EU regulatory register · NIS2
Article 36Penalties
CELEX 32022L2555 · Read on 2026-08-18 · Chapter VII
Short answer
Member States shall lay down rules on penalties applicable to infringements of national measures adopted pursuant to this Directive and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive.
Verbatim from the article. Source: NovaCopilot · https://legal.exploreworldai.com/eu/rattsakter/nis2-2022-2555/artikel-36 · Short answer as data · Official text
NIS2, cybersecurity in short
Essential and important entities must take security measures, report significant incidents within 24 hours, and management is personally accountable.
- Are we covered by NIS2?
- What is management's responsibility under NIS2?
- Does NIS2 or DORA apply to financial entities?
Source: NovaCopilot
Official text
Read from the EU Publications Office for this CELEX number. The wording stands as published; nothing here is rewritten or summarised.
Member States shall lay down rules on penalties applicable to infringements of national measures adopted pursuant to this Directive and shall take all measures necessary to ensure that they are implemented. The penalties provided for shall be effective, proportionate and dissuasive. Member States shall, by 17 January 2025, notify the Commission of those rules and of those measures and shall notify it, without delay of any subsequent amendment affecting them.
Follow-up questions
Other articles in this chapter
The text is quoted from the official source and is not legal advice. A national court reads the language version that binds in its jurisdiction.
Verifiable trust signals
- Source-linked answers and explicit evidence gaps
- Obligations, controls, risks and consequences
- Stable objects and verifiable checksums
- Rule-based objects, optional source-linked reasoning
- Model card, source status and audit