Two ceilings, and 'whichever is higher'
Essential entities face administrative fines of up to €10,000,000 or 2% of total worldwide annual turnover, whichever is higher. For important entities the ceiling is €7,000,000 or 1.4%, on the same 'whichever is higher' basis.
Why it is like this
The percentage makes the ceiling bite on large groups, and the fixed sum makes it bite on smaller entities whose turnover would make a percentage trivial. 'Whichever is higher' is what stops either floor from becoming a cap.
Not to be confused with
GDPR's numbers. They are a different pair — €20M/4% and €10M/2% — on a different trigger, and both regimes can apply to the same organisation for the same event.
In practice
A group with €2 billion turnover faces up to €40 million as an essential entity: the 2% dominates. A €20 million entity faces €10 million: the fixed sum dominates.
Source: Directive (EU) 2022/2555 (NIS2) — Art. 34(4) and 34(5). Read on .
Connects to
- GDPR — Both regimes use a fixed sum or a percentage of worldwide turnover, whichever is higher — GDPR at €20M/4% and €10M/2%, on a different trigger. One incident can draw both.
Odd one out Check yourself
Three of these are NIS2 figures. Which belongs to another regime?
Show the answer
€20 million or 4% of worldwide turnover
€20 million or 4% is the GDPR's upper tier under Article 83(5). NIS2's ceilings are €10M/2% and €7M/1.4%.