NIS2 liability for board members

The NIS2 Directive makes cybersecurity an explicit responsibility at board level. The management bodies of essential and important entities must approve cybersecurity risk-management measures, oversee their implementation and may be held liable where the organisation fails to comply with its obligations in this area.

In this article, we explain what NIS2 liability for board members means, which responsibilities rest with the management body, what training NIS2 requires and which supervisory and enforcement measures may apply.

The NIS2 Directive (EU) 2022/2555 entered into force on 16 January 2023. EU Member States were required to transpose the Directive into national law by 17 October 2024. However, the precise rules on management liability, supervision and enforcement are determined through national legislation. Their legal effect may therefore differ between Member States, particularly where national transposition has not yet been completed.

For an overview of national implementation, visit NIS2certification.eu, where NIS2 requirements and implementation are explained by country.

NIS2 obligations for board members #

Article 20 of the NIS2 Directive places specific responsibilities on the management bodies of essential and important entities. Cybersecurity is therefore not solely a technical or operational responsibility. It is also a governance matter requiring active oversight at board level.

The management body must, at a minimum:

• approve the cybersecurity risk-management measures referred to in Article 21 of the NIS2 Directive;
• oversee the implementation of those measures;
• have sufficient knowledge to assess cybersecurity risks and the measures taken to manage them;
• understand the potential impact of cybersecurity risks on the services provided by the organisation.

The NIS2 Directive does not define the management body separately for every type of legal entity. Which individuals form part of the relevant management body and which rules on personal liability apply therefore also depend on national law and the legal structure of the organisation.

Can board members be held liable under NIS2? #

Yes. The NIS2 Directive requires Member States to ensure that the management bodies of essential and important entities may be held liable for infringements by the organisation of the cybersecurity risk-management obligations referred to in Article 21.

This does not mean that every board member is automatically personally liable whenever an organisation breaches NIS2. The Directive establishes management responsibility at European level, while the precise rules governing liability, including any personal liability of individual directors or board members, are determined by applicable national law.

Specific national rules may also apply to public authorities, public officials and elected or appointed office holders.

NIS2 training for board members and management #

NIS2 also places requirements on the knowledge of management bodies. Article 20 requires members of the management bodies of essential and important entities to follow training.

The purpose of this training is to provide board members with sufficient knowledge and skills to:

• identify cybersecurity risks;
• assess the measures used to manage those risks;
• understand the consequences of cybersecurity risks for the organisation’s services;
• perform their supervisory and decision-making role in relation to cybersecurity effectively.

The NIS2 Directive does not prescribe a specific training programme or training provider. The detailed implementation of the training requirement may differ between countries.

BC Academy offers an NIS2 Executive training course for leadership and management teams. The in-company training covers the NIS2 Directive, governance, cybersecurity risks and the role of management. Each participant receives a certificate of attendance after completing the training.

NIS2 also requires Member States to encourage essential and important entities to offer similar cybersecurity training to their employees on a regular basis.

Supervision of NIS2 compliance #

EU Member States must designate competent national authorities responsible for supervising compliance with national NIS2 legislation. The competent authority and the precise supervisory arrangements may differ by Member State and sector.

The NIS2 Directive distinguishes between the supervision of essential entities and important entities.

For essential entities, competent authorities must have powers that include:

• on-site inspections and off-site supervision;
• regular and targeted security audits;
• ad hoc audits where justified;
• security scans based on objective and transparent risk-assessment criteria;
• requests for information, documents and evidence;
• requests for evidence that cybersecurity policies and risk-management measures have been implemented effectively.

For important entities, supervision follows an ex-post approach under the European framework. Supervisory measures are generally taken when evidence, indications or information suggest that the entity may not be complying with its NIS2 obligations.

The detailed supervisory procedures and powers are further defined in national legislation.

Enforcement measures for non-compliance #

Where an essential or important entity fails to meet the applicable NIS2 requirements, competent authorities may use a range of enforcement measures. Depending on national legislation, these may include:

• warnings;
• binding instructions to remedy deficiencies;
• orders requiring conduct that infringes the law to cease;
• instructions to adjust cybersecurity risk-management measures;
• requirements to implement recommendations resulting from a security audit;
• orders to make certain information about an infringement public;
• administrative fines.

For essential entities, NIS2 provides for additional measures where previous enforcement action has proved ineffective. Subject to national law, a certification or authorisation may, for example, be temporarily suspended. Competent authorities may also request that a person with managerial responsibilities at chief executive officer or legal representative level be temporarily prohibited from exercising managerial functions within the essential entity.

Such temporary measures apply only until the entity has remedied the relevant deficiencies or complied with the requirements of the competent authority.

NIS2 fines #

The NIS2 Directive establishes minimum requirements for the maximum administrative fines that Member States must make available under their national legislation.

• Essential entities: a maximum administrative fine of at least €10 million or 2% of the total worldwide annual turnover in the preceding financial year, whichever is higher.
• Important entities: a maximum administrative fine of at least €7 million or 1.4% of the total worldwide annual turnover in the preceding financial year, whichever is higher.

These European thresholds relate to administrative fines imposed on the entity for infringements including cybersecurity risk-management and incident-reporting obligations. They do not mean that an individual board member is automatically personally liable for a fine of this amount.

The final enforcement powers, sanctions and liability rules are determined by the national legislation of each EU Member State.

NIS2 liability requires active board involvement #

NIS2 makes clear that cybersecurity is not solely the responsibility of the IT department or information security function. The management body must be actively involved in managing cybersecurity risks, approving the relevant measures and overseeing their implementation.

Board members must also develop sufficient knowledge to carry out these responsibilities. The requirement for management-body members to follow training underlines that cybersecurity has become part of corporate governance and organisational risk management.

Because NIS2 is an EU Directive, the detailed rules on liability, supervision and enforcement are established through national legislation. Organisations operating in more than one European country should therefore consider both the European NIS2 framework and the national legislation applicable in each relevant Member State.

Would you like to know more about independent assessment in a NIS2 context? #

Brand Compliance performs independent certification and verification activities which, depending on the applicable national framework, may contribute to demonstrating cybersecurity measures.

Do you have questions about ISO/IEC 27001 certification, CyFun® verification or another assessment process? Request a non-binding introductory meeting with Brand Compliance. During this meeting, we can explain the assessment process, the information required and the possible scope.