NIS2 board duties: what Article 20 requires from management, and when directors can be held liable

Under NIS2 Article 20, the management body of every essential and important entity must approve the Article 21 cybersecurity measures and oversee their implementation, and its members must follow training. The body can be held liable for the entity’s infringements of Article 21. In essential entities, a chief executive can, as a last resort, be temporarily barred from managerial functions.

This guide covers the three duties, who the management body is, whether approval can be delegated, when directors can be held liable, the temporary management ban, what national laws add, a board-pack template, what evidence of oversight looks like, and a checklist.

Duty or consequence	Source	Applies to	In practice
Approve the Article 21 measures	Art. 20(1)	Essential and important	A recorded decision on named documents and versions
Oversee their implementation	Art. 20(1)	Essential and important	Regular reporting, questions, actions followed up
Members follow training	Art. 20(2)	Essential and important	A training record for each member
Liability for infringements of Article 21	Art. 20(1)	Essential and important	Form and conditions set by national law
Liability of those who must ensure compliance	Art. 32(6), 33(5)	Essential and important	Form and conditions set by national law
Temporary ban from managerial functions	Art. 32(5)(b)	Essential only, not public administration	Last resort after a missed deadline
Maximum fines of at least €10M or 2% (€7M or 1.4%)	Art. 34	The entity, not its directors	Amounts set in national law

What are the board’s responsibilities under NIS2?

Article 20(1) is one sentence: “Member States shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article.”

Recital 137 gives the purpose: “a high level of responsibility” for the risk-management measures and reporting obligations. The duties are identical for essential and important entities; supervision and enforcement differ, as set out in NIS2 essential vs important entities.

Approve the Article 21 measures

The board approves the measures the entity takes to comply with Article 21: the ten minimum measures explained in NIS2 Article 21. Approval is not a rubber stamp. The directive does not say how often, but a policy set approved in 2024 and never reopened says little about today’s measures. A sensible approach is to re-approve after material change and at least yearly.

Oversee their implementation

NIS2 does not define “oversee”. In practice the board receives regular reports, asks whether the measures work, and follows up. Article 21(2)(f) already requires procedures to assess the effectiveness of the measures; their results are the natural input. If security staff raise concerns about unpatched systems or missing backups, act on them. A board that was told and did nothing is the hardest case to defend.

Follow training

Article 20(2) requires Member States to ensure that the members of the management bodies of essential and important entities “are required to follow training”, and to “encourage” entities to offer similar training to their employees “on a regular basis”, so that they gain “sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity”. NIS2 sets no syllabus, hours or frequency. Content, format and records are covered in NIS2 training requirements.

Who counts as the management body?

NIS2 does not say: none of the 41 definitions in Article 6 covers “management body”, so national law and your company form decide. In a one-tier company it is usually the board or the managing directors. In a two-tier structure, check whether your national law names the executive board, the supervisory board, or both.

For public administration entities, Article 20(1) applies without prejudice to national rules on the liability of public institutions, public servants and elected or appointed officials.

Can the board delegate NIS2 approval?

The directive does not address delegation expressly. The text still answers most of the question.

1. The duty sits with the management body. Article 20(1) addresses approval and oversight to the management bodies, and recital 137 repeats it. Nothing in Article 20 lets that body transfer the duty.
2. The work can be delegated. Risk analysis, policies, controls and reporting can sit with a CISO, IT or an external provider. The directive does not say who does the work.
3. Liability does not follow the work. Nothing in Article 20(1) suggests that handing implementation to a CISO moves the management body’s liability.
4. Committees are the open part. Whether a risk or audit committee can approve on the board’s behalf is not settled by NIS2. National law and company law decide.

A sensible approach is for a committee or the CISO to prepare and recommend, and for the full management body to take the decision and minute it.

When can directors be held liable under NIS2?

The directive has two routes.

Article 20(1): the management body. It “can be held liable for infringements by the entities” of Article 21. This covers the risk-management measures, not incident reporting under Article 23.

Article 32(6): natural persons. Any natural person responsible for, or acting as legal representative of, an essential entity, on the basis of the power to represent it, take decisions for it or control it, must have the power to ensure its compliance. Member States must make it possible to hold such persons liable “for breach of their duties to ensure compliance with this Directive”. Article 33(5) applies this to important entities. This route covers the whole directive, including incident reporting.

National law decides the form of liability, civil, administrative or other, and the standard of fault. “Can be held liable” is a possibility, not an automatic consequence of every gap.

For enforcement measures, Article 32(7), applied to important entities by Article 33(5), makes authorities weigh factors including seriousness, duration, damage caused, “any intent or negligence on the part of the perpetrator of the infringement”, mitigation and cooperation.

The Article 34 fines are imposed on the entity, not its directors: maximums of at least €10 million or 2% of worldwide turnover for essential entities, €7 million or 1.4% for important ones. Details in NIS2 administrative fines.

Can a CEO be banned under NIS2?

Yes, in an essential entity, at the end of a sequence set out in Article 32(5).

1. Earlier measures under Article 32(4), points (a) to (d) and (f), have been ineffective: warnings, binding instructions, orders to stop infringing or to comply with Articles 21 and 23, orders to implement audit recommendations.
2. The authority sets a deadline to remedy the deficiencies.
3. If it passes, the authority can temporarily suspend, or ask the relevant body to suspend, a certification or authorisation for the services, and request that the relevant bodies, courts or tribunals temporarily prohibit “any natural person who is responsible for discharging managerial responsibilities at chief executive officer or legal representative level” from “exercising managerial functions in that entity”.

The ban lasts only until the deficiencies are remedied and does not apply to public administration entities. Recital 133 calls it a last resort, to be applied proportionately and with the rights of defence respected. Article 33 gives no equivalent power for important entities.

What do national laws add?

Article 20 reaches directors only through national law. On 8 July 2026 the Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify full transposition of NIS2, so check that your law is in force before relying on its detail.

Luxembourg is an example of a law that goes further. Under Article 13 of its law of 5 May 2026, the management body approves the measures required by Article 12, the risk-management article, oversees them and can be held liable for breaches of Article 12. Its members must follow training regularly, and entities must offer regular training to staff, which the directive only encourages. More in the Luxembourg NIS2 law.

In your own law, look for the liability rule and who it names, any training frequency, and whether delegation is addressed.

What should a NIS2 board pack contain?

Enough for the board to approve and oversee, not merely note. A layout to copy:

NIS2 BOARD PACK (Directive (EU) 2022/2555, Articles 20 and 21)
Entity: ...........  Meeting date: ........  Category: essential/important

1. DECISIONS REQUESTED
   Approve or re-approve: document, version, what changed
   Risk acceptance: risk ID, owner, reason, review date
   Resources: budget or staffing request, and the risk it addresses

2. STATUS OF THE ARTICLE 21(2) MEASURES, (a) TO (j)
   Per measure: status, change since last pack, owner
   Open gaps: ID, severity, due date, overdue yes/no

3. EFFECTIVENESS, ARTICLE 21(2)(f)
   MFA coverage, administrative and remote access ..... %
   Critical patches applied within own deadline ....... %
   Last restore test: date, system, result
   Last incident exercise: date, findings, actions

4. INCIDENTS AND REPORTING, ARTICLE 23
   Significant incidents since last pack: count
   24-hour, 72-hour and one-month deadlines met: yes/no
   Near misses and lessons

5. SUPPLIERS, ARTICLE 21(2)(d)
   Critical suppliers: assessed, overdue, open issues

6. SUPERVISION
   Authority requests, audits, findings, deadlines

7. TRAINING, ARTICLE 20(2)
   Members trained: name, date, provider, content

8. ACTIONS FROM LAST MEETING
   Action, owner, due date, closed / open with reason

What does evidence of board oversight look like?

Articles 32 and 33 let the authority request documented policies and evidence of their implementation. For the management body, the evidence has to show decisions taken on adequate information, not attendance.

• The approval. Minutes naming the documents and versions approved, the date and who was present. “The board noted the security update” is not an approval.
• The information. The pack as it was on the day, kept with the minutes.
• The challenge. Questions asked and answers given, recorded in the minutes.
• The follow-up. Actions with owners and due dates, and the next pack showing them closed or explained.
• Risk acceptance. Decisions to accept a risk, with the reason and a review date.
• Training. A record for each member: date, provider, content.
• Escalation. When a significant incident happened, when the board heard about it, and what it decided.

What Article 20 leaves open

Article 20 says approve and oversee. It does not say on what information, how often, or against which measures. In that gap, boards end up overseeing a traffic-light slide prepared by the people being overseen. The slide can say MFA is complete while the identity provider still holds administrative accounts without it.

Closing it is a technical job. The figures in the pack should come from the systems that hold the truth, the identity provider, endpoint management, cloud accounts and ticketing, with a person reviewing exceptions before they reach the board. That is how the CloudSoul platform works: evidence collected automatically, with human-in-the-loop review.

Someone also has to own the pack and answer the board’s questions. In a company without a CISO, that is often a virtual CISO. The wider programme is on the NIS2 compliance page.

NIS2 board checklist

• Confirm which body is the management body under your national law.
• Record approval of the Article 21 measures, naming documents and versions.
• Set a reporting rhythm and triggers for escalating significant incidents.
• Put effectiveness figures drawn from systems in every board pack.
• Minute questions, decisions, owners and due dates, and close them next time.
• Record each member’s training: date, provider, content.
• Check your national law on liability, training frequency and delegation.
• Keep packs and minutes ready for an authority’s request.

Sources

• Directive (EU) 2022/2555 (NIS2), Articles 6, 20, 21, 32, 33 and 34, recitals 133 and 137, EUR-Lex. Article text: Article 20, Article 32, Article 33, Article 34, recitals 131 to 144.
• Luxembourg, Law of 5 May 2026 concernant des mesures destinées à assurer un niveau élevé de cybersécurité, Articles 12 and 13, Legilux; parliamentary file for bill 8364, including the report of the Commission des Institutions of 13 April 2026, Chambre des Députés.
• Commission refers Ireland, Spain, France and the Netherlands to the Court of Justice for failing to transpose NIS2, 8 July 2026, European Commission.

Frequently asked questions