NIS2 Cyber Insurance: What Your Policy Actually Covers (and the Fines It Can Never Pay)

Your organisation gets hit with a NIS2 fine. You call your cyber insurer expecting them to pay it. They won’t — and in almost every EU jurisdiction, they legally can’t. That single fact catches more compliance officers off guard than any other clause in a cyber policy, because everything else in the policy genuinely does respond to a NIS2 incident.

This article separates the two cleanly: what a cyber insurance policy can pay for after a NIS2-reportable incident, what it can never pay for, and where a documented insurance decision fits into your Article 21 risk-management programme without ever standing in for it.

No, Cyber Insurance Does Not Cover NIS2 Fines

Under Article 34 of the NIS2 Directive, essential entities face fines of EUR 10,000,000 or 2% of total worldwide annual turnover — whichever is higher. Important entities face EUR 7,000,000 or 1.4% — again, whichever is higher [4]. No cyber insurance policy sold in the EU is built to absorb that number, and the reason isn’t underwriting appetite. It’s public policy.

Entity type	Fine ceiling	Comparator
Essential entity	EUR 10,000,000	or 2% of global turnover, whichever is higher
Important entity	EUR 7,000,000	or 1.4% of global turnover, whichever is higher

Regulatory fines are treated as punitive, deterrent instruments, not compensable losses — letting a third party absorb the deterrent would defeat its purpose. According to ISMS.online’s analysis of the market, NIS2 fines are “almost universally uninsurable” across the EU, following the same public-policy pattern already established under GDPR [6]. Only Finland and Norway carve out a narrow exception, and only where the underlying conduct was unintentional and not grossly negligent — even then, a court can still override the insurer’s payment. The same analysis finds that France, Germany, Spain, and most other member states prohibit indemnification of administrative fines outright [6]. A separate review of EMEA cyber-fine insurability by international law firm AO Shearman reaches the same conclusion: coverage, where it exists at all, excludes deliberate or grossly negligent conduct [7].

Picture the sequence concretely: a ransomware incident becomes a reportable NIS2 event, the competent authority opens an investigation, and months later imposes a multi-million-euro fine under Article 34, having weighed Article 32(7) factors such as how long remediation took and whether the entity had prior violations [3][4]. By that point, the insurer will already have paid for the forensic team, the notification costs, and the legal fees from the investigation itself. The fine is the one cost nobody transfers.

There’s a structural reason this holds up so consistently, and it’s worth understanding rather than just accepting. Article 32(7) lists exactly what a competent authority must weigh before setting a fine: the seriousness and duration of the infringement, any prior violations, the damage caused, whether the conduct was intentional or negligent, and what the entity actually did to remediate [3]. That calculation is the fine. If an insurer could simply pay it on the entity’s behalf, the number produced by that calculation would stop meaning anything — the entity’s behaviour and the consequence it faces would be disconnected. That’s precisely the outcome public-policy insurability doctrine exists to block.

What a NIS2-Ready Cyber Insurance Policy Actually Pays For

Strip the fine out of the conversation and the picture changes. A well-structured cyber policy responds to almost every cost a NIS2 incident actually generates — and each coverable category maps onto a specific obligation your compliance programme already has to satisfy.

Cost category	What it typically pays for	Complements
Incident response & forensics	Forensic investigators, containment and eradication specialists, remediation support	Article 21(2)(b) — incident handling
Notification & crisis communication	Drafting and filing the required reports, breach-attorney time, customer and press notification, surge call-centre capacity	Article 23 — 24h early warning, 72h notification, 1-month final report
Legal defense & regulatory response	Lawyer and consultant fees for the investigation itself, liaison with the competent authority — never the fine	Article 32(7)(h) — cooperation with authorities
Business interruption	Lost income and extra expense while systems are down — usually only once a direct, quantifiable financial loss is proven	Article 21(2)(c) — business continuity and crisis management
Third-party liability	Claims and settlements from customers, partners, or supply-chain counterparties harmed by the incident	Article 21(2)(d) — supply chain security

Article 23 sets the reporting clock that makes notification coverage matter in practice: an early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours, and a final report no later than one month after that [2]. Each deadline generates real cost — legal review, translation for multi-jurisdiction CSIRTs, drafting under time pressure — and that’s exactly the expense category notification coverage is built to absorb. Business interruption is the one line item worth double-checking before you assume it’s included: not every cyber policy bundles it by default, and where it does exist, insurers commonly require you to demonstrate a measurable revenue loss rather than simply asserting downtime occurred.

Insurance Isn’t a Compliance Substitute — But It Can Be Documented Evidence of Risk Management

Here’s where most guidance on this topic gets vague, and where the actual regulatory text is more precise than the marketing copy around it. ENISA’s own technical implementation guidance on Article 21(2)(a) risk-analysis policies lists three risk-treatment options an entity can choose between: avoidance, mitigation, and “risk transfer or sharing — shifting risk impact, e.g. via insurance or outsourcing, while retaining overall accountability” [9]. Insurance is a named, legitimate treatment option inside the formal risk process NIS2 already requires you to run. It is not, on its own, one of the ten measures in Article 21(2) — it’s a decision you document once you’ve already worked through them.

Germany’s BSI makes the boundary explicit by omission: its official guidance on the ten §30 BSIG risk-management measures — the direct national implementation of Article 21(2) — never mentions insurance once. Every measure is framed as something the entity itself must implement, suitable, effective, and proportionate to its own risk exposure [5]. Buying a policy doesn’t tick off incident handling, business continuity, or any other Article 21(2) item. It sits alongside them, not in place of any of them.

Where insurance can genuinely help is narrower and more specific than “reduces your risk of a fine.” Article 32(7)(f) instructs authorities to weigh “any measures taken by the entity to prevent or mitigate the material or non-material damage” [3] when deciding on enforcement action. A risk-transfer decision that’s documented as part of a formal, board-approved risk process — not bought reflexively after an incident — is the kind of remedial evidence that factor is asking for. It won’t move the fine calculation on its own, and no source claims it does. But paired with the Article 21(2) controls insurers already verify at underwriting, it can serve as evidence that your organisation runs the kind of ongoing risk-management process the Directive is actually trying to produce.

That distinction matters practically, too: an insurer’s underwriting review and a competent authority’s audit ask overlapping but not identical questions. An underwriter wants evidence the controls exist and were tested recently, because that predicts claim likelihood. An auditor wants evidence the entity runs the full Article 21(2) programme, of which a risk-transfer decision is one line among ten measures — not a keystone that anchors the rest.

Why NIS2 Compliance Is Reshaping What Insurers Will Even Quote

For CISOs and IT security managers, the practical overlap between NIS2 compliance and cyber insurance underwriting is now closer than either framework was designed around. On 2026 proposal forms, insurers treat multi-factor authentication, endpoint detection and response with continuous monitoring, and tested, immutable backups as hard eligibility gates — without them, a submission is declined outright or priced at a steep premium [10]. Those three controls map directly onto Article 21(2)(j), the incident-handling half of (b), and the backup-management element of (c). Visible gaps in any of them, or a prior claim, typically add 20-40% to the premium [10]. The mechanism behind that swing is straightforward: EDR and tested backups are the two controls that most directly cut ransomware recovery cost and downtime, which are the two loss categories that drive insurer payouts. An organisation that can produce a dated, successful restore test from the last 90 days is showing the underwriter the same evidence a NIS2 auditor would want for Article 21(2)(c) business continuity — one document, two audiences.

Insurers themselves aren’t regulated by NIS2 — they fall under DORA instead, according to international law firm DLA Piper’s analysis — but NIS2 compliance still reshapes the market indirectly: entities running the mandated controls present a lower claim-frequency risk profile, which is exactly what improves insurability and pricing over time [8]. One Central European compliance vendor goes further, observing in its own market that the evidence a NIS2 audit asks for and the evidence a cyber-insurance proposal form asks for now request substantially the same documentation — formal risk analysis, tested business-continuity plans, supply-chain risk records [11]. That’s a practitioner observation from one market rather than an EU-wide finding, but it points at a real trend: the two questionnaires are converging.

The failure mode CISOs should actually worry about isn’t missing coverage — it’s misrepresentation. The leading trigger for claim denial industry-wide is a gap between what was attested on the proposal form and what’s actually deployed [10]. If your Article 21(2) documentation is current and your underwriting attestation matches it, that gap closes on its own.

What This Means for the Board

For the board, cyber insurance and NIS2 compliance sit on different lines of the same budget conversation, and conflating them is the most common board-level mistake in this area. Compliance spend — implementing and evidencing the Article 21(2) controls — reduces the probability and severity of an incident. Insurance spend transfers the residual financial impact of the incidents that still get through. Presenting insurance premiums as an alternative to compliance investment, rather than a complement to it, creates exactly the gap a regulator will notice: a well-insured but under-controlled organisation is not a well-managed one under Article 21.

The more precise board-level question isn’t “are we insured?” but “does our documented risk-transfer decision sit inside a risk process a competent authority would recognise as active?” That’s the Article 32(7)(f) remedial-action factor in practice [3], and it’s a governance artefact, not a policy limit. Boards should expect the insurance decision minuted alongside the risk register it responds to — not procured as a standalone line item by whoever handles renewals fastest. Personal liability under NIS2 is a related but separate question from the organisation’s cyber cover; see management-body responsibilities under NIS2 for what management bodies are individually on the hook for.

Policy-Wording Checklist Before You Renew

For compliance officers and legal teams reviewing a renewal, the fine-uninsurability point matters less than getting the surrounding wording right. As a general starting point, verify each of the following before signing:

• Fines exclusion, scoped correctly. The policy should exclude fines and penalties that are uninsurable at law — but confirm that exclusion doesn’t also swallow your defense-cost coverage for the underlying investigation.
• Negligence vs. wilful-misconduct carve-outs. Given how heavily Article 32(7)(e) weighs intent and negligence in the fine itself [3], make sure your policy’s own negligence definitions are clear enough that a coverage dispute doesn’t turn into a second investigation.
• Notification sub-limits. If you operate across multiple member states, you may be notifying more than one CSIRT under Article 23 timelines simultaneously [2] — check whether notification-cost coverage has a per-incident or per-jurisdiction cap.
• Business interruption trigger. Confirm whether it’s tied to proven direct financial loss or a broader material-interruption test, and note the waiting period before it activates.
• Third-party liability scope. Confirm claims arising from a supply-chain-origin failure — an Article 21(2)(d) exposure — are explicitly in scope, not just claims from your direct customers.
• Attestation accuracy. Cross-check what was attested on the proposal form against your current control state before renewal, not after a claim.

NIS2 Cyber Insurance: Common Questions

Does buying cyber insurance reduce our Article 21 obligations?

No. Insurance is one of three risk-treatment options ENISA lists under Article 21(2)(a) [9], but it doesn’t satisfy any of the other nine measures. You still need to implement the full Article 21(2) control set regardless of what your policy covers.

Can a director’s D&O policy cover their personal NIS2 liability?

It depends on the specific policy and jurisdiction, and it’s a separate question from cyber insurance entirely — confirm your D&O wording with a broker or counsel rather than assuming coverage.

Does having cyber insurance improve our outcome in an audit?

Not directly, and no source claims it does. What can matter is a documented risk-transfer decision made as part of a formal process — that’s the kind of remedial evidence Article 32(7)(f) asks authorities to weigh [3], not a discount mechanism.

Does third-party liability cover an incident caused by one of our suppliers?

Only if the policy wording extends that far — check explicitly, since standard third-party liability language sometimes covers claims from your customers but not claims arising from a supplier’s own failure feeding into your incident.

This article provides general information only and does not constitute legal or regulatory advice. Requirements may vary by jurisdiction and organisation type. Consult a qualified legal professional or compliance specialist for advice specific to your situation.

Sources

• NIS2 Directive, Article 21 — Cybersecurity risk-management measures (nis-2-directive.com)
• NIS2 Directive, Article 23 — Reporting obligations (nis-2-directive.com)
• NIS2 Directive, Article 32 — Supervisory measures for essential entities (nis-2-directive.com)
• NIS2 Directive, Article 34 — Administrative fines (nis-2-directive.com)
• BSI — NIS-2 Risikomanagementmaßnahmen (German national competent authority)
• ISMS.online — Can Insurance Cover NIS 2 Fines or Are They Uninsurable?
• AO Shearman — Insurability of Cyber Fines
• "The NIS2 Directive: Will It Affect Insurance Companies?" — DLA Piper (dlapiper.com)
• ComplianceHub.Wiki — ENISA Technical Implementation Guidance Summary
• Underdefense — Cyber Insurance Readiness Checklist
• nFlo — KSC/NIS2 and Cyber Insurance