Directive NIS2 European Union
Check your scope Cart 0
Art. 20, 32 & 34 · Directive (EU) 2022/2555

Penalties and management liability

The fines are large. The provision that changed behaviour in boardrooms is not the fine — it is the possibility of being banned from management.

Administrative fines

Art. 34(4)

Essential entities

Maximum of at least

10 M€

or at least 2% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs — whichever is higher.

Art. 34(5)

Important entities

Maximum of at least

7 M€

or at least 1.4% of the total worldwide annual turnover in the preceding financial year of the undertaking to which the entity belongs — whichever is higher.

« Whichever is higher » matters: for any group with turnover above €500 million, the percentage, not the fixed amount, is the higher figure. Both are floors for the national maximum: for infringements of article 21 or 23, article 34(4) and (5) require a maximum of at least these amounts, and national law may set a higher one.

Calculate the required maximum →

Other supervisory powers

Fines are not a separate last step: article 34(2) says they are imposed in addition to the measures of article 32(4), points (a) to (h), article 32(5) and article 33(4), points (a) to (g). Article 32 gives competent authorities a set of supervisory and enforcement measures for essential entities, and article 33 a narrower one for important entities:

  • on-site inspections and off-site supervision, including random checks
  • regular and targeted security audits, including at the entity's expense
  • security scans and requests for information and evidence
  • binding instructions and orders to remedy identified deficiencies
  • orders to inform the natural or legal persons affected by a threat
  • orders to make aspects of non-compliance public

The provision that changed boardrooms

Article 32(5)(b) allows the competent authority, where other enforcement has failed, to request the temporary prohibition of any natural person exercising managerial responsibilities at chief executive officer or legal representative level from exercising those functions in that entity. Point (a) lets it suspend a certification or authorisation the entity holds.

These apply to essential entities. Combined with article 20, they turn cybersecurity from a budget line into a personal exposure for named individuals.

Article 20: what management bodies must actually do

The obligation is specific, and each part is auditable:

  • Approve the cybersecurity risk-management measures — a documented decision, not an informal nod.
  • Oversee their implementation — recurring reporting to the management body, with evidence it was read and acted on.
  • Follow training — the members of the management body themselves, so they can identify risks and assess risk-management practices. Member states must also encourage entities to offer similar training to their employees.

Member states must ensure management bodies can be held liable for infringements of article 21 by the entity (article 20(1)). How that liability is organised is a matter for national law.

What article 20(1) asks for

The management body approves the cybersecurity risk-management measures the entity takes to comply with article 21, and oversees their implementation. The approval is its own act: keep the decision that records it.

Common questions

Can a director personally be fined under NIS2?
The administrative fines in article 34 are addressed to the entity, not to individuals. What article 20(1) adds is that member states must ensure management bodies can be held liable for infringements of article 21 by the entity; the form that liability takes is a matter for national law. Separately, for essential entities: where enforcement measures under article 32(4), points (a) to (d) and (f), have been ineffective and the requested action is not taken within the deadline set, article 32(5)(b) allows a competent authority to request a temporary prohibition on a natural person at CEO or legal representative level exercising managerial functions in the entity. And article 32(6), which article 33(5) applies mutatis mutandis to important entities, requires member states to ensure that it is possible to hold liable, for breach of their duties to ensure compliance, the natural persons who represent the entity, take decisions on its behalf or exercise control of it. That is a personal consequence, even though it is not a personal fine.
Is the fine 2% of group turnover or of the entity turnover?
Article 34 refers to the total worldwide annual turnover of the undertaking to which the essential or important entity belongs, for the preceding financial year. In other words the group figure, not the local subsidiary figure. For large groups this makes the percentage, not the fixed EUR 10 million, the higher of the two figures. Both are floors for the national maximum (article 34(4) and (5) say "at least"), so national law may set a higher one.
Will authorities actually fine, or is this theoretical?
The directive does not say how often authorities will fine; that is national enforcement. What it sets is the range of measures. For essential entities, article 32(4) lists warnings, binding instructions, orders to cease conduct, orders to bring the measures into compliance, orders to inform affected persons, orders to implement security audit recommendations, a monitoring officer, orders to make aspects of an infringement public, and administrative fines; article 33(4) gives a comparable list for important entities. Fines are not a last step after the others: article 34(2) says they are imposed in addition to any of those measures.
We are an important entity. Does the management ban apply to us?
No. The temporary management prohibition and certification suspension in article 32(5) apply to essential entities. Important entities are supervised under article 33, which provides for ex post supervision and a narrower set of enforcement measures. The article 20 obligations on management bodies apply to both.
Does good security protect us from a fine?
Not on its own. The fines of article 34(4) and 34(5) concern infringements of article 21 or 23: appropriate and proportionate risk-management measures that include at least the ten points of article 21(2), and the reporting of significant incidents. Article 20(1) separately requires the management body to approve the cybersecurity risk-management measures and oversee their implementation, and articles 3(4) and 27 set registration duties. Technical security does not, by itself, discharge those other duties.
Art. 20

Board & Management Accountability Pack

Article 20 requires management bodies to approve the cybersecurity risk-management measures and oversee their implementation, makes it possible to hold them liable, and requires their members to follow training. This pack is what you put in front of them.

  • Measure brief (Markdown): exactly which points of article 21(2) this covers, and what each requires
  • Transposition table for all 27 member states (CSV): transposition status, competent authority, the national article carrying the measures, how many measures national law contains, the applicable assessment framework and its owner
  • Implementation worksheet (CSV): per measure, five implementation questions — approved document, scope, evidence, review, accountability — with columns for status, the artefact that proves it, owner and target date
  • Framework mapping (CSV): each covered measure of article 21(2) against all eight frameworks in our data hub — the six national assessment frameworks plus ISO/IEC 27001 and NIST SP 800-53 — with the units that carry it, the level the mapping is made at, and the stated limit of that mapping
  • Mapping legend (CSV): every framework unit cited, with its meaning — the 22 NIST CSF 2.0 categories used by CyFun, the 10 IT-Grundschutz layers, the 10 C2M2 domains, the 93 ISO/IEC 27001 Annex A controls and the 20 NIST SP 800-53 families
  • NIS2-to-enterprise crosswalk (CSV): one row per measure, one column per framework — the national frameworks a supervisor reads, then ISO/IEC 27001 Annex A controls and NIST SP 800-53 families, so you can see what you already hold before building anything new
  • Article 20 management record (CSV): the three duties article 20 places on the management body — approving the cybersecurity risk-management measures, overseeing their implementation, following training — its exposure to liability for infringements of article 21 (article 20(1)), and the employee training article 20(2) encourages, each with the evidence that shows it; article 21(2)(g) separately requires cybersecurity training as a measure of the entity
  • Regenerated from our data hub, so it carries the same review date as the site
49 € excl. VAT

Instant download · 30-day money-back guarantee

Cart 0