# Are managing directors personally liable under the German BSIG?

Yes, towards the company, under the rules of company law. Section 38(1) of the BSIG obliges the management of particularly important and important entities to implement the risk-management measures of section 30 and to monitor their implementation. Under section 38(2), managers who breach these duties are liable to their entity for culpably caused damage according to the company-law rules that apply to its legal form; only where company law contains no such rule does the BSIG itself provide the liability. For a GmbH or an AG, that means the familiar standards of a diligent manager. In addition, for particularly important entities, the supervisory authority can, as a last resort, temporarily prohibit unreliable managers from exercising their function if BSI orders are not followed (section 61(9)). Document approvals, reviews and training, and check whether your D&O insurance covers these claims.

General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.

FAQ: [Germany: BSIG](https://netsenx.com/en/faq/germany) · https://netsenx.com/en/faq/are-german-managing-directors-liable-under-the-bsig

## Read next

- https://netsenx.com/en/blog/2026-11-07_nis2-germany-bsig
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Must management in Germany attend cyber security training under the BSIG?](https://netsenx.com/en/faq/must-german-management-attend-cyber-security-training)
- [What does the BSI do after we submit an incident report?](https://netsenx.com/en/faq/what-does-the-bsi-do-after-we-submit-a-report)
- [Do banks and other DORA financial entities in Germany follow the BSIG duties?](https://netsenx.com/en/faq/do-dora-financial-entities-follow-the-bsig-duties)
- [Can the BSI audit our company?](https://netsenx.com/en/faq/can-the-bsi-audit-our-company)
- [Where are NIS2 incidents reported in Germany?](https://netsenx.com/en/faq/where-are-nis2-incidents-reported-in-germany)