Free
NIS2 penalty exposure
Article 34 sets the ceiling as the higher of a fixed amount and a percentage of worldwide turnover. For most groups, the percentage is the real number.
Fixed ceiling
—
Percentage of turnover
—
Maximum exposure
—
A ceiling, not a forecast
This is the statutory maximum. Actual fines are set by national authorities, which must take into account the gravity and duration of the infringement, damage caused, whether it was intentional or negligent, mitigating action taken, and cooperation with the authority (article 34(7)). Article 32 also gives authorities powers short of a fine — mandatory audits at your expense, orders to remedy, and orders to publish aspects of non-compliance.