Skip to content
You can now search across every topic, entity and event.What's new
Cybersecurity: Threats and Defences
3AUG

NIS2 fines now reach directors personally

4 min read
16:08UTC

The EU's NIS2 regime reached full force on 1 June, with personal fines for directors now at the statutory maximum and the Commission referring laggard member states to its top court.

← Back to KEV deadlines fell from 14 days to threeJump to analysis ↓
TechnologyDeveloping
Key takeaway

NIS2 now fines directors personally at the full rate, with the Commission taking laggard states to court.

The EU's NIS2 regime reached full enforcement force on 1 June 1. NIS2 is the bloc's 2024 Network and Information Security Directive, which sets binding cybersecurity duties on critical-infrastructure operators and large firms. From this date, personal fines for management-body members apply at 100% of the statutory maximum in member states that have transposed the directive, with the earlier grace-period discount gone. The liability now reaches named directors, not their organisations alone.

The European Commission has referred member states still untransposed 19 months after the October 2024 deadline to the CJEU (Court of Justice of the European Union), the bloc's highest court 2. Those referrals are the enforcement follow-through to the maturity gaps ENISA, the EU cybersecurity agency, flagged when it placed water, rail and waste water in the cyber risk zone and benchmarked member-state readiness . The directors most exposed sit in exactly those laggard, lower-maturity sectors, where boards have had the least time to build the controls the directive now fines them personally for lacking.

Read alongside the UK bill reaching third reading a few sections up, the regulatory direction is the same on both sides of the Channel in a single fortnight: wider duties, sharper penalties, and personal accountability moving up the org chart. The divergence is on the ransomware-payment question, which NIS2 leaves to member states and Westminster has just parked.

Deep Analysis

In plain English

The European Union has a cybersecurity law called NIS2, which stands for the Network and Information Security Directive 2. It requires companies that provide important services, including energy, water, hospitals, and financial services, to meet mandatory cybersecurity standards and to report incidents to regulators quickly. Since 1 June 2026, NIS2 reached its full enforcement phase in the countries that have already built the law into their national systems. The key change from 1 June is that individual company directors can now be fined personally alongside their organisations when a serious cybersecurity failure occurs. At the same time, the European Commission has referred the EU member states that have still not written NIS2 into their national law to the EU's highest court, the Court of Justice of the European Union, which can order them to pay financial penalties until they comply. The EU agency for cybersecurity, ENISA, has specifically flagged water companies, railways, and waste water utilities as the sectors with the biggest gap between what the rules require and what they are actually doing.

Deep Analysis
Escalation

Enforcement risk escalating. The 1 June full personal-liability date removes the last formal grace period. CJEU referrals against non-transposing member states signal the Commission will pursue compliance aggressively. First enforcement decisions against individual directors are likely within 12 to 24 months in high-capacity member states.

What could happen next?
  • Consequence

    Individual directors at essential and important entities in transposed NIS2 member states now face personal fines at 100 per cent of the statutory maximum for serious cybersecurity failures, removing the discretionary reduction that applied during the grace period.

    Immediate · Assessed
  • Risk

    ENISA's NIS360 2026 identification of water, rail, and waste water as highest-risk sectors means the first personal-liability enforcement test cases are most likely to come from infrastructure operators with documented maturity gaps rather than from financial-sector incumbents.

    Medium term · Reported
  • Precedent

    The Commission's CJEU referrals for non-transposition, running in parallel with entity-level enforcement in transposed states, create a two-tier NIS2 enforcement environment that may generate competitive disadvantage for firms operating in non-transposing jurisdictions relative to transposed ones.

    Medium term · Reported
Sources:Bitdefender
Mentions:NIS2 →European Commission →CJEU →ENISA →NCSC →GDPR →Luxembourg →Brussels →Westminster →Germany →Network and Information Systems →Singapore →Ireland →France →NIS360 →European Union →
First Reported In

Update #7 · VPN zero-day, no-patch KEV, late Exchange

Bitdefender· 14 Jun 2026
Read original →
Causes and effects
Caused by
ENISA puts water and rail in risk zone
ENISA NIS360 2026's identification of water, rail and waste water as highest-risk sectors provides the enforcement basis underlying the Commission's referral of untransposed member states to the CJEU.
Occurred 28 May 2026
Read story →
ENISA scores NIS2 maturity with NCAF 2.0
ENISA NCAF 2.0's member-state NIS2 maturity benchmarking in April 2026 established the documented readiness gaps the Commission now pursues via CJEU referrals.
Occurred 22 Apr 2026
Read story →
This Event
NIS2 fines now reach directors personally
Cyber accountability now reaches named directors, not their organisations alone, and the enforcement teeth are out.
Different Perspectives
Group-IB
Group-IB
Group-IB, headquartered in Singapore, documented on 19 March that The Gentlemen began inside Qilin's own affiliate programme and split from it over a payment dispute. Its analysis makes this window's leak-site tally readable as a fracture inside one ransomware operation rather than the arrival of an unknown crew.
ENISA
ENISA
ENISA placed EU drinking water and wastewater in its cyber risk zone for the first time on 28 May, finding one in three water entities had never run a risk assessment. CISA's 30 July advisory to American operators reads as the operational sequel to a gap European regulators had already documented two months earlier.
House of Lords and NCSC
House of Lords and NCSC
The Cyber Security and Resilience Bill sits at House of Lords committee stage, its amendment paper running to 23 July. Separately, the NCSC guidance CISA cited when directing water operators to disconnect controllers is version 1.0 from March 2024, a two-year-old British document doing operational work in an American alert published last week.
heise online
heise online
heise online reported on 27 July that Russian state attackers, named as APT28, ran the hotel WiFi credential-harvesting campaign. Its attribution is firmer than ReliaQuest's own hedged low-to-medium confidence assessment of the same intrusion, a difference in national reporting posture rather than a settled dispute over who is responsible.
CISA and ReliaQuest
CISA and ReliaQuest
CISA compressed remediation deadlines under BOD 26-04 while, in the same window, telling water and wastewater operators to disconnect internet-exposed controllers rather than patch them. ReliaQuest, investigating the hotel WiFi campaign, held its assessment of the intrusion route at low-to-medium confidence and declined to name a state sponsor.
AIVD
AIVD
AIVD co-signed AA26-204A alongside CISA, the NSA and the FBI, adding its signature to the fifteen-agency coalition naming LAUNDRY BEAR. Dutch involvement continues a pattern of joint Five Eyes-adjacent advisories the agency has co-issued with CISA and NCSC through 2026.