NIS2 Management Body Obligations

Article 20(1) states that management body members "can be held liable for infringements" of the entity's obligations under Article 21 (cybersecurity risk-management measures). This provision has generated significant attention from legal counsel, boards, and D&O insurers across the EU. The precise scope and mechanism of personal liability depends on each Member State's transposition, as NIS2 is a directive that requires national implementation.

Some Member States have transposed the liability provision conservatively, linking management body liability to existing corporate governance frameworks (e.g., directors' duties of care) and requiring proof of gross negligence or intentional misconduct. Others have adopted more expansive approaches, creating specific cybersecurity-related liability provisions that lower the threshold. The variation across Member States means that entities operating in multiple jurisdictions must assess the liability exposure of their management body members in each transposing country.

The practical implications are substantial. Management body members can no longer plausibly claim ignorance of cybersecurity risks as a defence. The combination of the approval obligation (they must approve the measures), the oversight obligation (they must oversee implementation), and the training obligation (they must be trained) creates a documented chain of knowledge and responsibility. A management body member who approved inadequate measures, failed to oversee their implementation, or declined to participate in training will have limited grounds for arguing that they exercised due diligence.

Advisory boards, non-executive directors, and supervisory board members should pay particular attention. In two-tier board structures common in Germany, Austria, and the Netherlands, both the management board (Vorstand) and the supervisory board (Aufsichtsrat) may have obligations under Article 20, depending on national transposition. Legal counsel in each jurisdiction should be consulted to determine the precise scope of the management body definition.

The approval obligation under Article 20(1) requires the management body to actively approve the cybersecurity risk-management measures adopted under Article 21. Article 21 covers a comprehensive list of measures including risk analysis and information system security policies, incident handling, business continuity and crisis management, supply chain security, security in network and information systems acquisition and development, vulnerability handling and disclosure, and policies on the use of cryptography and encryption.

Approval means more than rubber-stamping a document prepared by the CISO. The management body must understand the measures it is approving, assess their adequacy in the context of the entity's risk profile, and allocate sufficient resources for their implementation. Board minutes should reflect substantive discussion of cybersecurity measures, questions asked, alternatives considered, and the rationale for the chosen approach. A single-line board resolution stating "cybersecurity policy approved" will not demonstrate the level of engagement that Article 20 expects.

Oversight of implementation is the second limb of the obligation. Once measures are approved, the management body must monitor whether they are actually being implemented and whether they are effective. This requires regular reporting from the cybersecurity function to the management body — not just on incidents, but on the implementation status of approved measures, the results of vulnerability assessments and penetration tests, the state of supply chain security arrangements, and emerging risks that may require the measures to be updated.

Entities should establish a formal governance cadence for cybersecurity oversight. This typically includes quarterly reporting from the CISO or equivalent to the management body (or a dedicated risk/audit committee), annual review and re-approval of cybersecurity policies and measures, and ad hoc reporting triggered by significant incidents or material changes. The reporting format should be designed for a non-technical audience — dashboards, risk heat maps, and trend indicators are more useful to management body members than technical vulnerability reports.

The personal liability provisions of Article 20 have direct implications for Directors and Officers (D&O) insurance coverage. D&O insurance protects individual directors and officers against personal financial exposure arising from claims related to their management activities. With NIS2 creating an explicit statutory basis for management body liability in relation to cybersecurity failures, the D&O insurance market is adapting its coverage, exclusions, and pricing.

Insurers are increasingly scrutinising the cybersecurity governance practices of insured entities during underwriting. Questions about management body training, oversight cadence, CISO reporting lines, and incident response capabilities are becoming standard in D&O insurance applications and renewal questionnaires. Entities that cannot demonstrate compliance with Article 20 obligations may face higher premiums, narrower coverage, or specific exclusions for cybersecurity-related claims. In extreme cases, insurers may refuse coverage for management body members who have not complied with mandatory training requirements.

Management body members should review their D&O policies — and their personal coverage under those policies — in light of NIS2 transposition in their jurisdictions. Key questions include: Does the policy cover claims arising from regulatory proceedings under NIS2? Are there exclusions for wilful or knowing non-compliance with statutory obligations (which could apply if a director refused to undergo mandatory training)? Does the policy extend to supervisory board members in two-tier structures? Is there coverage for defence costs in administrative penalty proceedings?

From a risk management perspective, the most effective protection against personal liability is demonstrable compliance with Article 20 obligations: approve the measures, oversee their implementation, attend the training, ask the hard questions, and document everything. D&O insurance provides financial protection if things go wrong despite reasonable governance efforts — but it is not a substitute for those efforts, and no insurer will defend a claim where the director demonstrably failed to discharge their statutory obligations.