The question is no longer whether NIS2 will be enforced. It already is. Five fines have been handed down in Europe since January 2025, for a total of EUR 885,000. They cover five countries, five sectors and five distinct types of failure. Reading these cases in detail shows what authorities actually look for during an inspection.
The first five sanctions, country by country
The first confirmed NIS2 fine was handed down in Belgium in January 2025. A healthcare establishment was sanctioned to the tune of EUR 185,000 for failing to issue the early warning within 24 hours of detecting a significant incident. The violation existed. The systems had been compromised. But the organisation had no established procedure to trigger notification within the legal deadline. It was the procedure that was sanctioned, not the compromise itself.
In March 2025, an Italian cloud services provider was fined EUR 450,000 for the absence of a formalised risk management programme. No major incident had been declared, and no data leak had been published. The Italian authority (ACN) found during an audit that the organisation had no documented security policy covering its entire perimeter. The amount, the highest of the first wave, reflects the size of the entity and the extent of the shortfall.
In July 2025, a Hungarian water distribution company was sanctioned to the tune of EUR 78,000 for inadequate incident response procedures. The organisation had a continuity plan, but it had not been tested for more than eighteen months and did not cover cyber attack scenarios. An untested plan is treated, in the logic of NIS2, as a plan that does not exist.
In September 2025, a Lithuanian energy sector entity received a fine of EUR 52,000 for the absence of documented controls over its supply chain. Its critical ICT suppliers had not undergone any security assessment in the two years preceding the inspection.
In France, in February 2026, a DNS services provider was sanctioned to the tune of EUR 120,000 for late notification of a significant incident. The early warning had been sent to ANSSI 38 hours after the 24-hour legal deadline, and the intermediate report 11 days after the 72-hour deadline.
The signal these cases send
A cross-cutting reading of these five cases reveals a constant: none of them concerns a technical failure that would have made the inspection unavoidable. The authorities did not wait for a successful attack to act. They checked processes, procedures and registers. What they found, or did not find, was enough to ground the sanction.
The five failures identified (late notification, no risk management policy, untested response plan, missing supplier mapping, incomplete incident report) are all documentary or procedural gaps. None requires a particular technology or a significant hardware investment. They are the least costly failures to correct, which makes their persistence all the more notable.
To understand why notification deadlines remain a point of friction, the article on the operational pitfalls of NIS2 24-hour notification details the most frequent blocking points in French organisations.
Personal liability: two precedents
Beyond the fines imposed on organisations, two cases illustrate the activation of the personal liability provided for in Article 20 of NIS2.
In Belgium, the head of the sanctioned healthcare establishment received a personal fine of EUR 15,000, combined with an obligation to undergo cyber risk training. This is the first documented precedent of a named sanction against an executive under NIS2 in Europe.
In Italy, the competent authority proposed a temporary suspension of the CISO of the sanctioned cloud entity. This decision is being challenged before the Regional Administrative Court of Rome. Whatever the outcome of the appeal, the proceedings themselves are a signal: authorities are ready to use every tool NIS2 gives them, including those aimed at natural persons.
What national supervision programmes reveal
Beyond the five published fines, audit programmes have been launched in fourteen Member States targeting essential entities. The preliminary reports available identify five systematic shortcomings: supplier risk registers not kept up to date, undocumented incident response procedures, multi-factor authentication absent on administrator access, no responsible vulnerability disclosure policy, and insufficient training for governing bodies.
These five points constitute what auditors call first-level verification: checks carried out before even entering into the technical detail of the information system. An organisation that does not pass this first level does not progress to an in-depth audit: it receives an immediate formal notice.
What this means for your programme
Organisations that treated NIS2 as a documentary compliance exercise are, paradoxically, better positioned than those that invested heavily in tools without formalising their processes. This is not an argument for neglecting the technical side. It is an argument for starting with what authorities check first.
Three points to consolidate before the end of the quarter, without requiring any material investment. First, check that your NIS2 notification procedure is tested and that the people responsible for sending it know the ANSSI form and the 24-hour deadline. A two-hour simulation exercise is enough. Second, make sure your register of critical ICT suppliers is up to date and that each supplier has undergone a documented security assessment dated within the last twelve months. Third, verify that your incident response plan has been tested within the last eighteen months and that the exercise report is archived.
These three points form the minimum documentary foundation that the first five NIS2 cases show to be the first perimeter of inspection. Correcting them now costs less than explaining their absence to a supervisory authority.