NIS 2 and management bodies: approval, training and personal liability
Article 20 of Directive (EU) 2022/2555 (NIS 2) gives the management bodies of essential and important entities three duties: approve the cybersecurity risk-management measures the entity takes to comply with Article 21, oversee their implementation, and follow training. It adds that management bodies "can be held liable for infringements" of Article 21. How that liability works, and before which court or authority, is set by each Member State's transposition law; the directive fixes only a floor, plus specific powers over the managers of essential entities. In practice, three governance habits and one board pack cover the EU layer: a recorded approval, a regular review and a documented training.
What Article 20 says
Article 20(1) requires Member States to ensure that management bodies "approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article". For public institutions, public servants and elected or appointed officials, national liability rules apply. Article 20(2) requires members of management bodies to follow training, and asks Member States to encourage entities to offer similar training to employees on a regular basis, so that they gain "sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity". Recital 137 explains the intent: a high level of responsibility at the level of the entity itself.
The directive does not define "management body": national company law determines which body runs the entity, for example a board of directors, an executive board or a sole manager. The duties are the same for essential and important entities; supervision differs, as explained in NIS 2: essential vs important entities.
Approve: what the board actually signs
Approval is a decision recorded in the minutes, not an email from the IT department. It should cover, by name and date:
- the scope and classification reasoning (essential, important or out of scope);
- the information security policy;
- the action plan built on the ten measures of Article 21(2), with owners, dates and the budget;
- the incident procedure, including who decides that an incident is significant and sends the 24-hour early warning;
- the appointment of a lead for NIS 2 and a deputy.
A useful sentence for the minutes is one that mirrors the directive: the management body approves the cybersecurity risk-management measures presented and will oversee their implementation. Attach the documents approved, with their version numbers.
Oversee: the quarterly cyber review
The directive sets no frequency. A quarterly item on the management agenda is a workable rhythm, with a fuller annual review; choose your own and keep to it. A short slot is enough if the pack is prepared in advance:
- Compliance rate by domain and its trend since the last review.
- Priority gaps: what was closed, what is late, what needs a decision.
- Incidents of the period, and whether the Article 23 deadlines were met.
- Supplier issues and contract renewals with security impact.
- Decisions taken, with owner and date, recorded in the minutes.
Oversight leaves evidence only if the minutes show questions and decisions. Article 21(2)(f) separately requires procedures to assess the effectiveness of the measures; the quarterly review is where their results are discussed. To produce the compliance rate, see NIS 2 gap assessment template.
Train: content and proof
Article 20(2) defines the goal of the training, not its length or provider. A first session can cover the threats relevant to the entity's services, the obligations of the directive and of national law, the incident clock, the measures in place and the main gaps, and the role of each board member during a crisis. Keep proof: the date, the attendance list signed by each member, the material, and a planned refresher. New members of the management body need the same training when they join.
Liability as transposed by Member States
The directive layers several provisions. National law then decides the nature of the liability, the procedure and the sanctions; recital 128 states that the directive does not require Member States to provide for criminal or civil liability of these natural persons for damage suffered by third parties.
| Provision | What it says | Essential entities | Important entities |
|---|---|---|---|
| Article 20(1) | Management bodies can be held liable for infringements of Article 21 by the entity | Yes | Yes |
| Article 32(6) | Natural persons responsible for, or legal representatives of, the entity must have the power to ensure compliance, and it must be possible to hold them liable for breach of their duties to ensure compliance | Yes | Yes, through Article 33(5) |
| Article 32(5)(b) | If earlier enforcement measures are ineffective and a deadline is missed, a temporary prohibition on any person with managerial responsibilities at chief executive officer or legal representative level from exercising managerial functions, until the entity complies | Yes, except public administration entities | No |
| Article 34(4) and (5) | Fines on the entity for infringements of Article 21 or 23: maximum of at least EUR 10,000,000 or 2% of worldwide annual turnover (essential), EUR 7,000,000 or 1.4% (important), whichever is higher | Yes | Yes |
The national layer is moving. In France, the National Assembly's legislative file, consulted on 20 October 2026, showed the transposition bill adopted by the Senate on 12 March 2025 and by the Assembly's special committee on 10 September 2025, with no plenary vote and no promulgated law. The European Commission's transposition page, last updated on 1 July 2025, records a reasoned opinion sent on 7 May 2025 to 19 Member States, France among them. Check the law of each country where you operate before describing liability to your board.
A board pack template (fictitious)
One memo of one page, three attachments. The figures below are fictitious.
| Section | Fictitious content |
|---|---|
| 1. What applies to us | Manufacturing sector (Annex II), important entity by self-assessment; national law: status checked on the date of the memo |
| 2. Where we stand | Self-assessment: compliance rate 54%, 6 priority gaps, 2 domains in red (continuity, supply chain); 1 significant incident in the last twelve months |
| 3. What we propose | 90-day plan: MFA on all remote access, an offline backup copy, the incident procedure, board training, security clauses for the five most critical suppliers; 25 internal days and EUR 18,000 of external spend |
| 4. Decisions requested | Approve the security policy; approve the plan and its budget; confirm the lead and deputy; schedule the quarterly review and the training date |
| 5. Risks if we do not act | Business interruption, data loss, customer and insurer requirements, supervisory measures and fines once national law applies |
| Attachments | One-page dashboard, extract of priority actions, draft security policy |
The same structure works for an essential entity; the evidence simply needs to be ready before any inspection, because supervision there does not wait for an incident. The full list of obligations is in the NIS 2 compliance checklist.
FAQ
Can the board delegate NIS 2 to the IT director?
It can delegate the work, not the approval. Article 20(1) places approval and oversight on the management body itself, and Article 20(2) requires its members to follow training. Appointing a lead with a written mission helps, provided the board decides on the measures and reviews progress.
Does NIS 2 make directors personally liable for cyber attacks?
Not for the attack as such. The directive provides that management bodies can be held liable for infringements of Article 21, and that responsible natural persons can be held liable for breach of their duties to ensure compliance (Article 32(6)). Recital 128 adds that it does not require criminal or civil liability for damage to third parties; national law decides the rest.
How long should management training last?
The directive does not say. It sets the objective: enough knowledge and skills to identify risks and assess risk-management practices and their impact on the services provided. Keep the attendance record and plan refreshers.