NIS2 - CYBERSECURITY ACT
Fines and sanctions
The Cybersecurity Act gives supervisors various tools to address violations, from a warning to a hefty fine. Below you can see how that works.
The maximum fines at a glance
These are the statutory maximum amounts. Supervisors determine the actual amount based on the severity of the violation.
Essential entities
€10 million
Or 2% of the global annual turnover, if that amount is higher.
Important entities
€7 million
Or 1.4% of the global annual turnover, if that amount is higher.
This is how enforcement proceeds
A fine is not the first step. Supervisors apply a proportional escalation:
1
Warning
An instruction with a recovery period to resolve it yourself.
2
Binding instruction
An obligation to take specific measures, possibly with a mandatory audit.
3
Administrative fine
For persistent or serious violations, often with public disclosure.
4
Management ban
The heaviest sanction: temporary suspension of a director. Rarely used
Who supervises?
Depending on your sector, you will deal with one of these supervisors:
- National Inspectorate Digital Infrastructure (RDI): the primary supervisor
- De Nederlandsche Bank (DNB): supervision of the financial sector
- Authority for the Financial Markets (AFM): supervision of the financial markets
- Other sectoral supervisors, depending on your sector
Prevent it from getting that far
Know whether you fall under NIS2, and ensure your measures are in order before a supervisor asks for them.