NIS2 Article 20 puts personal liability on the management body. The CISO is rarely on the management body. The CISO is the person who ensures the management body's NIS2 compliance position is defensible, which is a different job from the one most CISOs were hired to do.
This piece is the precise scope of Article 20, who the management body actually is, what "liability" means in supervisory practice, and three protective actions for a CISO at a mid-market in-scope firm.
What Article 20 Actually Says
Article 20 of Directive (EU) 2022/2555 places the cybersecurity governance obligation on the management body of essential and important entities. Three operative requirements:
First, the management body must approve the cybersecurity risk-management measures taken by the entity to comply with Article 21. The approval is a formal act, not implicit acceptance of operational decisions. The supervisor will look for documentary evidence that the management body specifically signed off on the framework, and that sign-off is the foundation of any defensible NIS2 compliance posture.
Second, the management body must oversee the implementation of those measures. This is continuous, not point-in-time. The body cannot approve the framework in January and treat the obligation as discharged for the year.
Third, members of management bodies are required to follow training to gain sufficient knowledge and skills to apprehend and assess cybersecurity risks and management practices and their impact on the services provided by the entity. The training obligation is on the body, not on the CISO.
The Article also empowers member states, in their national transposition, to provide for management body members to be held liable for breaches of NIS2 cybersecurity obligations under Article 21 obligations. The exact form of that liability varies by member state, some transpositions create direct personal liability for breach, others create indirect liability through sanctions on the entity that the member state can extend to natural persons in defined circumstances.
Who Is The Management Body - and Where The CISO Fits
"Management body" is a term of art in EU corporate governance. It typically refers to the directors and senior executives with formal authority to bind the entity - at most mid-market firms, the executive committee or the board, depending on the firm's governance structure. The CFO and General Counsel are typically members. The CEO is always a member.
The CISO is rarely a member of the management body. CISOs at mid-market firms typically report into the COO, the CTO, or the General Counsel. They are functional leaders who carry the security risk-management responsibility but do not, in the formal corporate sense, sit on the management body.
This is the awkward shape of Article 20. The accountability is on the body. The expertise is in the function adjacent to the body. The CISO who reads the NIS2 requirements and concludes the obligation does not apply to them is technically correct and operationally wrong, because the management body's ability to discharge its Article 20 obligation depends almost entirely on what the CISO produces and how the CISO presents it.
What "Liability" Means in Practice
Two layers of supervisor power matter. Article 32 sets out the powers of the competent authorities in respect of essential entities, the supervisor can conduct on-site inspections, off-site supervision, request information, request access to documents, and where appropriate require the entity to remedy identified failures within a specified time. The Article 32 powers reach the entity directly; they reach natural persons through the entity's response and through the management body's accountability for that response.
Article 34 sets out the administrative fines. Essential entities can be fined up to €10 million or 2% of global annual turnover, whichever is higher. Important entities can be fined up to €7 million or 1.4% of global annual turnover. The fines are entity-level, but Article 32(5) allows the supervisor, where the management body of an essential entity has failed in its duties, to request the body to take specified action and, in the most serious cases, to suspend a natural person from exercising managerial functions in the entity until the breach is remedied.
The realistic exposure for a management body member at a mid-market firm is not a direct personal fine in the first wave of enforcement. It is reputational, a supervisor's finding naming the body's failure to oversee implementation, with the natural-person consequences (suspension, public identification) reserved for cases where the failure is repeated or wilful. The specifics depend on the member state's transposition; the trajectory across transpositions has been towards strengthening rather than softening the natural-person exposure, and the security compliance implications for management body members are materially different from what most boards have been advised.
Member-state implementation has varied. The transposition deadline was 17 October 2024, and several member states implemented later than that, the European Commission opened infringement proceedings against most member states in late 2024 for failure to transpose on time, and reasoned opinions followed in 2025. The natural-person liability provisions in particular vary across transpositions. The CISO operating across multiple member states should expect different exposures by jurisdiction.
Three Protective Actions
The CISO who carries the management body's defensibility has three operational priorities. None is exotic; all are routinely under-discharged.
- Document the management body's approval cycle for the cybersecurity risk-management framework. Calendar the annual approval, with formal sign-off recorded in the management body minutes. Calendar the quarterly review, with the CISO presenting the operating state of the framework against the approved measures. The supervisor will look for the paper trail; the paper trail is the management body's first line of defence.
- Build the management body training programme to discharge the Article 20 training obligation. A short structured curriculum, risk-management principles, the firm's specific obligation surface, incident response basics, supply chain risk, completed annually with a refresh on material change. Document attendance and completion. The training is on the body, not on the CISO; the CISO's role is to ensure the curriculum exists, the body completes it, and the records are kept.
- Surface the supply chain risk management visibility the management body needs to discharge its Article 21(2)(d) obligation. The supply chain measure under Article 21(2)(d) is the area where most management bodies are least equipped to oversee, because the underlying inventory is rarely complete. The CISO who builds the live supply-chain inventory and the renewal-cycle review process gives the management body something it can defensibly approve.
Management bodies rarely resist cybersecurity governance, they simply never understood their personal accountability was part of it. The framework gets approved when the CISO presents it. The quarterly update is received, noted, and moved past. The training is completed when the calendar requires it. None of that is negligence; it is the rational response of a body that was never informed it had personal skin in the game. NIS2 Article 20 changes the legal character of that engagement. It does not change the room. The CISO who understands this distinction has a different job to do. That means producing a framework the body understands it is personally accountable for defending. - Namita Razdan, Co-Founder, Montro |
The shift in the CISO role under NIS2 is real. The pre-NIS2 job was running NIS2 cybersecurity operations and producing the framework. The NIS2 job adds the responsibility of producing the framework in a form that the management body can demonstrably oversee, with the body's fingerprints on it, repeatedly, on a documented cadence that satisfies NIS2 requirements. The framework that satisfies the supervisor has the body's fingerprints on it, repeatedly, on a documented cadence.
Frequently Asked Questions
Does NIS2 Article 20 apply to private companies or only public bodies?
Article 20 applies to all essential and important entities in scope of NIS2, both public and private. The management body accountability obligation sits on the entity regardless of ownership structure.
What happens if a management body member is suspended under NIS2?
Article 32(5) allows the competent authority to request suspension of a management body member from exercising managerial functions until the breach is remedied. This power is reserved for cases where the management body has demonstrably failed its oversight duties, but it is a live supervisory tool, not a theoretical one.
How does NIS2 Article 20 interact with Directors and Officers insurance?
D&O policies vary significantly in how they treat regulatory liability. Some exclude fines and penalties entirely; others cover defence costs but not sanctions. A management body member relying on D&O cover for NIS2 exposure should verify specifically whether the policy covers personal supervisory consequences, not just civil claims.
Do NIS2 personal liability provisions vary by member state?
Yes, materially. Transposition has differed across member states, and the trajectory has been toward strengthening rather than softening individual management liability consequences. Firms operating across multiple member states should model the strictest applicable jurisdiction, and build their security compliance programme to that standard rather than assuming a uniform floor applies.
