FREE TOOL
What could ignoring NIS2 cost your company?
This free calculator shows the highest fine the Belgian NIS2 law allows for your company: up to €10 million for an essential entity, €7 million for an important one, or more if that share of turnover is higher. Pick your entity type and enter your group turnover.
The law counts the turnover of the whole group your company belongs to, not only the Belgian company.
The highest fine the law allows
Important entity
€7,000,000
€7,000,000 or 1.4% of worldwide annual turnover, whichever is higher
Here the fixed ceiling is the higher amount.
The law sets a range: from €500 up to this amount.
Smaller fines, for every company in scope
- Up to €125,000 for not giving the CCB the information it asks to identify you.
- Up to €200,000 for not cooperating with an inspection or other supervision.
- Up to €200,000 for penalising someone working for you because they did their NIS2 job in good faith.
What reaches the directors
Directors and legal representatives are personally liable for making sure the company follows the law (art. 61). In an essential entity that does not take the measures asked in time, the CEO or legal representative can be temporarily banned from management (art. 60).
Source: Belgian NIS2 law of 26 April 2024, art. 59-62.
What is the NIS2 fine rule?
The Belgian NIS2 law of 26 April 2024 (art. 59) [1] sets the fine for not taking the required security measures or not reporting an incident. The regulator picks an amount inside the range, based on how serious the breach is.
- Essential entity: from €500 up to €10,000,000 or 2% of the worldwide annual turnover of the group, whichever is higher.
- Important entity: from €500 up to €7,000,000 or 1.4% of the worldwide annual turnover of the group, whichever is higher.
The law counts last year’s turnover of the whole group your company belongs to. If the same facts happen again within three years, the fine doubles. Public bodies get no NIS2 fines.
Example: an important entity in a group with €1 billion turnover. 1.4% of that is €14 million, more than the €7 million ceiling, so the highest fine is €14 million.
What this means for directors and public bodies is covered in detail on the NIS2 penalties page.
Not sure the law applies to you?
The NIS2 scope check asks a few questions about your sector and size, and tells you if you are essential, important or out of scope.
Do the scope check →Frequently asked questions
- What is the maximum NIS2 fine in Belgium?
- For an essential entity, €10 million or 2% of worldwide annual group turnover, whichever is higher. For an important entity, €7 million or 1.4%. The fine doubles if the same facts repeat within three years.
- Whose turnover counts?
- The worldwide annual turnover in the previous financial year of the undertaking your company belongs to. For a Belgian subsidiary of a larger group, that is the group turnover, not only the Belgian company.
- Is the NIS2 fine the same as a GDPR fine?
- No. GDPR fines follow their own rules. The NIS2 amounts are the ones in the Belgian NIS2 law of 26 April 2024, art. 59.
- Can directors be held personally responsible?
- Yes. Directors and legal representatives are liable for making sure the company follows the law (art. 61). In an essential entity, the CEO or legal representative can also be temporarily banned from management if the company does not take the measures asked in time (art. 60).
- Do public bodies pay NIS2 fines?
- No. The Belgian NIS2 law does not apply its fines to public-sector entities (art. 62). The other supervisory measures still apply.
Related free tools
- Incident reporting clock Enter when you found out about a cyber incident. Get every Belgian NIS2 reporting deadline to the CCB, plus the GDPR 72-hour deadline, to the minute.
- CyFun readiness quiz 19 plain questions covering the 34 controls of CyberFundamentals (CyFun) 2025 Basic. A score and a fix-first list, no email needed.
- NIS2 scope check Sector, size and a supply-chain step: see in about two minutes whether a company is an essential or important NIS2 entity, or out of scope, and which customer sectors push requirements down anyway.
- Domain security check Scans SPF, DMARC, DKIM, DNSSEC, CAA, MTA-STS, TLS-RPT, MX and HTTPS/HSTS for any domain, each finding mapped to a CyFun control and a NIS2 duty.
- Ransomware downtime cost calculator Enter your staff count, hourly cost and days down. See what a ransomware attack would cost your company, per day and in total, with the formula shown.
2026-11-03
Computed with the free tool at https://easycyberprotection.com/learn/tools/nis2-fine-calculator/, by Easy Cyber Protection.