What is the liability of management under NIS2?

What Article 20 of the NIS2 Directive states

Article 20 of Directive (EU) 2022/2555 is short, but it changes the nature of cybersecurity in the company. It sets out three obligations for the 'management bodies' of essential and important entities:

1. Approve the cybersecurity risk management measures taken by the entity (those in Article 21).
2. Supervise their implementation.
3. Undergo training on a regular basis to acquire sufficient knowledge to identify risks and assess risk management practices; the directive encourages offering similar training to employees.

The same article specifies that management bodies 'may be held liable' for violations of these obligations. The term 'management bodies' refers, depending on legal forms, to the board of directors, the management board, the chairman, the chief executive officer or the managers. In other words, cybersecurity ceases to be a matter delegated to the IT department to become a governance issue, on the same level as financial compliance.

For details of the technical requirements expected, see our fact sheet on the NIS2 Directive and the definition of NIS2 in our glossary.

Which sanctions personally target management?

The directive distinguishes two levels.

Sanctions against the entity (Article 34):

Measures against natural persons (Article 32, paragraph 5, for essential entities): if the authority's injunctions remain without effect within the set deadline, it may request that a temporary ban on exercising management functions be pronounced against any natural person exercising managerial responsibilities at the level of chief executive officer or legal representative, until the entity achieves compliance. The authority may also temporarily suspend a certification or an operating authorisation.

To this is added common law: management fault in the event of manifest security failure may engage the civil liability of the manager vis-à-vis the company and third parties, and a cyberattack having resulted in a personal data breach simultaneously exposes the entity to GDPR sanctions (up to 4% of global turnover).

What is the status of the French transposition of NIS2?

France was required to transpose the directive before 17 October 2024. The draft law 'relating to the resilience of critical infrastructures and the strengthening of cybersecurity', known as the French Resilience Act, transposes NIS2, DORA and the REC directive in a single text. It was adopted by the Senate on 12 March 2025 then by the special committee of the National Assembly on 10 September 2025, unanimously.

In the meantime, the French cybersecurity agency (ANSSI) has already opened the MonEspaceNIS2 platform (pre-registration since 24 November 2025) and published the French Cyber Reference Framework (ReCyF), which details the expected technical requirements. The French cybersecurity agency (ANSSI) estimates between 15,000 and 18,000 the number of entities concerned in France, compared with approximately 500 under NIS1, and has announced a progressive compliance ramp-up over approximately three years after the publication of the technical requirements. This transitional period does not suspend the governance obligation: it is precisely during these three years that the manager must demonstrate that they are steering.

How does the manager demonstrate that they have fulfilled their obligations?

NIS2 liability hinges on evidence. A director who can produce the following five elements is in a defensible position before the authority and before a judge.

1. A formal approval decision for the security policy and risk management plan: board minutes, resolution, or dated and archived decision of the president.
2. A recurring cybersecurity item on the agenda of the management body (at least quarterly), with a dashboard: incidents, open critical vulnerabilities, plan progress, audit results.
3. A training certificate for the director(s), renewed periodically, covering risks, NIS2 obligations and crisis management.
4. A named organisation: a security officer (internal CISO or outsourced) with a letter of appointment, resources and direct access to management.
5. A tested notification chain: who decides to notify the French cybersecurity agency (ANSSI), within what timeframe, with what information, and a crisis exercise conducted within the year.

None of these elements requires technical expertise. They require having organised, funded and monitored.

The most common mistakes observed among directors

• Waiting for the decrees: the content of the obligations has been known since 2022; only the procedures and control schedule remain to be specified. Waiting works against the director, as it documents inaction.
• Delegating without supervising: entrusting the matter to the IT department or a service provider without formal reporting does not satisfy the supervision obligation.
• Believing oneself to be out of scope: an SME of 50 employees in a sector in Annex II is an important entity; a subcontractor of an essential entity may be subject by contract to equivalent requirements.
• Confusing insurance and compliance: a cyber insurance policy does not exempt from the responsibility of governance and many insurers now make the coverage conditional on Article 21 measures.
• Forgetting the dual exposure: a security incident often triggers both NIS2 (notification to the French cybersecurity agency (ANSSI)) and GDPR (notification to the French data protection authority (CNIL) within 72 hours).

Where to start this week

1. Check your organisation's status (essential, important, out of scope) with the 5-question test.
2. Add a NIS2 item to the next agenda of the management body and have the launch of a diagnostic formally recorded.
3. Appoint a person responsible, internal or outsourced, with a letter of appointment.
4. Schedule a 2 to 3-hour directors' training within the quarter.
5. Complete the NIS2 self-assessment to obtain an overview of the 10 Article 21 measures.

Sources

• Directive (EU) 2022/2555 of 14 December 2022 (NIS2), Articles 20, 21, 23, 32, 33 and 34, EUR-Lex.
• Draft law on the resilience of critical infrastructures and the strengthening of cybersecurity, legislative file, Senate and National Assembly.
• ANSSI, MesServicesCyber, 'Directive NIS 2' and Référentiel Cyber France (ReCyF).