You've read somewhere that NIS2 fines can reach up to ten million euros or two percent of turnover, and you're wondering whether that could happen to you. The short answer: those amounts are indeed in the Directive, but they are intended for essential and important entities — organizations that fall under NIS2 themselves, with a duty of care, a registration obligation and an incident reporting obligation. If your company does not fall under this but you do supply to such an organization, then a fine is not the risk you should be losing sleep over.
The risk you are more likely to face is more practical and comes sooner: a customer who is themselves subject to the duty of care must assess their suppliers. If you cannot answer the questionnaire or demonstrate compliance with the contractual requirements, the consequence is usually not a fine but loss of the contract. That process often takes weeks, not years.
For whom the fine is actually intended
The Directive directs enforcement at organizations that are themselves obligated: the essential and important entities from the sectors listed in Annexes I and II. For them, the national law — in the Netherlands the Cybersecurity Act — determines how the competent authority acts if the duty of care or the reporting obligation is not met. If you are not yourself obligated but supply to such an entity, you are not a party to that enforcement process. You do feel the impact of the Directive, but through the contractual requirements of your customer, not through a fine notice in your own name. If you are unsure whether your organization falls under the law itself, that can be determined with a few questions via the check that maps your situation in a few steps.
What the Directive states in terms of amounts
The Directive itself states maximum amounts for essential and important entities, with a higher ceiling for essential entities than for important ones. It is always the highest of a fixed amount or a percentage of global annual turnover — so not automatically the full amount for every violation. How the competent authority weighs things in a specific case, and what amount is actually imposed, is not specified in the Directive and is up to the competent authority. We deliberately make no prediction about this; what the Directive and the national law precisely say can be read in the official text and the publications of the competent authority.
Why the contract comes before the fine
A fine process typically only begins after signals, investigation and an opportunity to remedy — that takes time. A procurement department sending out a security questionnaire does not wait for that. If the answer is missing or incomplete, the order is often simply awarded to another supplier, or you are given a remediation period that you must fill yourself. For most SMEs, that makes the conversation with your customer more urgent than the question of whether a fine will ever come into play. More on what exactly lies behind such a questionnaire can be read in the overview of topics that have been researched for each situation.
What this means if you are supply chain-affected
If you are not yourself obligated but are a supplier to an obligated organization, the question is not whether a fine is looming, but whether you can demonstrate that you have the requested measures in place. This is about evidence, an owner for each measure and an answer you do not have to make up from scratch each time. Once you have documented this, answering the next questionnaire requires much less work. Frequently asked questions about what can and cannot be asked of you are collected at the frequently asked questions page.
If you are yourself essential or important, then the fine counts as a last resort, but the duty of care itself is the real work: implementing measures, documenting them and being able to show them. How that process is structured and where the information on this site comes from is explained on the page that explains how the platform works.
Do you want to know whether your organization falls under NIS2 itself, or is only affected through a customer? Take the free NIS2 check, or read through the knowledge base first — both are accessible without an account.