NIS2 fines: the maximum the directive requires
Article 34 does not cap fines. It requires each member state to provide for a maximum of at least a fixed amount or a share of worldwide turnover, whichever is higher, for infringements of article 21 (risk-management measures) or article 23 (incident reporting). This calculator shows that minimum. Your national law may set a higher maximum.
A floor for the national maximum, not a forecast
Article 34(4) and (5) require a maximum of at least these amounts. The directive sets a floor for the national maximum: it is neither a cap nor a prediction of what an entity would pay. The maximum that binds you is the one in your national law, which may be higher. When deciding whether to impose a fine and how much, authorities must give due regard, as a minimum, to the elements of article 32(7) (article 34(3)): the seriousness of the infringement and the importance of the provisions breached, its duration, previous infringements, the damage caused, intent or negligence, measures taken to prevent or mitigate the damage, adherence to approved codes of conduct or certification mechanisms, and the level of cooperation.
A fine is imposed in addition to the measures of articles 32 and 33 (article 34(2)) — among them targeted security audits, whose cost falls on the audited entity unless the authority decides otherwise (articles 32(2) and 33(2)), orders to remedy, and orders to make aspects of an infringement public. Whether and to what extent fines apply to public administration entities is for each member state to lay down (article 34(7)).