Who supervises NIS2 compliance, and what can the supervisor do?
The competent authority your national law designates, often the national cybersecurity agency or a sector regulator. Articles 32 and 33 give authorities supervisory and enforcement powers: on-site inspections and off-site supervision, regular, targeted and ad hoc audits, security scans, requests for information and for evidence of the measures, binding instructions and orders to remedy deficiencies, orders to inform customers about threats, and fines. Essential entities can be supervised proactively at any time, while important entities are usually supervised after the fact, when there are indications of non-compliance. In Germany, the BSI holds these powers under sections 61 and 62 of the BSIG, including ordering audits by independent bodies. Prepare by keeping your documentation current, so you can answer a request in days, not months.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.