NIS2 Enforcement Has Started: What the First Actions Tell Industrial Operators

NIS2 moved out of the preparation phase some time ago. In member states that transposed on or near time, supervisory authorities now have inspection powers, information request powers and the ability to impose administrative fines. Meanwhile four states were referred to the Court of Justice in July 2026 for not transposing at all. The result is a two speed Europe where your exposure depends on where you operate.

For industrial operators the useful question is not how large the fines can be. It is what supervisory authorities look at first, because that is where your remediation budget should go. Across the enforcement activity visible so far, the pattern is consistent and it is not the pattern most OT security programs are built around.

The fine structure, briefly

Entity category	Fine floor member states must enable
Essential entities	At least 10 million euro or 2 percent of total worldwide annual turnover, whichever is higher
Important entities	At least 7 million euro or 1.4 percent of total worldwide annual turnover, whichever is higher

 

Those are minimums that national law must make available, not ceilings. More consequential for most operators are the non financial powers: binding instructions, mandatory audits at your expense, public disclosure of the infringement, and for essential entities the temporary suspension of authorizations or bans on individuals in management functions. A public finding does more commercial damage than a fine in most industrial markets.

What authorities test first

Supervision is proportionate by design: essential entities face proactive supervision, important entities are supervised reactively after an incident or a credible indication. In both cases the opening moves are documentary, and they are the same four questions.

• Are you registered. The simplest possible failure and a surprisingly common one. Entities that never worked out they were in scope have nothing else to discuss.
• Can you produce the Article 21 measures as documents. Not as controls in a tool. As approved policies with dates and owners.
• Did the management body approve them. Article 20(1) evidence. Minutes, not assertions.
• Do you have an asset inventory. Everything downstream depends on it, and in OT environments it is the most common genuine gap. Our guide to non-disruptive OT asset discovery covers how to build one without touching production.

The gap that shows up in almost every industrial assessment Operators with genuinely strong technical controls routinely fail documentary review. The segmentation is sound, the monitoring works, the engineers know the plant. But nothing is written down in a form an inspector can accept, there are no approval records, and the asset inventory lives in one person's spreadsheet. Enforcement is a documentation test before it is a security test, and that is the inversion most OT teams do not expect.

 

Why incident reporting drives most enforcement

Enforcement rarely begins with an inspector arriving unannounced. It begins with an incident. You file an early warning within 24 hours, and that filing is the authority's first close look at you. Everything they ask next is shaped by whether the report was timely, coherent and consistent with what they can see. A late or confused filing turns a security event into a compliance event.

Which means the highest leverage preparation is not a new tool. It is a tested reporting process with a named decision maker, pre-written templates and a clear threshold for what counts as significant. Our ICS ransomware defense playbook covers the incident side, and building an OT monitoring program covers the detection capability that makes a 24 hour clock survivable.

What to fix before an inspection

• Confirm your registration status in every member state where you operate.
• Produce the Article 21 measures as dated, approved, owned documents.
• Get management body approval and oversight into the minutes.
• Build or validate the OT asset inventory. Nothing else is credible without it.
• Run one reporting dry run against a plausible OT scenario and time it.

That list is deliberately unglamorous. It is also what the enforcement activity so far suggests actually gets examined.

Why Choose Arista Cyber

We assess live industrial environments and we write the evidence that survives review, which are different skills that have to meet. Our consultants work to IEC 62443 and hold functional safety credentials, so remediation we recommend accounts for what a change does to a running process. Our case studies show that work on real assets.

Next Steps

Start with a documentary readiness review rather than a technical assessment, because that is the order an authority will use. Then close the asset inventory gap and run a timed reporting exercise. Most operators find the technical posture is better than the paperwork, which is good news and a quick fix.

Common Questions

Have any NIS2 fines actually been issued?

Supervisory authorities in transposed states have enforcement powers and have begun using them, though the public record remains thin and varies sharply by country. Treat specific fine figures circulating online with caution and verify against the national authority before relying on them.

What is the maximum NIS2 fine?

The directive sets floors that member states must enable: at least 10 million euro or 2 percent of worldwide turnover for essential entities, and 7 million euro or 1.4 percent for important entities, whichever is higher. National law may go higher.

Are important entities inspected the same way as essential entities?

No. Essential entities face proactive supervision including regular audits. Important entities are supervised reactively, after an incident or evidence of non-compliance.

Can authorities force us to pay for our own audit?

Yes. Supervisory powers include ordering targeted security audits carried out at the entity's expense, alongside binding instructions and public disclosure of infringements.

We operate in a state that has not transposed. Are we safe?

For now there is no national law to enforce, but it is coming and the transitional period is likely to be short given how late those states already are. Build to the directive and to IEC 62443 in the meantime.

Would your documentation survive a supervisory review? Arista Cyber runs NIS2 documentary readiness reviews for industrial operators: registration status, Article 21 evidence, management body records, asset inventory validation and a timed reporting dry run. Request a readiness review