In brief: NIS2 provides for fines of up to €10 million for compliance violations; companies must now review their security measures.
The NIS2 Directive stipulates financial penalties of up to €10 million for violations of cybersecurity and compliance obligations. Companies must prepare for these substantial financial risks.
The amendment to the European Union’s Network and Information Security Directive (NIS2) defines fines of up to €10 million for violations of its requirements. This applies in particular to critical infrastructures and operators of essential entities that fall under the Directive’s tightened security obligations.
For compliance officers, this concretely means: insufficient security measures, missing incident response processes, inadequate use of encryption, or incomplete risk assessments can result in substantial penalties. The fines are graduated and take into account the nature, severity, and duration of the violation.
Organizations should therefore systematically review their NIS2 readiness: inventorization of critical systems, validation of cybersecurity measures according to NIS2 standards, establishment of incident response processes, and regular compliance audits are essential. The exact implementation deadlines and transition rules vary depending on operator category and member state.
Source: news.google.com · Published 25 June 2026
Lumi AI News — AI-assisted curation pursuant to Article 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.7.1.