Are managers personally liable under NIS2?
They can be, in the way national law sets out. Article 20(1) requires Member States to ensure that the management bodies of essential and important entities can be held liable for infringements of their duty to approve and oversee the cybersecurity measures. For essential entities, Article 32 also lets authorities, as a last resort, request a temporary ban on a person exercising managerial functions if ordered measures are not taken. How liability works in practice differs by country: Germany, for example, makes management liable to the company for culpably caused damage under the rules of company law (section 38(2) BSIG) and allows a temporary ban on unreliable managers of particularly important entities (section 61(9)). Check your national law, your directors' and officers' insurance, and keep minutes that show you approved and reviewed the measures.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- Is cyber security training mandatory for management under NIS2?
- What do board members have to approve under NIS2 Article 20?
- How can a managing director check that cyber measures actually work?
- Does NetSenX cover all NIS2 Article 21 measures?
- Does buying a security tool make us NIS2 compliant or registered?