NRC Enforcement: Violations & Civil Penalties

When the NRC identifies a violation, what happens next is not arbitrary — it follows a defined enforcement process that classifies the violation by significance and then dispositions it as a minor violation, a non-cited violation, a cited Notice of Violation, a civil penalty, or an order. Understanding that escalation ladder is what lets a radiation safety officer respond proportionately: correcting quietly what should be corrected quietly, and mounting a serious corrective-action response when the significance demands it.¹²

Most radiation safety programs will, at some point, have a finding written up during an inspection. The difference between a program that handles it well and one that compounds the problem usually comes down to understanding how the NRC decides what a finding is worth and what it expects in return.¹ This guide walks through the current NRC enforcement framework — severity levels, the sanction types, the civil penalty assessment, and the licensee's obligations — and how it maps onto medical and materials licensees. DRPS supports this work through its radiation safety officer consulting and radioactive material license support services across Florida, Maryland, Virginia, Washington DC, California, and Nevada.

Introduction

NRC enforcement exists to obtain compliance with regulatory requirements and to deter future violations, using a graded set of sanctions matched to the safety or regulatory significance of the violation. The governing document is the NRC Enforcement Policy, most recently revised effective August 23, 2024, supported by the NRC Enforcement Manual and implemented through the procedures in 10 CFR Part 2, Subpart B.¹² For materials licensees — which includes medical-use licensees under 10 CFR Part 35 — enforcement is handled through what the NRC calls "traditional enforcement," in which each violation is assigned a severity level according to its significance.¹

The framework is deliberately graded. A paperwork lapse of trivial safety consequence is not treated like an unmonitored overexposure, and the enforcement process is built so that the response scales with the significance. The three primary sanctions the NRC can impose are the Notice of Violation, the civil penalty, and the order.¹ Everything else — minor violations, non-cited violations, escalation, mitigation, and enforcement discretion — is the machinery that decides which sanction, if any, applies. This article makes that machinery legible so that an RSO can read an inspection outcome correctly and respond in a way that strengthens, rather than undermines, the program.

Topic Explanation

The disposition ladder

Every violation the NRC identifies is placed somewhere on a ladder of increasing formality, from a minor violation requiring no enforcement action up to an order that can suspend or revoke a license. The rungs are:¹²

Minor violation — below regulatory concern. It is not subject to enforcement action and is not normally described in inspection reports, but like all violations it must still be corrected.¹
Non-cited violation (NCV) — typically a Severity Level IV violation. For materials licensees, it is documented in the inspection report or record to create a public record but is not formally cited and normally does not require a written response.¹
Notice of Violation (NOV) — a cited violation that identifies the requirement and how it was violated, formalized under 10 CFR 2.201, and normally requiring a written response.¹³
Civil penalty — a monetary sanction, normally reserved for the most significant violations, proposed under 10 CFR 2.205.¹⁵
Order — a legally binding directive under 10 CFR 2.202 that can modify, suspend, or revoke a license or impose specific requirements.¹⁴

Where a violation lands depends first on its severity level and then on the civil penalty assessment. For the flip side of this process — the findings that most often trigger it — see common radiation safety violations and how to avoid them.

Severity levels

The NRC characterizes the significance of a violation by assigning a severity level:¹

Severity Level I — the most significant, reflecting the most serious safety or regulatory concern.
Severity Level II — very significant.
Severity Level III — significant enough to warrant consideration of a civil penalty, though less serious than Levels I and II.
Severity Level IV — more than minor concern, the least severe cited category, normally dispositioned as a non-cited violation for materials licensees.

The severity level is the pivot of the whole process: it determines whether a civil penalty is normally assessed, considered, or not applied, and it signals how much regulatory attention the finding will draw.

Key Technical Principles

The civil penalty assessment

Whether a violation actually results in a civil penalty — and how large — is decided through a structured assessment, not a fixed price list. Civil penalties are normally assessed for Severity Level I and II violations and for knowing and conscious violations of certain reporting requirements; for Severity Level III violations, a civil penalty is considered.¹ The assessment moves through a set of decision points that weigh factors such as whether the NRC or the licensee identified the problem, and the timeliness and comprehensiveness of corrective action. Absent the exercise of enforcement discretion, the outcome of the assessment for a given violation resolves to one of three results:¹

Civil Penalty \in {0, B, 2 B}

where $B$ is the base civil penalty. In words: no civil penalty, a base civil penalty, or a base civil penalty escalated by 100 percent. The base amount $B$ itself depends on the severity level and on the type and size of the licensee, so a small medical practice and a large fuel-cycle facility do not face the same base figure for a comparable severity level.¹

The statutory ceiling

The base and escalated amounts sit beneath a statutory maximum set by the Atomic Energy Act and adjusted annually for inflation. For fiscal year 2024, the maximum civil monetary penalty was set at $362,814 per violation, per day.⁶ Because a continuing violation accrues per day, the theoretical exposure for a prolonged violation is:

CP_{m a x} = N_{days} \times 362, 814 USD

In practice, materials-licensee civil penalties are far below this ceiling because the base civil penalty for a medical or small-materials licensee is a fraction of the statutory maximum, and because identification and corrective-action factors frequently reduce the proposed amount.¹ The ceiling matters mainly as a reminder that the exposure scales with how long a significant violation is allowed to persist — which is one more reason prompt correction is central to the process.

Severity level, disposition, and civil penalty at a glance

Severity level	Significance	Typical disposition	Civil penalty treatment
Severity Level I	Most significant	Cited NOV; likely order in serious cases	Normally assessed ¹
Severity Level II	Very significant	Cited NOV	Normally assessed ¹
Severity Level III	Significant	Cited NOV	Considered ¹
Severity Level IV	More than minor	Non-cited violation (materials)	Not normally assessed ¹
Minor violation	Below regulatory concern	Not documented; must still be corrected	None ¹

The table is the practical heart of the framework: read the severity level, and you can predict the likely disposition and whether money is on the table.

Escalation, mitigation, and discretion

The base civil penalty is not the end of the analysis. It can be escalated — for example, for willfulness or for a licensee who should have identified the problem sooner — or mitigated for prompt, comprehensive corrective action and licensee identification of the issue.¹ The NRC also reserves enforcement discretion, which can increase a sanction in aggravated cases or decrease or forgo one where the normal outcome would not serve the enforcement objectives — for instance, discretion has historically been applied to encourage prompt self-identification and correction.¹ This is why two violations at the same severity level can end very differently: the corrective-action story, not just the initial finding, drives the outcome.

Clinical Impact

For a medical or materials licensee, the enforcement process shapes not only the immediate financial and administrative consequences of a finding but the program's long-term regulatory standing. A well-handled Severity Level IV non-cited violation is a routine event; a mishandled Severity Level III violation — one with a weak or late corrective-action response — can escalate regulatory attention, invite a civil penalty, and color the next inspection.¹²

The operational lesson is that the severity level is only half the story; the licensee's response is the other half. Because the civil penalty assessment explicitly credits self-identification and prompt corrective action, a program that finds and fixes its own problems — through internal audits, a functioning radiation safety committee, and a culture that surfaces issues — is materially better positioned when the NRC arrives.¹ The same logic connects enforcement to the rest of the safety program: strong occupational-dose controls, accurate records, and timely reporting reduce both the frequency and the severity of findings. For how these obligations tie together, see our guides to occupational dose limits under Part 20 and medical event reporting under 10 CFR 35.3045.

Practical Optimization Tips

Respond to a Notice of Violation correctly

A cited NOV under 10 CFR 2.201 normally requires a written response within 30 days that addresses, for each violation:³

the reason for the violation, or a statement contesting it;
the corrective steps that have been taken and the results achieved;
the corrective steps that will be taken to avoid further violations; and
the date when full compliance was or will be achieved.

Treat this response as a substantive corrective-action document, not a formality — it is a public record and a primary input to how the NRC judges the program.

Read the severity level before reacting

Match the response to the significance. A non-cited Severity Level IV finding calls for correction and documentation, not a crisis footing; a Severity Level III finding calls for a rigorous root-cause analysis and a corrective-action plan robust enough to influence the civil penalty assessment.¹

Build self-identification into the program

Because identification and corrective action drive escalation and mitigation, invest in the internal machinery that finds problems first: periodic program audits, a working radiation safety committee, and honest incident reporting. For how these are structured, see preparing for an NRC inspection and the radiation safety officer role.

Document corrective action to a durable standard

Corrective actions should be specific, dated, verifiable, and aimed at recurrence prevention, not just the immediate fix. "Retrained staff" is weaker than a documented procedure change, a competency check, and a scheduled effectiveness review.

Know the difference between a Notice of Violation and an order

An NOV cites past noncompliance and asks for correction; an order under 10 CFR 2.202 compels or prohibits future conduct and can be immediately effective when public health and safety require it.¹⁴ The two demand different responses, and confusing them wastes time in exactly the situations where time matters most.

Regulatory Considerations

The NRC enforcement process applies directly to NRC-regulated licensees, while Agreement States run parallel, compatible programs of their own. The core authorities are the NRC Enforcement Policy, the NRC Enforcement Manual, and 10 CFR Part 2, Subpart B, which contains the procedural rules for notices of violation (2.201), orders (2.202), and civil penalties (2.205); the underlying penalty authority comes from Section 234 of the Atomic Energy Act.¹²³⁴⁵

Key frameworks to reference:

NRC Enforcement Policy (effective August 23, 2024) — the current policy establishing severity levels, the civil penalty assessment, and enforcement discretion.¹
NRC Enforcement Manual — the staff implementation guidance for dispositioning violations, including documentation of minor violations and NCVs in materials inspection reports.²
10 CFR 2.201, 2.202, and 2.205 — the procedural basis for the NOV, orders, and civil penalties, respectively.³⁴⁵
The requirement being enforced — most medical-licensee findings arise from 10 CFR Part 20 (protection standards) and 10 CFR Part 35 (medical use), so the enforcement process is only as relevant as a program's grasp of those underlying rules.

Jurisdiction determines whose process applies. Of the states DRPS serves, Florida, Maryland, Virginia, California, Nevada, Pennsylvania, New York, and New Jersey are NRC Agreement States that license and inspect medical use under their own radiation-control rules and their own compatible enforcement programs, while Washington, DC and Delaware are regulated directly by the NRC and follow the federal enforcement process described here. X-ray-producing machines are regulated separately under state programs (for example, Florida's Chapter 64E-5), not under this NRC materials-enforcement framework. Always confirm which authority regulates a given activity before assuming which enforcement process applies. For the licensing backdrop, see our NRC medical-use license guide.

Frequently Asked Questions (FAQs)

What are the NRC's severity levels?

The NRC classifies violations by significance into four severity levels, from Severity Level IV for violations of more than minor concern up to Severity Level I for the most significant. Severity Levels I and II are the most serious and normally warrant a civil penalty; Severity Level III is significant enough that a civil penalty is considered; Severity Level IV is the least severe cited category. Violations below more-than-minor concern are treated as minor violations and are not subject to formal enforcement action.

What is the difference between a minor violation, a non-cited violation, and a Notice of Violation?

A minor violation is below regulatory concern, is not normally documented, and is not subject to enforcement action, though it still must be corrected. A non-cited violation (NCV) is typically a Severity Level IV violation documented in the inspection record to establish a public record but not formally cited, so it usually does not require a written response. A Notice of Violation (NOV) formally cites the violation under 10 CFR 2.201 and normally requires a written response describing corrective action.

When does the NRC issue a civil penalty?

Civil penalties are normally assessed for Severity Level I and II violations and for knowing and conscious violations of certain reporting requirements. For Severity Level III violations a civil penalty is considered but not automatic. The civil penalty assessment weighs factors such as who identified the problem and the timeliness and adequacy of corrective action, and the result is generally no penalty, a base penalty, or a base penalty escalated by 100 percent.

How large can an NRC civil penalty be?

The statutory maximum is adjusted annually for inflation. For fiscal year 2024 it was set at $362,814 per violation per day. The base civil penalty actually proposed depends on the severity level and the type and size of the licensee, and it can be escalated or mitigated based on identification and corrective action, so most materials-licensee penalties are far below the statutory ceiling.

What must a licensee do after receiving a Notice of Violation?

A cited NOV under 10 CFR 2.201 normally requires a written response, generally within 30 days, that states the reason for the violation (or a contest of it), the corrective steps taken and the results achieved, the steps that will be taken to prevent recurrence, and the date when full compliance was or will be achieved. The response is a public document and is central to how the NRC judges the licensee's corrective-action program.

What is an NRC order and how is it different from a Notice of Violation?

An order, issued under 10 CFR 2.202, is a legally binding directive that can modify, suspend, or revoke a license or impose specific requirements — for example, to remove an individual from licensed activities. Unlike a Notice of Violation, which cites past noncompliance and asks for corrective action, an order compels or prohibits future conduct and can be made immediately effective when public health and safety require it.

Do Agreement States use the same enforcement process?

Agreement States administer their own radiation-control programs that must be compatible with the NRC's, so the structure — severity classification, notices of violation, civil penalties, and orders — is generally parallel, but the specific procedures, penalty amounts, and forms are set by state rule. NRC-regulated licensees in non-Agreement jurisdictions follow the federal process directly.

Key Takeaways

Enforcement is graded. Violations are classified by significance into severity levels I–IV, and the response scales with the classification.¹
Most findings are not penalties. Minor violations require correction only; Severity Level IV violations are typically non-cited; civil penalties are reserved mainly for Severity Levels I and II.¹
The NOV requires a real response. A cited violation under 10 CFR 2.201 normally demands a written corrective-action response, and that response is a public record.³
Civil penalties follow a structured assessment. The outcome is generally no penalty, a base penalty, or a base penalty escalated by 100 percent, beneath a statutory ceiling of $362,814 per violation per day for FY2024.¹⁶
Your corrective-action story matters. Self-identification and prompt, comprehensive correction can mitigate a penalty; willfulness and delay can escalate it.¹
Orders are different from NOVs. An order under 10 CFR 2.202 compels or prohibits future conduct and can be immediately effective.⁴
Jurisdiction decides the process. Agreement States run parallel programs; direct-NRC licensees follow the federal process.¹

Conclusion

The NRC enforcement process is not a black box. It is a graded, published framework that classifies each violation by significance and then matches it to a proportionate response — from a minor violation that only needs correcting, through non-cited violations and cited Notices of Violation, to civil penalties and orders for the most serious cases.¹² The severity level tells a licensee how much attention a finding will draw; the civil penalty assessment tells them whether money is at stake; and the corrective-action response determines, more than anything else, how the episode ends.

For a radiation safety officer, fluency in this process is a core competency. It converts an inspection finding from a source of anxiety into a defined problem with a defined response, and it turns the program's own habits of self-identification and prompt correction into concrete regulatory advantage. A program that understands the enforcement ladder — and builds toward the low rungs of it by design — is a program that stays there.

How DRPS Can Help

Diagnostic Radiation Physics Services helps medical and materials licensees strengthen the parts of a radiation safety program that keep findings low on the enforcement ladder: program audits, corrective-action planning, Notice-of-Violation response support, and RSO mentoring. This work is delivered through our radiation safety officer consulting, radioactive material license support, and radiation safety training services by board-certified professionals.

DRPS supports facilities across our service locations, including Florida, Maryland, Virginia, Washington DC, California, Nevada, New York, Pennsylvania, New Jersey, and Delaware.

The best enforcement outcome is the one you never have to manage — earned by a program that finds and fixes its own problems before an inspector does.

Related Resources

References

U.S. Nuclear Regulatory Commission. NRC Enforcement Policy. Effective August 23, 2024. nrc.gov
U.S. Nuclear Regulatory Commission. NRC Enforcement Manual. nrc.gov
U.S. Nuclear Regulatory Commission. 10 CFR 2.201: Notice of violation. ecfr.gov
U.S. Nuclear Regulatory Commission. 10 CFR 2.202: Orders. ecfr.gov
U.S. Nuclear Regulatory Commission. 10 CFR 2.205: Civil penalties. ecfr.gov
U.S. Nuclear Regulatory Commission. Adjustment of Civil Penalties for Inflation for Fiscal Year 2024. 89 Fed. Reg. (Jan. 12, 2024); maximum civil penalty $362,814 per violation per day. federalregister.gov
U.S. Nuclear Regulatory Commission. Enforcement Program Overview. nrc.gov
U.S. Nuclear Regulatory Commission. 10 CFR Part 2, Subpart B: Procedures for Imposing Requirements by Order, or for Modification, Suspension, or Revocation of a License, or for Imposing Civil Penalties. ecfr.gov
U.S. Nuclear Regulatory Commission. 10 CFR Part 20: Standards for Protection Against Radiation. ecfr.gov
U.S. Nuclear Regulatory Commission. 10 CFR Part 35: Medical Use of Byproduct Material. ecfr.gov