NIS2 Article 20 makes cybersecurity governance a management-body responsibility. For essential and important entities, management must approve the Article 21 cybersecurity risk-management measures, oversee their implementation, and complete cybersecurity training. The Directive also requires Member States to make it possible for management bodies to be held liable for Article 21 infringements, but the exact personal consequences depend on national law.
That last sentence deserves care. NIS2 does not say that every director personally receives the Directive's €10 million or €7 million administrative fine. Those thresholds apply to entities under Article 34. Personal liability, temporary restrictions on managerial functions, and other consequences sit in different legal layers.
For security and compliance teams, Article 20 changes the operating model more than the org chart. Management can still rely on CISOs, IT teams, legal counsel, and external providers to do the work. What it cannot hand away is approval and oversight.
Free tool
Check the governance gaps before they reach the board agenda
Q-Sec's NIS2 Assessment helps teams review scope, controls, incident readiness, evidence, and ownership before a supervisory review.
Start the NIS2 self-assessmentArticle 20 is short, but it creates four distinct management expectations. Keeping them separate makes the rest of the compliance work much easier to assign.
| Article 20 area | What management must do | What that means operationally |
| Approve | Approve the cybersecurity risk-management measures used to comply with Article 21 | Management needs a decision it can stand behind, not a passive receipt of a security report. |
| Oversee | Oversee implementation of those measures | Management needs visibility into progress, material gaps, exceptions, and unresolved risks. |
| Train | Members of the management body must follow cybersecurity training | They need enough knowledge to identify risk and assess security practices and their effect on services. |
| Accountability | Management bodies can be held liable for Article 21 infringements | The exact personal consequences are set through national law; EU-level entity fines are a separate issue. |
The legal wording comes directly from Article 20 of Directive (EU) 2022/2555. It applies to the management bodies of both essential and important entities.
Management approves the cybersecurity risk-management measures the organization uses to comply with Article 21. That is a governance decision, not an instruction to sign every firewall rule, patch ticket, or endpoint policy.
A useful approval package should make the decision visible. It should show which risks matter, which controls address them, what remains unresolved, who owns the work, and where the organization has accepted an exception or residual risk. The level of detail should be enough for management to challenge the plan rather than merely acknowledge that one exists.
This is where Article 20 and Article 21 meet. Article 21 defines the security areas that need to be covered. Article 20 decides who must approve the organization's approach and keep watching whether it is being carried out.
The Directive does not give every organization a universal board calendar. It simply requires management bodies to oversee implementation. That makes the quality of the reporting more important than an invented monthly or quarterly ritual.
Useful oversight gives management enough information to spot material drift. A status report that stays green while critical remediation slips for six months is not much of an oversight mechanism. The reporting should expose decisions that need management attention.
In practice, management oversight usually needs visibility into the following areas before it can work:
The organization can choose the reporting format. The important part is traceability: what management knew, what it decided, who took the action, and whether the issue came back for follow-up.
Yes. Article 20(2) requires Member States to ensure that members of the management bodies of essential and important entities follow training. The goal is practical: they need enough knowledge and skills to identify risks and assess cybersecurity risk-management practices and their impact on the services the entity provides.
The EU text does not prescribe a specific certification, number of training hours, or one fixed renewal cadence. National law or competent-authority guidance can add detail, so organizations operating across several Member States should check the rules that apply to each legal entity.
Training also needs to fit the decision. A generic phishing-awareness video does not prepare a management body to challenge a risk-treatment plan, understand a major service dependency, or judge whether a proposed exception is reasonable.
A sensible training record therefore shows who attended, when the training happened, what it covered, and how it connected to the organization's actual risk and services. That is evidence of the activity without pretending the Directive mandates one standard course.
NIS2 management liability is often described too loosely. The Directive creates management accountability, but several different enforcement concepts sit around it. They should not be collapsed into one frightening number.
The cleanest way to read the framework is to separate the layers:
| Layer | What the Directive says | What not to claim |
| Article 20 | Management bodies can be held liable for the entity's infringements of Article 21 | Do not claim one uniform EU personal fine or automatic director liability in every Member State. |
| Article 34 | Member States must provide administrative fine ceilings for essential and important entities | The €10m/2% and €7m/1.4% thresholds are entity-level fine rules, not automatic personal fines on directors. |
| Article 32(5) | For essential entities, authorities must be able in specified circumstances to seek a temporary management restriction at CEO or legal-representative level | Do not describe this as automatic, permanent, or applicable to every important entity. |
| National law | Member States determine the concrete liability and enforcement mechanics within their legal systems | Do not generalize one country's director-liability rule across the EU. |
No. Article 34 sets administrative fine requirements for entities. Essential entities face a maximum fine level of at least €10 million or 2% of worldwide annual turnover, whichever is higher. For important entities, the baseline is at least €7 million, or 1.4%, whichever is higher.
Those thresholds are part of the entity enforcement regime in Article 34 of the NIS2 Directive. They should not be repackaged as "personal fines for directors."
Yes, but only in a narrower situation than many summaries suggest. Article 32(5) concerns essential entities and comes after specified enforcement measures have been ineffective and the entity has missed a deadline to remedy the deficiencies or comply with the authority's requirements.
At that point, Member States must ensure that competent authorities can ask the relevant body, court, or tribunal, in accordance with national law, to temporarily prohibit a natural person with managerial responsibilities at CEO or legal-representative level from exercising managerial functions in that essential entity.
The restriction lasts only until the entity remedies the deficiencies or complies with the authority's requirements. The Directive also requires procedural safeguards. It is a serious last-resort measure, not the default result of a failed control test.
Potentially, yes, because Article 20 requires Member States to make management bodies capable of being held liable for Article 21 infringements. But the exact route to personal civil, administrative, or criminal exposure is a national-law question. It is not identical across the EU.
That is why an organization should separate the EU baseline from the law in each Member State where the relevant entity is established or regulated. The Directive creates the governance obligation. National implementation supplies much of the legal machinery around personal consequences.
It changes the relationship between the CISO and management more than it changes the CISO's job title. A CISO can design controls, run the security program, prepare risk information, recommend remediation, and report progress. Article 20 still places approval and oversight with the management body.
That division is useful when it is explicit. The CISO should not be left carrying a risk that management has never seen, while management should not approve a security program it cannot question.
A practical split looks like this:
| Work | Typical operating owner | Article 20 management role |
| Risk assessment and control design | CISO / security / IT / risk teams | Review material risks and approve the Article 21 approach |
| Control implementation | Security, IT, engineering, business owners, suppliers | Oversee whether agreed measures are being delivered |
| Technical exceptions | Control owner with risk and business input | Approve or receive material risk decisions according to governance rules |
| Incident handling | Security / incident response / business teams | Receive material incident information and make business-level decisions where required |
| Governance evidence | Security, compliance, legal, risk, company secretariat | Ensure decisions, training, and follow-up are traceable |
Article 20 does not publish a mandatory evidence pack. The useful evidence is the material that proves management did more than receive a slide deck.
A management audit trail can include several types of records, depending on the organization and national process:
The point is not to manufacture paperwork after the fact. Evidence should fall out of the governance process naturally. If a regulator asks how a material security gap was handled, the organization should be able to reconstruct the decision without hunting through private inboxes.
Start with the decisions that management is expected to own, then build the reporting around those decisions. That keeps Article 20 from becoming another compliance folder with no operating value.
If those six pieces exist, Article 20 becomes part of normal governance rather than a separate compliance ceremony.
Use these questions as a short readiness check before turning the gaps into a larger remediation plan:
The useful Article 20 test is simple: can management explain what cybersecurity measures it approved, what material risks remain, how it knows implementation is moving, and what it decided when something slipped? If the answer lives only in the security team, the governance chain is incomplete.
For organizations still assembling that chain, start with scope, Article 21 measures, management reporting, and training. Then keep the evidence as the decisions happen. That is easier to defend than rebuilding a year of governance shortly before an audit.
Turn management decisions into an evidence-backed compliance program
Q-Sec supports NIS2 scoping, gap analysis, implementation, evidence preparation, and audit readiness for European organizations.
Yes. Article 20 requires management bodies of essential and important entities to approve Article 21 measures, oversee implementation, and complete cybersecurity training.
The work can be delegated, but Article 20 keeps approval and oversight with the management body. A CISO can operate the program and advise management; management still owns its governance duties.
Article 20 requires Member States to make management bodies capable of being held liable for Article 21 infringements. The exact personal consequences depend on national law and are not uniform across the EU.
The Article 34 fine thresholds apply to entities. They are not automatic personal fines for directors. Personal liability must be assessed under the applicable national law.
Yes. Article 20 applies to management bodies of both essential and important entities. Some enforcement tools, including the Article 32(5) temporary management restriction, are specific to essential entities.
Yes. Management-body members must follow training. The Directive does not set a universal certificate, number of hours, or fixed EU-wide renewal schedule.
Article 20 requires oversight but does not set one EU-wide review cadence. The organization should define a cadence and escalation rules that fit its risk, changes, incidents, and national requirements.
Useful evidence includes formal approvals, oversight reports, risk decisions, remediation follow-up, and management training records. The Directive does not prescribe one universal document pack.