NIS2 makes cybersecurity a personal duty of the management body: directors must approve and oversee their organisation's cyber risk measures, must be trained, and can be held liable when the organisation fails. This briefing is for board members, chief executives, company secretaries, general counsel and CISOs of organisations that are, or may be, essential or important entities under Directive (EU) 2022/2555. It explains Article 20 in plain terms, what personal exposure looks like under Article 32 and national law, how the fines work, and what evidence a board needs to show it has met its duties. It stays at board level; for scope, the ten Article 21 measures and reporting detail see the NIS2 Directive Guide and, for a control-by-control review, the NIS2 Readiness Checklist.
The risk in one paragraph
Under NIS2 the management body of an in-scope organisation can no longer delegate cybersecurity and walk away. Article 20 requires it to approve the cybersecurity risk-management measures the organisation takes under Article 21, to oversee how they are implemented, and to follow training, and it states that management bodies can be held liable for infringements. Article 32 adds that people with authority over an essential entity must be able to ensure compliance and can be held liable for breaching that duty, and, as a last resort, allows a temporary ban on a chief executive or legal representative exercising managerial functions. On top of that sit organisational fines with maximums of at least EUR 10 million or 2 per cent of worldwide turnover. The practical risk for a director is not usually a fine in their own name; it is being unable to show, after an incident, that the board approved credible measures, understood the risks, and followed up when they were not working.
Why this is a board-level issue now
- The duty is already law in most of the EU. Member States had to transpose NIS2 by 17 October 2024. Many were late, and the Commission sent reasoned opinions to 19 Member States on 7 May 2025, then on 8 July 2026 referred Ireland, Spain, France and the Netherlands to the Court of Justice seeking a lump sum and daily penalties. Where national law is in force, the management duties apply now. Track your countries in the NIS2 Transposition Tracker.
- National laws make liability concrete. Germany's implementing law, in force since 6 December 2025, requires management of essential and important entities to implement and monitor the risk measures (section 38(1) BSIG), makes them liable to the entity for damage caused through fault under the company law of the entity's legal form (section 38(2)), and requires them to attend training regularly (section 38(3)). See the Germany NIS2 Implementation Guide.
- Scope is far wider than the first NIS Directive. NIS2 covers 18 sectors and most medium and large organisations in them, so many boards are subject to cyber governance law for the first time.
- Incidents are reported to regulators within 24 hours. An early warning is due within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report within one month. Failure to notify is one of the factors that makes an infringement serious under Article 32(7).
- Regulators judge governance after the fact. When a supervisor investigates, board minutes, approvals, training records and follow-up actions become evidence. A board that cannot produce them is exposed regardless of how much was spent on security.
Article 20 duties in plain terms
| Duty | What the Directive says | What the board must be able to show |
|---|---|---|
| Approve | Management bodies approve the cybersecurity risk-management measures taken to comply with Article 21 (Art. 20(1)) | A minuted approval of the security policy and risk treatment plan, renewed when they change materially |
| Oversee | Management bodies oversee the implementation of those measures (Art. 20(1)) | Regular reports with metrics, an audit or assurance view, and recorded challenge and follow-up |
| Be accountable | Management bodies can be held liable for the entity's infringements of Article 21; national rules on public sector liability are preserved (Art. 20(1)) | A clear allocation of responsibility, a named accountable executive and an escalation route for unresolved risks |
| Be trained | Members of management bodies are required to follow training (Art. 20(2)) | Attendance records per director, content that covers the entity's own risks and services, a refresh cycle |
| Train staff | Entities are encouraged to offer similar training to employees on a regular basis (Art. 20(2)) | A staff training programme linked to the Article 21 hygiene and training measure |
The training is not a general awareness module. Article 20(2) aims at sufficient knowledge and skills to identify risks and assess cybersecurity risk-management practices and their impact on the services the entity provides. In practice that means scenarios built on the organisation's own critical services, suppliers and incident history.
Personal liability, bans and fines
NIS2 sets minimums; each Member State decides the exact form of liability, so directors must read their national law. The main layers are:
- Liability for infringements (Article 20(1)): the Directive requires that management bodies can be held liable for the entity's infringements of the Article 21 risk-management duties. The mechanism is national: in Germany it is liability to the entity under company law, which can lead to claims by the company or its shareholders against directors.
- Duty to ensure compliance (Article 32(6), essential entities): any natural person responsible for an essential entity or acting as its legal representative, with authority to take decisions or exercise control, must have the powers to ensure compliance and can be held liable for breach of that duty.
- Temporary management ban (Article 32(5), essential entities): if earlier enforcement measures prove ineffective and a deadline to remedy is missed, the authority may ask the relevant body or court to temporarily prohibit any person discharging managerial responsibilities at chief executive or legal representative level from exercising managerial functions in that entity, until the deficiencies are fixed. It does not apply to public administration entities.
- Organisational fines (Article 34): fines must be effective, proportionate and dissuasive, and are imposed in addition to other supervisory measures.
| Measure | Essential entities | Important entities |
|---|---|---|
| Maximum fine for breaching Article 21 or 23 | At least EUR 10,000,000 or 2% of total worldwide annual turnover of the undertaking, whichever is higher | At least EUR 7,000,000 or 1.4% of total worldwide annual turnover, whichever is higher |
| Supervision | Proactive (ex ante and ex post) | Reactive (ex post, after evidence or indication of non-compliance) |
| Temporary ban on managers | Available as a last resort (Art. 32(5)) | Not provided for in the Directive |
| Periodic penalty payments | Possible where national law provides, after a prior decision | Possible where national law provides, after a prior decision |
| Management liability for infringements | Yes (Art. 20(1), plus Art. 32(6)) | Yes (Art. 20(1)) |
The Directive's figures are floors for the maximum: national laws may set higher ceilings, and Member States decide whether public administration bodies can be fined at all. When deciding on measures, authorities must consider factors listed in Article 32(7), including the seriousness and duration of the infringement, intent or negligence, the damage caused, measures taken to mitigate it, and the level of cooperation. Providing false or grossly inaccurate information is listed as serious. For a cross-jurisdiction view of director exposure, including the US SEC and NYDFS regimes, see the Board and Director Cyber Liability Guide.
Defensible oversight: the evidence trail
Liability turns on what the board did and can prove. Directors should expect to rely on the following records after an incident or in a supervisory audit:
| Evidence | Owner | Frequency |
|---|---|---|
| Board approval of the cybersecurity policy and Article 21 risk treatment plan | Company secretary | On adoption and on material change, at least annually |
| Cyber risk report with metrics and exceptions | CISO, via the accountable executive | Quarterly to the board or a delegated committee |
| Director training attendance and content | Company secretary and HR | On appointment and on a regular refresh cycle |
| Entity classification and registration with the national authority | Legal and compliance | On change of scope, activities or size |
| Incident reporting procedure and test results (24 hours, 72 hours, one month) | CISO and legal | Tested at least annually |
| Independent assurance on the Article 21 measures | Internal audit | Annual plan, with findings tracked to closure |
| Supplier security risk review for critical suppliers | Procurement and CISO | Annual, and on onboarding |
Minutes matter. A record that says "the board noted the report" is weaker evidence than one that shows questions asked, a risk accepted with reasons, or an action set with an owner and deadline.
Five questions for the board to ask
- Are we an essential or important entity in each country where we operate, and have we registered with each authority? A credible answer is a written classification by country, signed off by legal, with registration evidence.
- Which Article 21 measures has this board formally approved, and when did we last review whether they work? Look for a minuted approval and a dated effectiveness review with metrics, not just a policy document.
- Has every director completed NIS2 training that covers our own critical services, and when is the refresh? Expect attendance records per director and training built on the organisation's real risks.
- If a significant incident happened on Friday night, who would send the 24-hour early warning, and has that been tested? The answer should name roles, deputies and the authority's reporting channel, with a test date.
- What are our three largest gaps against Article 21, and what decision is management asking this board to make about each? The board should be accepting, funding or rejecting specific risks, on the record.
Red flags in management answers
- "We are ISO 27001 certified, so we comply": certification helps with many Article 21 measures but does not cover director training, national registration or the reporting timeline. Ask for a mapping.
- "Legal says we are probably not in scope": without a written analysis by sector, size and country, this is a guess. Scope can also arise through group companies.
- "The CISO owns NIS2": the Directive places approval and oversight on the management body. A CISO can run the programme, but cannot carry the board's duty.
- Training as a slide deck: a generic e-learning module does not show that directors can assess risks and their impact on the entity's services.
- Reports with no decisions: board papers that never ask the board to accept, fund or reject anything leave no evidence of oversight.
- "Our national law is not in force yet, so we can wait": laws arrive with short transition periods, and supervisors will look at what was done before them.
What good looks like
| Area | Good practice |
|---|---|
| Scope and registration | Written classification per entity and country, registration completed, reviewed on corporate change |
| Governance | Board approval of the policy and risk plan, a named accountable executive, a committee with cyber in its terms of reference |
| Training | Initial and refresher training for every director, scenario based, with records |
| Oversight | Quarterly reporting with metrics, exceptions and decisions; internal audit coverage of Article 21 |
| Incident readiness | Tested reporting process meeting the 24-hour, 72-hour and one-month steps, with deputies and offline contact details |
| Supply chain | Critical suppliers identified, security requirements in contracts, reviews recorded |
| Identity and access | Multi-factor authentication, privileged access control and service account governance evidenced, since Article 21 lists access control and MFA among the measures |
Where to invest first
- Scope certainty: a legal classification of every group entity in every Member State. Everything else depends on knowing which regime and which authority applies.
- Board governance pack: policy approval, terms of reference, reporting template and a decision log. See the Board Cyber Report Template.
- Director training: a session built on the organisation's own services and incident scenarios, recorded per director, with a refresh date.
- Incident reporting capability: a process that can produce an early warning within 24 hours, tested with an exercise. See EU Incident Reporting Clocks.
- Gap closure on the highest-risk measures: typically access control and MFA, supplier security and backup and recovery. See the NIS2 Readiness Checklist.
Metrics to track
- Percentage of directors with current NIS2 training, and days until the next refresh is due.
- Number of Article 21 measures assessed as effective, partly effective or not effective at the last review.
- Number of open high-risk gaps and their age, with the board decision recorded for each.
- Result and date of the last incident reporting test against the 24-hour and 72-hour steps.
- Percentage of critical suppliers with security requirements in contract and a review in the last 12 months.
- Internal audit findings on NIS2 measures closed on time.
A 90-day plan
- Days 1 to 30: commission a written scope and registration analysis by country; name the accountable executive; confirm which committee oversees NIS2; schedule director training.
- Days 31 to 60: deliver director training with attendance records; approve the cybersecurity policy and risk treatment plan in a minuted meeting; agree the quarterly reporting template with metrics and a decision log.
- Days 61 to 90: run an incident exercise that tests the 24-hour early warning and 72-hour notification; ask internal audit to include Article 21 in its plan; receive the first gap report and record a decision on each high-risk item.
Common failure patterns
- Delegation without oversight: the board hands NIS2 to the CISO and never sees metrics, so it cannot show it oversaw implementation.
- Group blind spots: a subsidiary in another Member State is in scope under a different national law that nobody has read.
- Tick-box training: directors complete generic awareness training that does not relate to the entity's services, which is weak evidence under Article 20(2).
- Untested reporting: a written procedure exists but nobody has tried to file an early warning within 24 hours, out of hours, with the real portal.
- Minutes that hide the debate: records that show no questions or decisions, leaving directors unable to demonstrate diligence.
Practitioner checklist
- Hold a written NIS2 classification for every group entity and country, with registration evidence.
- Record board approval of the cybersecurity policy and Article 21 risk treatment plan, and re-approve on material change.
- Keep training records for every director, with content tied to the entity's services and a refresh date.
- Report NIS2 metrics and open gaps to the board or a committee at least quarterly, with decisions minuted.
- Test the 24-hour, 72-hour and one-month reporting steps at least annually, including out of hours.
- Map ISO/IEC 27001 or other certifications to Article 21 and close the gaps they do not cover.
- Track national transposition and secondary rules in each relevant Member State.
- Brief directors on how liability works in each national law that applies to them.
Standards and references
- EUR-Lex: Directive (EU) 2022/2555 (NIS2 Directive)
- European Commission: NIS2 Directive FAQs
- European Commission: NIS2 Directive transposition
- European Commission: Referral of four Member States to the Court of Justice for failing to transpose NIS2
- Germany: BSI Act section 38, management duties
- Germany: BSI Act section 65, fines
- UK NCSC: Cyber Security Toolkit for Boards
How NHI Mgmt Group can help
We provide independent identity and non-human identity risk assessments, board briefings and programme initiation support, including the access control, MFA and service account evidence that NIS2 supervisors ask for. Our NHI Foundation Level Training Course helps security and IAM teams govern service accounts, API keys and secrets. Contact us to arrange a briefing.
Related NHI Mgmt Group resources: NIS2 Directive Guide · NIS2 Readiness Checklist · Board and Director Cyber Liability Guide · DORA and NIS2 Overlap Mapping Guide. This guide summarises the management body duties in Directive (EU) 2022/2555 and selected national implementing law as of 8 November 2026 and is not legal advice.