The NIS2 Directive (EU) 2022\/2555<\/a> entered into force on 16 January 2023. EU Member States were required to transpose the Directive into national law by 17 October 2024. However, the precise rules on management liability, supervision and enforcement are determined through national legislation. Their legal effect may therefore differ between Member States, particularly where national transposition has not yet been completed.<\/p>\n For an overview of national implementation, visit NIS2certification.eu<\/a>, where NIS2 requirements and implementation are explained by country.<\/p>\n Article 20 of the NIS2 Directive places specific responsibilities on the management bodies of essential and important entities. Cybersecurity is therefore not solely a technical or operational responsibility. It is also a governance matter requiring active oversight at board level.<\/p>\n The management body must, at a minimum:<\/p>\n The NIS2 Directive does not define the management body separately for every type of legal entity. Which individuals form part of the relevant management body and which rules on personal liability apply therefore also depend on national law and the legal structure of the organisation.<\/p>\n Yes. The NIS2 Directive requires Member States to ensure that the management bodies of essential and important entities may be held liable for infringements by the organisation of the cybersecurity risk-management obligations referred to in Article 21.<\/p>\n This does not mean that every board member is automatically personally liable whenever an organisation breaches NIS2. The Directive establishes management responsibility at European level, while the precise rules governing liability, including any personal liability of individual directors or board members, are determined by applicable national law.<\/p>\n Specific national rules may also apply to public authorities, public officials and elected or appointed office holders.<\/p>\n NIS2 requires management bodies to approve cybersecurity risk-management measures and oversee their implementation. Whether and under which circumstances an individual board member can be held personally liable depends on the applicable national legislation.<\/p>\n<\/div>\n NIS2 also places requirements on the knowledge of management bodies. Article 20 requires members of the management bodies of essential and important entities to follow training<\/strong>.<\/p>\n The purpose of this training is to provide board members with sufficient knowledge and skills to:<\/p>\n The NIS2 Directive does not prescribe a specific training programme or training provider. The detailed implementation of the training requirement may differ between countries.<\/p>\n BC Academy offers an NIS2 Executive training course for leadership and management teams<\/strong><\/a>. The in-company training covers the NIS2 Directive, governance, cybersecurity risks and the role of management. Each participant receives a certificate of attendance after completing the training.<\/p>\n NIS2 also requires Member States to encourage essential and important entities to offer similar cybersecurity training to their employees on a regular basis.<\/p>\n EU Member States must designate competent national authorities responsible for supervising compliance with national NIS2 legislation. The competent authority and the precise supervisory arrangements may differ by Member State and sector.<\/p>\n The NIS2 Directive distinguishes between the supervision of essential entities<\/strong> and important entities<\/strong>.<\/p>\n For essential entities, competent authorities must have powers that include:<\/p>\n For important entities, supervision follows an ex-post approach under the European framework. Supervisory measures are generally taken when evidence, indications or information suggest that the entity may not be complying with its NIS2 obligations.<\/p>\n The detailed supervisory procedures and powers are further defined in national legislation.<\/p>\n Where an essential or important entity fails to meet the applicable NIS2 requirements, competent authorities may use a range of enforcement measures. Depending on national legislation, these may include:<\/p>\n For essential entities, NIS2 provides for additional measures where previous enforcement action has proved ineffective. Subject to national law, a certification or authorisation may, for example, be temporarily suspended. Competent authorities may also request that a person with managerial responsibilities at chief executive officer or legal representative level be temporarily prohibited from exercising managerial functions within the essential entity.<\/p>\n Such temporary measures apply only until the entity has remedied the relevant deficiencies or complied with the requirements of the competent authority.<\/p>\n The NIS2 Directive establishes minimum requirements for the maximum administrative fines that Member States must make available under their national legislation.<\/p>\n These European thresholds relate to administrative fines imposed on the entity<\/strong> for infringements including cybersecurity risk-management and incident-reporting obligations. They do not mean that an individual board member is automatically personally liable for a fine of this amount.<\/p>\n The final enforcement powers, sanctions and liability rules are determined by the national legislation of each EU Member State.<\/p>\n NIS2 makes clear that cybersecurity is not solely the responsibility of the IT department or information security function. The management body must be actively involved in managing cybersecurity risks, approving the relevant measures and overseeing their implementation.<\/p>\n Board members must also develop sufficient knowledge to carry out these responsibilities. The requirement for management-body members to follow training underlines that cybersecurity has become part of corporate governance and organisational risk management.<\/p>\n Because NIS2 is an EU Directive, the detailed rules on liability, supervision and enforcement are established through national legislation. Organisations operating in more than one European country should therefore consider both the European NIS2 framework and the national legislation applicable in each relevant Member State.<\/p>\n National implementation, competent authorities, deadlines and procedures differ between Member States. NIS2certification.eu provides country-specific information on the implementation of NIS2 across Europe.<\/p>\n![\"NIS2](\"https:\/\/brandcompliance.com\/wp-content\/uploads\/2024\/05\/pexels-cqf-avocat-188397-613508_web2-300x266.jpg\")
<\/p>\nNIS2 obligations for board members<\/h2>\n
\n
Can board members be held liable under NIS2?<\/h3>\n
NIS2 training for board members and management<\/h3>\n
\n
Supervision of NIS2 compliance<\/h2>\n
\n
Enforcement measures for non-compliance<\/h3>\n
\n
NIS2 fines<\/h3>\n
\n
NIS2 liability requires active board involvement<\/h2>\n