR, to inform without undue delay the supervisory authorities referred to in Articles 55 and 56 GDPR. Article 35(2), in turn, settles that where a supervisory authority has imposed an administrative fine under Article 58(2)(i) GDPR, the competent authority shall not impose a further fine under Article 34 NIS2 for an infringement arising from the same conduct. It may, however, still apply the enforcement measures under Article 32(4)(a)-(h), Article 32(5) and Article 33(4)(a)-(g).

The practical conclusion is that there will be no double fine for the same conduct, but there will very much be double proceedings, and the NIS2 supervisory measures do not disappear along with the fine. The same area is also regulated by, among others, Directive (EU) 2022/2557, Regulation (EU) 2022/2554 (DORA) for the financial sector and Regulation (EU) 2019/881 — NIS2 expressly provides for cooperation between authorities across those regimes (Article 32(9) and (10)).

---

The sanction that reaches the person, not the balance sheet

Financial penalties are quoted most often, because they can be compared with revenue and fitted into a single sentence. From the perspective of the person running the company, however, a different measure is the harshest: a temporary ban on exercising managerial functions. The directive provides for it only against essential entities (Article 32(5)(b)) and only once earlier enforcement measures have proved ineffective and the entity has failed to remedy the deficiencies within the deadline set by the authority. The ban covers people discharging managerial responsibilities at chief executive officer or legal representative level, it applies to holding functions in that entity, and it lasts only until the deficiencies are remedied. Important entities are not subject to it — Article 33(5) extends to them only Article 32(6) to (8). The company pays the fine; the ban reaches a specific human being.

This explains why the training obligation is addressed to the management body and not to the IT department: the legislator assumes that the person bearing the liability should understand what they are approving. The cheapest way to close that gap is to make sure the board knows what it is signing off on before it has to — which is what NIS2 training for boards is for.

Legal basis and sources

• Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 (NIS2), OJ L 333/80 of 27 December 2022 — Articles 20, 21, 23, 32, 33, 34 and 35.
• Act of 5 July 2018 on the National Cybersecurity System, as amended by the Act of 23 January 2026 (Journal of Laws 2026 item 252, in force since 3 April 2026) — Articles 8e, 9, 11, 12a, 15, 41, 73 and 73a, and Articles 33, 35 and 49 of the amending act.
• Regulation (EU) 2016/679 (GDPR) — Articles 33, 55, 56 and Article 58(2)(i), as regards the relationship with Article 35 NIS2.

Legal position as at 18 September 2026.

Related Terms

Learn key terms related to this article in our cybersecurity glossary:

• Security Operations Center (SOC) — Security Operations Center (SOC) is a central location where a team of security…
• SOC as a Service — SOC as a Service (Security Operations Center as a Service), also known as…
• Network Security — Network security is a set of practices, technologies, and strategies aimed at…
• Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
• Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…

---

Learn More

Explore related articles in our knowledge base:

• How Does the NIS2 Directive Affect Enterprises? A New Era of Business Cybersecurity
• NIS2 directive in practice: What does a manufacturing plant manager need to know about the new obligations?
• NIS2 national implementation: how the directive is changing cybersecurity law across Europe
• What Are the Main NIS2 Directive Requirements? Comprehensive Guide for Regulated Entities
• What are the penalties for non-compliance with the DORA regulation?

---

Explore Our Services

Need cybersecurity support? Check out:

• NIS2 compliance - implementing compliance and avoiding penalties under the NIS2 Directive
• NIS2 readiness check - find out which obligations are not yet evidenced
• KSC compliance - meeting the requirements of the Polish National Cybersecurity System Act
• Security Audits - comprehensive security assessment
• Penetration Testing - identify vulnerabilities in your infrastructure
• SOC as a Service - 24/7 security monitoring

---

Related topics

See also:

• NIS2 for hospitals — implementation and funding
• Security Audit Pricing Calculator
• NIS2 for hospitals — compliance

Frequently asked questions

What are the maximum financial penalties for non-compliance with the NIS2 Directive?

Article 34(4) of Directive (EU) 2022/2555 requires Member States to provide, for essential entities, administrative fines with a maximum of at least EUR 10 000 000 or at least 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs — whichever is higher. For important entities, Article 34(5) provides for EUR 7 000 000 or 1.4% of that turnover respectively. These are ceilings, not rates: the amount of a specific fine is set by the competent authority taking into account the circumstances listed in Article 32(7).

Beyond financial penalties, what other consequences follow from a NIS2 violation?

Article 32(4) of Directive (EU) 2022/2555 lists, for essential entities: warnings, binding instructions and orders to remedy deficiencies, an order to inform the recipients of the service about a significant cyber threat, an order to implement the recommendations of a security audit, the designation of a monitoring officer, and an order to make the violation public. Only once those measures have proved ineffective does Article 32(5) allow the temporary suspension of a certification or authorisation, or a request for a temporary ban on exercising managerial functions. For important entities the catalogue in Article 33(4) is narrower and does not include the measures under Article 32(5).

What exactly is the personal liability of management for NIS2 compliance?

Article 20(1) of Directive (EU) 2022/2555 requires Member States to ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures, oversee their implementation, and can be held liable for infringements of Article 21 by those entities. In Polish law this liability takes the form of a financial penalty on the head of the entity — in an amount not exceeding 300% of the remuneration received, calculated on the basis used for holiday pay equivalent (Article 73a(4) of the National Cybersecurity System Act as amended, Journal of Laws 2026 item 252).

From when can penalties under the Polish National Cybersecurity System Act actually be imposed?

The amendment to the Polish National Cybersecurity System Act of 23 January 2026 (Journal of Laws 2026 item 252) has been in force since 3 April 2026, but its Article 35 provides that the financial penalties under Articles 73(1)-(4) and Articles 73a-73c may be imposed for the first time only after two years from the date the act entered into force — that is, no earlier than after 3 April 2028. Entities perform the obligations under Chapter 3 within 12 months of entry into force (Article 33(1) of the amending act), and the first audit of an essential entity falls within 24 months (Article 33(2)).

How can organizations avoid penalties for a NIS2 violation?

Avoiding penalties requires a complete implementation: an audit of the current security posture, the design and roll-out of the required information security management system (ISMS), incident reporting procedures, regular security testing, and training for the management body and staff. When setting a fine, the authority must take due account of the level of cooperation with it and of the measures taken to prevent or limit damage (Article 32(7)(f) and (h), applied to fines by Article 34(3) of the directive).