Article 20(1) NIS2 management body liability: requirements

How NIS2 makes management bodies answerable for cybersecurity failures

Under Article 20(1) of NIS2, Member States can hold the management body of an essential or important entity liable when the entity infringes the Article 21 risk-management measures. The duty does not sit with a security team or a single officer. It sits with the people who approve budgets, appoint leaders and set strategy, and it is applied through each country's transposition law, so the exact exposure depends on where the entity operates. There is no NIS2 certificate of compliance, so no document lets a board show that it is covered. Liability follows from what the authority finds when it inspects or audits the entity.

The risk this provision addresses is a governance gap: basic controls such as patching, access reviews, backups or supplier checks lapse quietly because no one with authority notices they have stopped. The difficulty is that accountability sits with people who rarely run controls day to day. A board can receive a green status slide and still be unable to show it asked what the measures cover, who owns them and how gaps are closed. Article 20(1) therefore rewards evidence of oversight, not evidence of technical work performed by someone else.

Start by confirming, with counsel or your national competent authority, how your Member State has transposed Article 20(1) and whether public administration rules apply to your entity. Then ask management to name the owner of each Article 21 measure and to record how it reviews progress. Finally, decide what the board will keep and what it will outsource: an implementation partner can prepare systems, policies and evidence, but the management body must still approve the measures and remain answerable for them.

Which entities, people and decisions fall under management liability

Management liability under NIS2 attaches to specific entities and to specific people inside them, and the answer changes with classification, group structure and national law. The cards below are decision points to settle before scoping the work, because each one changes who is answerable and which regime applies.

Essential entities and their management bodies

Article 20(1) makes the management bodies of essential entities answerable for infringements of the Article 21 risk-management measures. Essential entities also face ex ante supervision, so authorities can review compliance before an incident occurs. Confirm the entity's classification under Article 3 with counsel, then map which board or executive committee formally holds the approval and oversight role for the measures.

Important entities and ex post supervision

Management bodies of important entities carry the same Article 20(1) exposure for Article 21 infringements, but supervision runs ex post, usually triggered by evidence, incidents or complaints. Ask whether the entity's records would show a documented board decision on the risk-management measures at the time of any later review, because that record is often what supervisors request first.

Natural persons who represent or control

Article 32(6) reaches natural persons who represent the essential entity, take decisions on its behalf or control it, provided they hold the power to ensure compliance. Article 33(5) applies the same logic to important entities. Map every such person, including those with delegated authority or significant shareholding control, because the duty follows the power to act, not only the job title.

Group structures and parent undertakings

In corporate groups, the question is which legal entity is the regulated one and which people sit in its management body. A parent company's board may direct the group's security program while the subsidiary that provides the in-scope service holds the legal duty. Document the reporting lines and confirm with the national authority or counsel how the group structure maps to the entity's obligations.

Member State transposition and national rules

NIS2 is a directive, so personal exposure depends on how the Member State where the entity is established transposed Article 20 and Article 32(6) into national law. Some states may add rules that Article 5 allows. Confirm the transposing law, the competent authority and any national procedures before assuming the EU text alone governs the people in scope.

Public administration bodies

The temporary suspension and prohibition measures in Article 32(5) do not apply to public administration entities, and Article 20(1) preserves national liability rules for public institutions, public servants and elected or appointed officials. Public bodies should confirm with their national authority which liability regime applies to their officers, since the answer is set nationally rather than by the directive.

How supervisors escalate from fines to a temporary ban

Essential entities face ex ante supervision, which means authorities can act before an incident occurs. The escalation path is graduated. Supervisors begin with lower-level enforcement measures, and only if those fail can they move to the most severe personal consequence in NIS2: a request that a person with managerial responsibility be temporarily prohibited from exercising managerial functions in the entity. Under Article 32(5)(b), that request can target a chief executive officer or legal representative level of management, and it is only available once earlier measures have not produced compliance.

Trigger: earlier enforcement measures against the entity must have failed before a temporary ban can be requested.
Who can be targeted: persons with managerial responsibilities at chief executive officer or legal representative level.
Duration: the suspension or prohibition lasts only until the entity remedies the deficiencies identified.
Safeguards: the measure carries the right to an effective remedy and the presumption of innocence.
Public administration: the suspension and prohibition measures of Article 32(5) do not apply to public administration entities.

Check with counsel how your national transposition law implements the escalation steps, since the Directive sets the framework and Member States define the procedure.

How a supervisor tests management accountability

This table compares what a national competent authority checks, the evidence it asks for, and the findings that commonly appear when testing the management body's duty under Article 20(1). Read each row as a question a supervisor may put to the board and its legal representatives, with the records that answer it. The main takeaway is that the test looks at what management decided and did, not only at whether a policy exists.

Supervisory test	Evidence requested	Common findings
Did management approve the Article 21 measures?	Board or management minutes showing approval of the cybersecurity risk-management measures, with the approved version and date	Policies signed by IT or security staff only, with no record that the management body reviewed them
Do members understand the measures they approved?	Briefing papers, risk summaries, and records of questions raised and answered at management meetings	Approval recorded in minutes, but no evidence that members could explain the main risks or the measures in place
Do named individuals hold the power to ensure compliance?	Governance chart, delegations of authority, and role descriptions for chief executives and legal representatives	Accountability assigned to a security function with no mandate, budget or reporting line to the management body
Do records show decisions, risk acceptance and escalations?	Decision logs, risk acceptance forms signed by an accountable manager, and escalation records from security incidents or audit findings	Risks accepted informally, or significant findings never reported to the management body
Is the entity remedying deficiencies it has identified?	Remediation plans with owners and dates, status reports to management, and evidence that closed items were verified	Open findings carried over from earlier inspections or scans with no revised plan
How does the authority gather the evidence?	Inspections, security audits, security scans and written information requests issued by the national competent authority	Entity relies on a certificate or audit report as proof, which NIS2 does not create

Steps to make management liability defensible

This sequence shows a supervisor that the management body knew which Article 21 measures applied, approved them, kept the power to act, and reviewed them on a schedule. Each step leaves a record that can be produced during an inspection or after an incident.

Map management responsibility and legal power to act
Start by listing every natural person who represents the entity, takes decisions for it, or controls it, including the chief executive officer and the legal representative. For each person, record the decisions they can make on cybersecurity budget, staffing, supplier selection and risk acceptance, and whether they can direct the teams that run security. Article 32(6) ties liability to the power to ensure compliance, so this map is the basis for every later step. The output is a signed responsibility matrix that names the roles, the powers and the gaps. It is done when the legal representative and the board chair have confirmed it in writing, and a supervisor can see who could have acted.
Document management approval of Article 21 measures
Present the entity's cybersecurity risk-management measures to the management body in a form members can read and discuss, covering the scope of systems, the identified risks and the measures chosen to address them. The body then approves the measures by a recorded decision, with the date, the attendees and the version of the policy set approved. Article 20(1) makes approval part of the duty, so an unrecorded or informal agreement is weak evidence. The output is board or executive minutes with the approved document reference and version. The step is done when the minutes and approved documents are stored in the governance record and can be retrieved for a supervisor.
Set reporting lines to the management body
Define how security information reaches the management body: which metrics, how often, from which owner, and what triggers an out-of-cycle briefing, such as a significant incident or a major change in risk. Set the escalation path from the security function to the legal representative and confirm who receives reports when the chief executive officer is unavailable. Implementing Regulation (EU) 2024/2690 expects the entity to show how governance information flows, so the reporting design should be written down rather than left to habit. The output is a reporting standard and a calendar of briefings. It is done when the first briefing has been delivered against that standard and the minutes show the body reviewed it.
Record risk acceptance decisions
Where the entity decides not to fully mitigate a identified risk, the decision must be made by a named person with authority, recorded with the reasoning, the residual risk, the compensating controls and a review date. Record acceptance separately from ordinary exceptions so a supervisor can see that the management body, not an operational team alone, accepted the residual exposure. Ask counsel to confirm which acceptances need board-level sign-off under national law and the entity's own articles. The output is a risk acceptance register with signed entries. The step is done when each open exception has an accepting owner who has the authority recorded in step one.
Assign an owner to each measure
Assign one accountable owner to each Article 21 measure, with a named deputy and a clear statement of what the owner must deliver. Owners should sit in functions that can act on the measure, and the management body should confirm the assignments. Where a measure is delivered by an outsourced provider, the owner remains accountable inside the entity, and the contract and supplier oversight belong to that owner. The output is a measure ownership register linked to the approved policy set and the responsibility matrix. It is done when every measure has an owner, every owner has accepted the role in writing, and no owner is also the sole reviewer of their own work.
Schedule and record management review
Set a recurring management review of the Article 21 measures, with an agenda that covers status against each measure, open risk acceptances, incidents and near misses, audit or scan findings, and changes to the entity or its threat picture. Keep the review calendar fixed in advance and record decisions, actions and deadlines in the minutes. Ask advisers to confirm the review frequency that national transposition law and the entity's supervisor expect, since the frequency is not fixed by the researched facts. The output is an annual review plan and the minutes of each review, with actions tracked to closure. The sequence is complete when a supervisor can trace a finding from the review minutes through to the owner's remediation record.

Evidence that shows the board is in control

Article 20(1) makes management bodies answerable for Article 21 infringements, so the evidence has to show who decided what, when, and on what information. The six artifacts below connect: policy approval sets the baseline, minutes and reporting packs show oversight, and the risk and escalation records show what happened when something went wrong.

Approved governance policy with approval record

The cybersecurity risk-management policy, with its version history and a dated record of the management body's approval. Check that the approval names the body, not only a committee, and that it covers the Article 21 measures in scope. Re-approve after material changes to scope, architecture or key personnel, and keep the superseded versions. Assessors will ask whether the approver had the information needed to decide, so keep the summary paper that accompanied the approval.

Management body minutes on cyber risk

Minutes that record the management body reviewing cyber risk, not just receiving a status line. Each minute should show the agenda item, the materials reviewed, the questions asked and the decisions or instructions given, with follow-up owners. Attendance and any recusal should be recorded. Between audits, schedule the cyber item at a fixed cadence and check that minutes reflect actual discussion, since an empty or copied item is the first thing a supervisor will question.

Register of accepted risks with named owners

A register listing each risk the entity has chosen to accept rather than treat, with a named individual owner, the rationale, the approving authority and a review date. Acceptances above the entity's risk appetite should reach the management body by name. Review the register when controls change or incidents occur, and remove acceptances that have expired. Ask whether any accepted risk relates to a supplier or an outsourced service, since those often sit with no internal owner.

Reporting packs on Article 21 measure status

Periodic reports to the management body showing the status of each Article 21 measure, the metrics used, open gaps and the trend since the last report. A useful pack states what is not working, not only what is green. Keep each pack with the data extract behind it so the figures can be reproduced. Confirm the cadence with leadership and agree which metrics come from tooling that the organization runs itself, such as patch currency or access review completion.

Escalation records and decision trail

Records showing that significant cyber risks and incidents reached the right managers in time, with timestamps, the recipient, and the decision taken. Keep the escalation criteria in writing and test them against past events. Where an incident triggered a reporting obligation under Article 23, the escalation record should show when management was informed relative to the reporting clock. Gaps between the criteria and what actually happened are the findings to fix first.

Delegation and authority to act

Written evidence that named managers hold the authority and resources to enforce the Article 21 measures, such as board resolutions, delegation letters, role descriptions and budget approvals. Under Article 32(6) and Article 33(5), liability attaches to natural persons who represent, decide for or control the entity, so the record must match who actually holds those roles. Update the records on every appointment, departure or reorganization, and confirm that the legal representative listed in filings matches the internal record.

What meeting Article 20(1) costs in money and management time

This table lists the cost components of meeting Article 20(1) liability duties, who is paid for each, whether the cost is one-time or recurring, and what drives it up. No figures are supplied for these components, so use the last column to decide what a written quote must state. The main takeaway is that most of the cost is management time and recurring reporting, not a single external fee.

Cost component	Who bears or is paid	One-time or recurring	What drives the cost
Legal review of liability exposure	Outside counsel or in-house legal, paid by the entity	One-time, then revisited when national transposition or scope changes	Number of Member States where the entity operates, sector rules, and whether it is essential or important
Governance policy drafting	Security or compliance staff, plus outside advisers if engaged	One-time drafting, recurring review	Number of Article 21 measures documented, existing policy maturity, and how many approval cycles are needed
Management time for reviews and approvals	Management body members, paid through existing salaries but drawn from their working time	Recurring, usually tied to the review cycle set by the entity	Frequency of meetings, size of the board, and how much briefing is needed before each decision
Reporting pack preparation	Internal security or risk team, or an implementation partner preparing material	Recurring, at each board or committee reporting cycle	Volume of incidents, number of open risks, and the level of detail the board requires
Risk register upkeep	Internal risk owners, with tooling costs where a platform is used	Recurring, with a larger initial build	Number of systems in scope, the rate of change in the environment, and risk acceptance workflow
External advisory or independent review	Consultants or independent reviewers, paid by the entity under a written scope	Usually one-time for a readiness review, optional recurring for periodic checks	Scope of the review, the number of entities in a group, and whether findings must be re-tested
Directors and officers insurance discussion	Insurance broker and the entity's finance or legal team	Recurring premium decision, with one-time coverage review	Claims history, jurisdictions of directors, and the terms the insurer applies to regulatory fines and defense costs

Where management liability usually breaks down

Article 20(1) makes the management body answerable for Article 21 infringements, so the weak points are rarely technical. They sit in approvals that never turn into oversight, in decisions nobody recorded, and in authority that is assumed rather than written down. The cards below cover the gaps supervisors most often find and the closing action for each.

Policy approved, status never reviewed

The board signs off the cybersecurity policy once and then hears nothing about whether the measures behind it work. Article 20(1) liability attaches to the infringement itself, so an approval with no follow-up is weak evidence of oversight. Close the gap by putting a standing item on the board agenda, with a short status report per Article 21 measure showing owner, current state and open gaps. Ask whether minutes record the discussion, not just the attendance.

No named owner for security spend

When security budget is split across IT, operations and finance, nobody can say who approved a shortfall or who accepted a delayed control. Supervisors look for a person with the power to fund the measures the entity has committed to. Close the gap by naming one accountable executive for the security budget in a board resolution, and by requiring that any deferral of an approved measure goes to that person in writing.

Risk acceptance made informally

Decisions to live with a known weakness often happen in a hallway, a ticket comment or a meeting without minutes. Later, the entity cannot show that a responsible person knew the risk and chose to carry it. Close the gap with a written risk acceptance form that states the risk, the business reason, the compensating controls, the approver's name and role, and an expiry date that returns the decision to management.

Delegation to a CISO without documented power

Management often hands security to a CISO or security officer in practice while the mandate exists only in a job title. If the CISO cannot stop a risky change, buy a tool or require a fix, the delegation may not show that the person had the power to ensure compliance. Close the gap with a written mandate that sets out decision rights, escalation paths and the CISO's direct line to the management body, reviewed when the role or structure changes.

Unclear decision rights across group entities

In groups, a parent may set policy while a subsidiary operates the systems and reports incidents. If it is unclear which entity's management body approves measures and carries liability, the gap can leave a covered entity with no one clearly responsible. Close the gap by mapping, for each in-scope entity, who approves policy, who funds controls and who signs incident reports, and by recording that mapping in intra-group agreements.

Findings closed without remediation evidence

Internal audits, penetration tests and vulnerability reviews often produce findings that are marked resolved without proof. Management then cannot show that it acted on what it knew, which weakens any defense under Article 20(1). Close the gap by requiring each finding to carry a remediation record with the fix, the retest result and the approver, and by reporting open high-severity findings to the board until they are verified closed.

What management must keep in-house and what can be outsourced

Under Article 20(1), the management body remains answerable for the entity's Article 21 infringements, so the decisions themselves cannot move to an outside party. The board or equivalent body must approve the risk-management measures, accept residual risk, decide how much budget and staff the program receives, and accept or reject exceptions. An implementation partner can shape these decisions but cannot make them, and its name should not appear as the approver in any policy or minute. Before engaging anyone, management should confirm in writing which named individuals sign each approval and who holds the authority to accept risk on the entity's behalf.

Partners can prepare much of the groundwork. Typical deliverables include a gap analysis against the Article 21 measures and the requirements of Implementing Regulation (EU) 2024/2690, draft policies for management to review, evidence packs showing how each control operates, reporting templates for briefing the board, and a risk register that the executive team can challenge. The NIS2 Directive page on the European Commission's digital strategy site is a useful starting point for confirming which obligations apply to the entity. Management should ask for these items as named deliverables in the written scope, with a reviewer and an acceptance step for each.

The work that stays with the organization is the part a regulator will test: showing that the board actually reviewed the material, asked questions, and tracked remediation over time. Minutes, decision logs and dated approvals are the evidence of that oversight, and they must be produced by the entity itself. Any engagement with an outside advisor should state that the advisor does not issue certificates or attestations, since NIS2 creates no certificate of compliance. Legal advice on personal liability should come from the entity's own counsel, and the scope should say so explicitly.

Questions buyers ask about NIS2 management liability

Can directors be personally fined under NIS2?

NIS2 does not set a fine against a director for an Article 21 failure in the way it sets fines against the entity, but the Directive allows management bodies to be held liable for the entity's infringements of Article 21 (Article 20(1)). Article 32(6) adds that natural persons who represent, take decisions for or control an essential entity must have the power to ensure its compliance and can be held liable for breaching that duty, and Article 33(5) applies the same logic to important entities. How this becomes a personal financial penalty depends on how each Member State transposed these rules. Confirm with national counsel which regime applies to your entity and which personal liabilities already exist under national company law.

What triggers the temporary ban on managerial functions?

The temporary ban is a last-resort measure against essential entities. It becomes available only when earlier enforcement measures against the entity have failed, and the competent authority then may request that a person with managerial responsibility at chief executive officer or legal representative level be temporarily prohibited from exercising managerial functions in that entity (Article 32(5)(b)). The ban lasts only until the entity remedies the deficiencies, and it is subject to procedural safeguards, including the right to an effective remedy and the presumption of innocence. The measure does not apply to public administration entities. Read the national law that implements these rules, since the procedure and the authority's powers are set nationally.

Does hiring a consultant reduce personal exposure?

A consultant does not transfer the duty. The management body remains responsible for approving the Article 21 measures and overseeing their implementation, and an outside party cannot take that role on its behalf. What a consultant or implementation partner can do is prepare the systems, policies, risk assessment and evidence that let the board make informed decisions and show that it exercised oversight. Documented board approval, regular reporting and recorded decisions on risk acceptance are what supervisors and courts are likely to look for. Ask any advisor to state in writing what it delivers and what remains with management, and confirm the effect on personal liability with national counsel.

How much management time does the oversight duty take?

The time depends on the entity's size, sectors, number of suppliers and how mature its security program already is. NIS2 does not set an hour count for board members. In practice, the recurring work includes reviewing the risk assessment and risk treatment plan, approving the required policies, receiving security reporting, deciding on risk acceptance and checking that incidents and the 24-hour, 72-hour and one-month reporting steps are handled. Mandatory cybersecurity training for management body members is a separate duty under Article 20(2). Ask your advisor for a board calendar and a written list of decisions the board must take each year, so the time commitment is visible before work starts.

Can a vCISO carry the management body's responsibility?

No. A virtual chief information security officer can run the security program, prepare reports and coordinate implementation, but the legal duty to approve and oversee the Article 21 measures stays with the management body and the legal representatives. A vCISO can make that oversight practical by setting the agenda, drafting decision papers and tracking open actions. The engagement should state who reports to the board, how often, and which decisions the vCISO prepares but does not make. Confirm with national counsel whether a named security officer must hold any specific role under your national law.

Can we keep the NIS2 work in-house?

Yes, an entity can run its own NIS2 program if it has staff with the skills and time to deliver the Article 21 measures, the policies, the evidence and the reporting process. The question is capacity and continuity, not legality. Most organizations keep decisions, risk acceptance and accountability in-house and outsource specialist work such as technical hardening, security testing, evidence preparation or 24/7 monitoring. An implementation partner such as DeployOpen can plan, implement and document self-hosted open-source platforms in your own infrastructure under a written, fixed scope, but it does not issue audit reports or certifications, and the entity still owns its controls.

How long does preparing for management liability take?

The duration depends on the starting point, and no fixed timeline is supplied for this work. An organization with a documented risk assessment, approved policies and an incident process needs less time to show board oversight than one starting from nothing. Preparation usually covers forming a governance structure, documenting board approval, scheduling oversight reporting, and completing the required management training. Ask any advisor for a written plan with milestones and dependencies, and ask your national authority or counsel for any transposition deadlines or registration steps that apply to your entity.

How DeployOpen prepares governance evidence for NIS2

DeployOpen helps essential and important entities prepare the technical records their management body needs to show it is overseeing Article 21 measures. The organization keeps ownership of its controls, decisions and accountability, while DeployOpen prepares systems, documentation and evidence in the client's own infrastructure.

How we scope

Written scope lists which Article 21 measures, governance records and reporting lines the engagement covers for management body oversight.
Scope names the client owner who approves the policies and risk decisions that management must sign off on.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.

How we build

We configure self-hosted open-source tooling that records policy approvals, risk acceptances and remediation status for management review.
We set up dashboards and scheduled reports that give board members a current view of Article 21 control health.
We test the reporting path end to end so escalations from security teams reach the management body within the client's defined timeframes.

How we hand over

Handover includes documented procedures, evidence registers and a record of who approved each governance decision.
We document the records management would present to a competent authority, and confirm with the client which ones their legal advisers require.
Client staff are trained to run and maintain the tooling, so evidence keeps flowing after the engagement ends.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the initial engagement.
Retainers can keep governance reports current as the Article 21 measures and the organization's risk profile change.
Confirm with your legal counsel how liability rules in your Member State apply to your management body before finalizing scope.