How Much Does NIS2 Compliance Cost

NIS2 compliance cost has no official price tag, and any article that hands you a single number is guessing. The only member state to publish a detailed euro estimate is Germany, whose government costed its implementation law at around €70,000 one-off per company and a broadly similar amount, roughly €73,000 to €77,000, per company per year. The European Commission never published a per-company euro figure. Its impact assessment behind the directive estimated that newly-covered companies would raise ICT security spending by up to 22% in the first years, and around 12% for those already inside the old NIS regime.

What moves you within that spread is mostly your starting point. A company with a mature ISO 27001 information security management system already covers much of what NIS2 asks, so its added cost is a fraction of a company starting cold. Size, sector and the member state you fall under do the rest.

Two things get wrongly folded into that number. NIS2 sets no compliance fee at directive level, so most of these euros are the cost of building and running security measures, not a charge anyone invoices you. The exception is a handful of member states, Hungary among them, that levy their own supervisory fees on top, which is exactly the kind of national variance this article is about.

Who Needs To Be NIS2 Compliant

NIS2 applies to medium and large organisations across 18 sectors, which broadly means 50 or more employees, or more than €10 million in both turnover and balance sheet. National laws word the threshold differently, and Germany uses an either/or test, so the precise cut-off depends on your member state. Micro and small companies are generally exempt.

Scope comes before cost, because none of the figures above apply until you are inside it, and plenty of companies guess wrong in both directions. The 18 sectors sit across two annexes. Annex I holds 11 high-criticality sectors whose larger players are classified as essential entities. Annex II holds seven more, whose companies, and medium-sized firms from Annex I, are important entities under Article 3. That split sets your reporting duties and your maximum fine.

Some entities fall in regardless of size, including DNS service providers, top-level domain registries, trust service providers, providers of public electronic communications, and the sole provider of an essential service in a member state. Public administration is in scope too, and central government bodies are covered whatever their headcount. Financial firms are a special case, because DORA is the sector-specific law that governs their ICT risk-management and incident reporting, so a bank reads its obligations mainly through DORA rather than NIS2. If you are unsure which side of the line you sit on, our NIS2 Applicability Checker walks the Article 2 tests, and the split between the two entity types is set out in our guide to essential versus important entities.

Being out of scope is not always the end of it. Article 21(d) requires in-scope entities to manage supply-chain risk, so their obligations travel down the chain as contract clauses. A small supplier with no direct NIS2 duty can inherit security requirements from a covered customer, which is the most common way the cost reaches a company that assumed it was exempt.

The population keeps growing. The Commission’s 2020 impact assessment estimated around 110,000 entities across the EU, up from roughly 15,000 operators under the old NIS Directive. A later Commission re-estimate put the figure at least 160,000 as of November 2025.

What NIS2 Compliance Costs, From Around €70,000 One-Off Upwards

The only official euro estimates come from national implementation laws, and Germany’s is the most detailed. It puts the one-off cost at around €70,000 per company and the recurring annual cost at roughly €73,000 to €77,000, so the yearly bill runs at least as high as the initial one. The EU-wide figure was never a euro amount, only a 12% to 22% rise in ICT security spending. There is no single price because the directive does not set one.

The honest way to read the cost is to keep four categories apart and not blend them. The official EU estimate is a set of percentages. The Commission’s impact assessment put the rise at up to 22% of current ICT security spending for newly-covered companies, around 12% for those already under the old NIS Directive, and roughly 15% recurring for medium enterprises. The one euro figure it attached was the payoff, an estimated €11.3 billion reduction in the cost of cyber incidents over ten years.

The national estimates are where real euro amounts appear. Germany’s implementation law, the NIS2UmsuCG, took effect on 6 December 2025 covering around 29,500 companies, and the government draft costed the economy-wide burden at roughly €2.1 to €2.2 billion one-off and €2.2 to €2.3 billion a year. Divide either by the number of firms and you land near €70,000 to €77,000 per company, which is why the annual figure deserves as much attention as the one-off. A per-entity breakdown by the consultancy ORBIT, worked out from the draft’s own assumptions, puts a typical important entity around €86,900 and an essential one around €209,000, though ORBIT itself warns those numbers are probably unrealistic in places and should be read as a starting point rather than a quote.

Reported spending is a third category and should not be read as an isolated NIS2 bill. ENISA’s 2025 NIS Investments report, covering 1,080 organisations, found information security holding at about 9% of IT budgets, with 70% of organisations naming regulatory compliance as their main investment driver. The more useful signal is where that money now goes. With 76% of organisations struggling to recruit qualified staff, spending is shifting from hiring toward tools and outsourcing. That does not make the bill smaller, it moves it from payroll to suppliers.

The fourth category is consultancy models, the source of the most-quoted numbers. Frontier Economics projected the total cost of NIS2 across EU business at €31.2 billion a year, or 0.31% of affected sectors’ turnover. That is a forecast from an economic model, not an official assessment, and it should be labelled as such rather than repeated as fact.

Strip the article numbers away and the ten measures in Article 21 put cost in three places. People take the largest share, from training the whole workforce in basic cyber hygiene, to the staff time behind incident handling and continuity, to the board hours Article 20 demands, since management must approve and oversee the measures and can be held personally liable. Tools come next, covering detection and logging, encryption, multi-factor authentication, and backup and recovery. Then comes the proof, the documented risk policies, supply-chain reviews and evidence that the measures work. Digital infrastructure providers pay more on the tooling line, because Commission Implementing Regulation (EU) 2024/2690 sets detailed technical requirements for DNS, cloud, data centre, CDN and managed service providers. If you want your own figure rather than these anchors, our Compliance Cost Estimator returns a range and your penalty exposure in under two minutes.

Why The Same Directive Costs Different Amounts By Country

Because NIS2 is a directive, each member state writes its own transposing law, and some add costs the directive never required. Belgium lets essential entities prove compliance three ways, through CyberFundamentals verification, ISO 27001 certification, or a CCB inspection, with evidence due by 18 April 2026 and the cost borne by the entity. Hungary goes further and charges an annual supervisory fee based on prior-year turnover, plus a mandatory external audit whose base fee is around 1.75 million forint and which can reach 140 million for the largest entities. Neither charge exists in the German or Slovenian regimes.

That variance is why a single number misleads. Slovenia’s ZInfV-1 took effect on 19 June 2025 with the same 50-employee and €10 million threshold, but no per-entity euro estimate has been published there, and the German range only transfers as a rough proxy once you discount for lower Slovenian labour costs, since the German figure is largely staff time priced at German rates. As of July 2026, 23 of the 27 member states had notified transposition. The four that had not, Ireland, Spain, France and the Netherlands, were referred to the Court of Justice on 8 July 2026, with the Commission asking for a lump sum and daily penalties until they comply. The Dutch law passed the day before that referral and enters force on 15 August 2026. A separate Commission proposal from 20 January 2026 would amend NIS2 to simplify some requirements, but it is a proposal, not law, so nothing in the reporting or registration regime has yet been lightened.

The directive lists ten security measures, names not one euro of budget, and leaves 27 member states to price the same obligations differently, some with state fees on top. That is why how much NIS2 costs has no EU-wide answer, only national ones, and the number of national answers is still climbing.

What NIS2 Compliance Software Costs

Governance, risk and compliance platforms such as Vanta, Drata and OneTrust run from roughly €7,000 to €10,000 a year at entry level to €30,000 to €50,000 or more for a mid-sized deployment, and audit fees sit on top of that. Cheaper regional tools exist below that band, but the named platforms are not €3,000-a-year products, whatever a budget template might suggest.

Software is optional, and this is the part vendors are least keen to say plainly. NIS2 mandates no product and names no vendor. A platform can cut the documentation and evidence work, but it does not make you compliant on its own, and buying one before you have mapped your scope and gaps spends money in the wrong order. If you want to compare implementation and advisory partners rather than software, our Compliance Provider Directory lists vetted NIS2 and DORA providers by country and service.

What NIS2 Never Tells You To Spend

NIS2 sets no mandatory budget, prescribes no specific technology or vendor, and, at directive level, imposes no fee. Article 21(1) asks only that measures be proportionate to your risk, size and exposure.

This is the detail that reframes the whole cost question. Because the directive fixes an outcome rather than a spend, the honest answer is always a range tied to how much security you already run. Compliance vendors estimate that a certified ISO 27001 information security management system covers 70% to 80% of the Article 21 measures, and Belgium’s decision to accept ISO 27001 as a full compliance route supports the direction of that claim. In our assessment the percentage still oversells the saving, because coverage counted by controls is not coverage counted by cost. The uncovered part is the reporting timelines, the management-liability and governance duties, and the depth of supply-chain assurance, which are recurring and staff-heavy rather than one-off. An existing ISMS lowers the bill, but by less than the headline percentage implies.

NIS2 Fines Reach €10 Million Or 2% Of Global Turnover

Non-compliance is a separate cost from compliance, and a larger one at the top end. Under Article 34 of Directive (EU) 2022/2555, essential entities face administrative fines of at least €10 million or 2% of total worldwide annual turnover, whichever is higher, and important entities at least €7 million or 1.4%.

Read the wording carefully, because the directive sets floors rather than a single figure. The phrase throughout Article 34 is a maximum of at least, which means member states must allow at least these ceilings and may set them higher. Your real exposure is written by your national regulator, not by Brussels, so any article quoting one EU-wide fine number is misreading the text. Beyond the money, Article 20 makes management personally liable, and Article 32(5) lets regulators temporarily bar individuals from management roles at essential entities.

Whether large fines are actually being issued is still unsettled. Some enforcement trackers list early administrative fines in a handful of member states, but they flag their own figures as directional estimates, and some public trackers contain demonstrable errors, such as fines attributed to countries that had not yet transposed the directive. As of mid-2026 no competent authority had publicly confirmed a final NIS2 fine against a named entity, so treat any specific early-fine figure as unverified.

The Cheapest Line Item Is Knowing What You Already Have

The most cost-effective work does not depend on a single budget decision, and you can finish it before any standard or national deadline forces your hand. It starts with confirming scope against Annex I and II and the size threshold, because everything downstream is wasted effort if you turn out to be exempt, or a nasty surprise if a covered customer pushes requirements down the supply chain. Mapping your existing controls against the ten measures in Article 21 then shows how much of NIS2 you already meet, and an existing ISO 27001 ISMS covers a large part of it, though less of the cost than the control count suggests.

Costing the gap makes sense split by where the money lands, which is people, tools and the documentation that proves the measures work, with the German range of roughly €70,000 one-off and €73,000 to €77,000 a year as a rough anchor to adjust for your maturity and your member state. Set that against your Article 34 penalty exposure, and check your own transposing law for the extras the directive does not mandate, from Belgium’s conformity assessment to Hungary’s supervisory fee. That sequence turns a frightening single number into a defensible range, and our Compliance Cost Estimator will produce that range and your Article 34 exposure in under two minutes.