NIS2 Management Responsibility and Liability Under Article 20

NIS2 Article 20 makes cybersecurity governance a management-body responsibility. For essential and important entities, management must approve the Article 21 cybersecurity risk-management measures, oversee their implementation, and complete cybersecurity training. The Directive also requires Member States to make it possible for management bodies to be held liable for Article 21 infringements, but the exact personal consequences depend on national law.

That last sentence deserves care. NIS2 does not say that every director personally receives the Directive's €10 million or €7 million administrative fine. Those thresholds apply to entities under Article 34. Personal liability, temporary restrictions on managerial functions, and other consequences sit in different legal layers.

For security and compliance teams, Article 20 changes the operating model more than the org chart. Management can still rely on CISOs, IT teams, legal counsel, and external providers to do the work. What it cannot hand away is approval and oversight.

What does NIS2 Article 20 require from management?

Article 20 is short, but it creates four distinct management expectations. Keeping them separate makes the rest of the compliance work much easier to assign.

The legal wording comes directly from Article 20 of Directive (EU) 2022/2555. It applies to the management bodies of both essential and important entities.

What must management actually approve under Article 20?

Management approves the cybersecurity risk-management measures the organization uses to comply with Article 21. That is a governance decision, not an instruction to sign every firewall rule, patch ticket, or endpoint policy.

A useful approval package should make the decision visible. It should show which risks matter, which controls address them, what remains unresolved, who owns the work, and where the organization has accepted an exception or residual risk. The level of detail should be enough for management to challenge the plan rather than merely acknowledge that one exists.

This is where Article 20 and Article 21 meet. Article 21 defines the security areas that need to be covered. Article 20 decides who must approve the organization's approach and keep watching whether it is being carried out.

What does "oversee implementation" mean in practice?

The Directive does not give every organization a universal board calendar. It simply requires management bodies to oversee implementation. That makes the quality of the reporting more important than an invented monthly or quarterly ritual.

Useful oversight gives management enough information to spot material drift. A status report that stays green while critical remediation slips for six months is not much of an oversight mechanism. The reporting should expose decisions that need management attention.

In practice, management oversight usually needs visibility into the following areas before it can work:

• Material cybersecurity risks and changes in exposure.
• Progress against approved Article 21 measures and remediation plans.
• High-impact exceptions, accepted risks, and overdue actions.
• Significant incidents and what they revealed about existing controls.
• Critical supplier or dependency risks that affect regulated services.
• Resources or business decisions that are blocking security measures.

The organization can choose the reporting format. The important part is traceability: what management knew, what it decided, who took the action, and whether the issue came back for follow-up.

Does NIS2 require cybersecurity training for directors and management?

Yes. Article 20(2) requires Member States to ensure that members of the management bodies of essential and important entities follow training. The goal is practical: they need enough knowledge and skills to identify risks and assess cybersecurity risk-management practices and their impact on the services the entity provides.

The EU text does not prescribe a specific certification, number of training hours, or one fixed renewal cadence. National law or competent-authority guidance can add detail, so organizations operating across several Member States should check the rules that apply to each legal entity.

Training also needs to fit the decision. A generic phishing-awareness video does not prepare a management body to challenge a risk-treatment plan, understand a major service dependency, or judge whether a proposed exception is reasonable.

A sensible training record therefore shows who attended, when the training happened, what it covered, and how it connected to the organization's actual risk and services. That is evidence of the activity without pretending the Directive mandates one standard course.

What does NIS2 management liability actually mean?

NIS2 management liability is often described too loosely. The Directive creates management accountability, but several different enforcement concepts sit around it. They should not be collapsed into one frightening number.

The cleanest way to read the framework is to separate the layers:

Are the €10 million and €7 million NIS2 fines personal fines?

No. Article 34 sets administrative fine requirements for entities. Essential entities face a maximum fine level of at least €10 million or 2% of worldwide annual turnover, whichever is higher. For important entities, the baseline is at least €7 million, or 1.4%, whichever is higher.

Those thresholds are part of the entity enforcement regime in Article 34 of the NIS2 Directive. They should not be repackaged as "personal fines for directors."

Can NIS2 temporarily restrict someone from a management role?

Yes, but only in a narrower situation than many summaries suggest. Article 32(5) concerns essential entities and comes after specified enforcement measures have been ineffective and the entity has missed a deadline to remedy the deficiencies or comply with the authority's requirements.

At that point, Member States must ensure that competent authorities can ask the relevant body, court, or tribunal, in accordance with national law, to temporarily prohibit a natural person with managerial responsibilities at CEO or legal-representative level from exercising managerial functions in that essential entity.

The restriction lasts only until the entity remedies the deficiencies or complies with the authority's requirements. The Directive also requires procedural safeguards. It is a serious last-resort measure, not the default result of a failed control test.

So can a director be personally liable under NIS2?

Potentially, yes, because Article 20 requires Member States to make management bodies capable of being held liable for Article 21 infringements. But the exact route to personal civil, administrative, or criminal exposure is a national-law question. It is not identical across the EU.

That is why an organization should separate the EU baseline from the law in each Member State where the relevant entity is established or regulated. The Directive creates the governance obligation. National implementation supplies much of the legal machinery around personal consequences.

Does Article 20 change the CISO's responsibility?

It changes the relationship between the CISO and management more than it changes the CISO's job title. A CISO can design controls, run the security program, prepare risk information, recommend remediation, and report progress. Article 20 still places approval and oversight with the management body.

That division is useful when it is explicit. The CISO should not be left carrying a risk that management has never seen, while management should not approve a security program it cannot question.

A practical split looks like this:

What evidence supports Article 20 governance?

Article 20 does not publish a mandatory evidence pack. The useful evidence is the material that proves management did more than receive a slide deck.

A management audit trail can include several types of records, depending on the organization and national process:

• Minutes or formal approvals showing that Article 21 measures and material risks were considered.
• Risk and control reports supplied to management, with dated follow-up decisions.
• Remediation plans with owners, deadlines, exceptions, and escalation records.
• Training records for members of the management body, including the content covered.
• Records of material risk acceptance or resource decisions that affected cybersecurity measures.
• Incident or crisis decisions that show how management acted when service or business impact required executive authority.

The point is not to manufacture paperwork after the fact. Evidence should fall out of the governance process naturally. If a regulator asks how a material security gap was handled, the organization should be able to reconstruct the decision without hunting through private inboxes.

How should management start with Article 20?

Start with the decisions that management is expected to own, then build the reporting around those decisions. That keeps Article 20 from becoming another compliance folder with no operating value.

1. Confirm which legal entities are in the NIS2 scope and whether they are essential or important.
2. Identify the management body that will approve Article 21 measures under the applicable corporate and national framework.
3. Bring the Article 21 control map and material gaps into a management-level decision format.
4. Define what information management needs to oversee implementation and which issues must be escalated between scheduled reviews.
5. Arrange management training that covers the entity's real risks, services, dependencies, and NIS2 duties.
6. Keep a traceable record of approvals, material risk decisions, follow-up, and training.

If those six pieces exist, Article 20 becomes part of normal governance rather than a separate compliance ceremony.

Quick Article 20 management review

Use these questions as a short readiness check before turning the gaps into a larger remediation plan:

• Can the organization identify the management body responsible for Article 20 approval and oversight?
• Has management formally approved the Article 21 risk-management approach?
• Does management receive enough information to see material gaps, exceptions, and overdue remediation?
• Can the organization show that management body members completed relevant cybersecurity training?
• Are material risk decisions and follow-up actions documented?
• Has the organization separated entity-level NIS2 fines from any personal liability that depends on national law?

Final thoughts: Make Article 20 part of normal governance

The useful Article 20 test is simple: can management explain what cybersecurity measures it approved, what material risks remain, how it knows implementation is moving, and what it decided when something slipped? If the answer lives only in the security team, the governance chain is incomplete.

For organizations still assembling that chain, start with scope, Article 21 measures, management reporting, and training. Then keep the evidence as the decisions happen. That is easier to defend than rebuilding a year of governance shortly before an audit.

Frequently asked questions about NIS2 management responsibility

Does NIS2 make management responsible for cybersecurity?

Yes. Article 20 requires management bodies of essential and important entities to approve Article 21 measures, oversee implementation, and complete cybersecurity training.

Can NIS2 management responsibility be delegated to the CISO?

The work can be delegated, but Article 20 keeps approval and oversight with the management body. A CISO can operate the program and advise management; management still owns its governance duties.

Does NIS2 create personal liability for directors?

Article 20 requires Member States to make management bodies capable of being held liable for Article 21 infringements. The exact personal consequences depend on national law and are not uniform across the EU.

Are NIS2 fines paid personally by directors?

The Article 34 fine thresholds apply to entities. They are not automatic personal fines for directors. Personal liability must be assessed under the applicable national law.

Does Article 20 apply to important entities too?

Yes. Article 20 applies to management bodies of both essential and important entities. Some enforcement tools, including the Article 32(5) temporary management restriction, are specific to essential entities.

Does NIS2 require board cybersecurity training?

Yes. Management-body members must follow training. The Directive does not set a universal certificate, number of hours, or fixed EU-wide renewal schedule.

How often must management review NIS2 controls?

Article 20 requires oversight but does not set one EU-wide review cadence. The organization should define a cadence and escalation rules that fit its risk, changes, incidents, and national requirements.

What should management keep as Article 20 evidence?

Useful evidence includes formal approvals, oversight reports, risk decisions, remediation follow-up, and management training records. The Directive does not prescribe one universal document pack.