NIS2 fine calculator

Enter category and turnover: see the maximum and minimum that Article 38 of D.Lgs. 138/2024 sets for your case, with the workings shown.

For the most serious NIS2 violations, such as failing to adopt the security measures or to notify an incident, an essential entity faces up to €10 million or 2% of worldwide annual turnover, whichever is higher; an important entity up to €7 million or 1.4%. There is also a minimum: one twentieth of the maximum for essential entities, one thirtieth for important ones. The calculator applies these rules of Article 38 of Legislative Decree 138/2024 (D.Lgs. 138/2024), Italy's NIS2 transposition, to your turnover.

Category of the entity

Not sure? Find out with the self-assessment.

Worldwide annual turnover of the previous financial year (€)

As a rule, the turnover of partner and linked enterprises counts too, as when calculating company size (Recommendation 2003/361/EC). If it is in another currency, enter the amount already converted into euro.

Type of violation

Security and notification: For example: basic measures not adopted, an incident not notified, management bodies not trained.
Registration and information: For example: annual update not done, categorisation not submitted.

Special circumstances (optional)

The same violation has already been sanctioned in the past (repeat of the same violation)

A different violation has already been sanctioned (repeat of a different violation)

We did not register on the ACN portal, or we registered late

This calculator shows the limits set by Article 38 of D.Lgs. 138/2024: it does not estimate the fine you would receive. ACN decides the actual amount case by case, taking into account seriousness, duration, cooperation and the other criteria of the decree, and proceedings can end without a fine. It is not legal advice. The calculation runs in your browser: we do not record the data you enter.

The calculation rules

T is the worldwide annual turnover of the previous financial year. The amounts are statutory maximums and minimums, not estimates.

Paragraph 8 violations (security, notification, formal warnings)

Category	Maximum	Minimum	Article 38
Essential	the higher of €10,000,000 and 2% of T	one twentieth of the maximum	para. 9(a)
Important	the higher of €7,000,000 and 1.4% of T	one thirtieth of the maximum	para. 9(b)
Essential PA or public company	€125,000	€25,000	para. 9(c)
Important PA or public company	€83,333 (reduced by one third)	€16,667	para. 9(d)

Paragraph 10 violations (registration, information, categorisation, cooperation)

Category	Maximum	Minimum	Article 38
Essential	0.1% of T	unclear (paragraph 11 refers to the minimums of paragraph 9)	para. 11(a)
Important	0.07% of T	unclear (as above)	para. 11(b)
Essential PA or public company	€50,000	€10,000	para. 11(c)
Important PA or public company	€33,333	€6,667	para. 11(d)

Repeat of the same violation: the fine is increased up to twofold (paragraph 12).
Repeat of a different violation: the fine for the most serious violation applies, increased up to threefold (paragraph 12).
Failure to register, or late registration: all the violations are charged and the fine for the most serious one applies, increased up to threefold (paragraph 13).
For the public administrations and public companies identified, failure to notify an incident is fined only when the same violation is repeated within five years (paragraph 14).
Reduced payment: one third of the maximum or, if more favourable and where established, twice the minimum, within 60 days of notification of the charge (paragraph 15(b)).

How we read the text: the “statutory maximum” on which the minimum is calculated is the maximum applicable to the case, that is the higher of the fixed amount and the percentage. This is the literal reading of paragraph 9; it has not yet been confirmed by a lawyer or by ACN practice.

Which violations cost the most

Article 38 divides violations into two groups. The most serious (paragraph 8) concern the obligations of the management bodies (Article 23), the risk management measures (Article 24), incident notification (Article 25) and compliance with ACN's provisions and formal warnings: for example basic measures not adopted, an incident not notified, management bodies not trained. They are punished with the fines of paragraph 9.

The others (paragraph 10) concern registration and updating of information on the ACN portal, categorisation of activities and services, certification schemes and domain name registration data (Articles 27, 29 and 32), and cooperation with ACN and with CSIRT Italia: for example an annual update not done or a categorisation not submitted. They are punished with the fines of paragraph 11.

For banks and financial market infrastructures (sectors 3 and 4 of Annex I), Article 17 and Chapters IV and V of the decree do not apply: Regulation (EU) 2022/2554, DORA, applies instead (Article 3(14)). The calculator does not cover their case.

Who is liable, besides the company

The natural persons responsible for an essential entity, or who represent it with the power to take decisions and exercise control, must ensure compliance with the decree and can be held liable for violations (Article 38(5)). If the entity fails to comply with a formal warning, ACN can apply to the administrative and executive bodies, and to whoever acts as chief executive or legal representative, the ancillary sanction of unfitness to perform management functions in the entity, until the shortcomings are remedied (paragraph 6).

What ACN does before imposing a fine

Gradual supervision: ACN checks compliance with the obligations through a gradual, risk-based approach (ACN FAQ MVE.1).
Inspections: on essential entities they can be ordered even before any warning sign (ex ante); on important entities there must be information suggesting a possible violation (FAQ MVE.3).
Orders and formal warnings: before a fine, ACN can indicate what to correct, with reasonable procedures and deadlines (FAQ MVE.4).

Frequently asked questions

Is the fine calculated on the company's turnover or the group's?

On the total worldwide annual turnover of the previous financial year, calculated under Recommendation 2003/361/EC: as a rule, therefore, it includes partner and linked enterprises. If you are part of a group, have the scope checked.

Could a small company face €10 million?

The statutory maximum for an essential entity is €10 million even with low turnover, because the higher of €10 million and 2% applies. It is a ceiling, not an estimate: ACN decides the actual amount proportionately. Remember, though, that small enterprises are normally outside the scope.

Does the minimum always apply?

The decree sets a minimum for the most serious violations: one twentieth of the maximum for essential entities and one thirtieth for important ones. For violations on registration and categorisation the text refers to the same minimums, with effects the decree does not make clear: see the note in the result.

What happens if I have not registered?

ACN charges all the violations provided for and applies the fine for the most serious one, increased up to threefold (Article 38(13)).

Sources

The sources are official texts, published in Italian.

Updated 23 September 2026. If a source changes, we update the page.

Back to resources