NIS2 and the Board: Management Liability and Training Under Article 20

What Article 20 requires

Article 20 of NIS2 (Directive (EU) 2022/2555) sets three duties for the management bodies of essential and important entities:

Article 20(2) also requires member states to encourage entities to offer similar training to their employees on a regular basis. Management bodies "can be held liable" for infringements of Article 21 by the entity (Article 20(1)); national law sets the liability rules, and the provision does not affect national rules on the liability of public institutions and officials.

How personal liability works

Article 32(6) requires member states to ensure that any natural person responsible for, or acting as legal representative of, an essential entity has the power to ensure its compliance, and that such persons can be held liable for breach of their duties to ensure compliance. Article 33(5) applies the same rule to important entities.

The form of that liability, civil, administrative or otherwise, comes from national law. Check how your country transposed it.

Temporary bans for chief executives

For essential entities, Article 32(5) adds an escalation step. If earlier enforcement measures, such as binding instructions or orders to comply, are ineffective and the entity misses the deadline it was given, the authority can request a court or other body to temporarily prohibit any person discharging managerial responsibilities at chief executive or legal representative level from exercising managerial functions in that entity. The prohibition lasts only until the entity remedies the deficiencies, with procedural safeguards such as the right to an effective remedy. It does not apply to public administration entities.

Other enforcement the board should know

Besides fines (for essential entities a maximum of at least €10 million or 2% of worldwide turnover, for important entities at least €7 million or 1.4%), authorities can, among other things (Article 32(4) for essential entities):

• issue warnings and binding instructions with deadlines;
• order the entity to bring its Article 21 measures or Article 23 reporting into compliance;
• appoint a monitoring officer to oversee compliance for a set period;
• order the entity to make aspects of the infringement public.

A practical board routine

1. Once: approve the Article 21 measures by formal resolution, assign an accountable executive, and agree how often the board receives security reporting.
2. Every quarter: review a short report: top risks, progress on the remediation plan, significant incidents and how they were reported, critical supplier issues.
3. Every year: training for all management body members, re-approval of the measures after the annual risk review, and a test of the incident reporting process the board can watch.
4. After any significant incident: a board debrief on cause, reporting timeline and lessons learned.

Minutes matter: they are your evidence that the board approved and oversaw the measures.

Know your starting point: the free NIS2 Readiness Check includes governance and accountability as one of its nine domains.

Everything for the board meeting. The NIS2 Board Pack includes a board briefing deck, a board resolution template, a management liability summary, a quarterly cybersecurity report template, a compliance roadmap and a budget template.

Sources

• Directive (EU) 2022/2555 (NIS2), Articles 20, 32, 33 and 34, EUR-Lex

Related tools