The amount of the penalty depends on the sector and the severity of the infringement, and can be up to 10 million Euros or 2% of the global annual turnover. This is another reason not to take the NIS2 directive lightly.