NIS2 / BSIG § 65 — Fine Framework

NIS2 Fines: Sanctions, Procedure, Prevention

The BSIG provides for substantial fines for NIS2 violations — tiered by entity category and severity of the violation. We explain the figures, the procedure, and how to effectively avoid fines.

Request Consultation NIS2 Overview

§ 65 BSIG — Fine Framework

What Fines Threaten for NIS2 Violations?

The fine regime under § 65 BSIG tiers sanctions by entity category and severity of the violation. The higher of the two amounts always applies — the percentage of turnover or the absolute maximum amount.

Fine Framework Under the BSIG

Entity Category	Max. Absolute	Max. % of Turnover
Especially important entities	€10 million	2%
Important entities	€7 million	1.4%

effectiveproportionate
& dissuasive

Note: Fines can also be imposed even if no security incident has occurred — based solely on inadequate compliance evidence. The BSI can carry out proactive reviews at any time.

Grounds for Fines

Which Violations Can Result in Fines?

Missing Risk Measures

No or inadequate implementation of the risk management measures under § 30 BSIG.

Breach of Reporting Obligations

Late, incomplete or missing notification of significant security incidents to the BSI.

Missing Management Training

Executive management has not fulfilled or cannot demonstrate the training obligation under § 38 BSIG.

Missing BSI Registration

The affected entity has not registered with the BSI.

Procedure

How NIS2 Fine Procedures Work

How does the BSI check whether companies are NIS2-compliant?

The BSI has various supervisory instruments: ad-hoc reviews (following incidents or reports), proactive spot checks, and requests for compliance evidence. Especially important entities are subject to stricter supervision than important entities.

Does voluntary cooperation reduce the fine?

Yes, generally. Authorities take into account, when determining the fine, whether the company was cooperative, proactively reported incidents, and remedied deficiencies on its own initiative. Conversely, withholding information or obstructing reviews risks higher sanctions.

Can fines be imposed even without proven damage?

Yes. The BSIG sanctions the breach of compliance obligations — regardless of whether actual damage occurred. Missing documentation, missed training, or late registration are independent grounds for a fine.

Further NIS2 Topics

Minimise Fine Risk — Through Demonstrable Compliance

We help you fulfil all NIS2 obligations completely and build the documentation that protects you in the event of a BSI review.

Request Consultation Now