YTYK You think you know

Card 8 of 18 Governance — who signs ●●● Sharp edge

Managers can be held personally liable

Article 20(1) requires Member States to ensure that members of the management body can be held liable for a failure to comply with the measures. In the Belgian transposition this sits alongside the supervisory powers, including the possibility of temporarily barring an individual from management functions in an essential entity.

Why it is like this

A fine paid by the company is a cost that can be budgeted. Personal exposure changes who asks the questions and how early — which is the behaviour the directive is actually trying to produce.

Not to be confused with

Automatic personal fines. The directive requires that liability be *possible*; it does not itself impose a penalty on an individual, and the form it takes depends on national law.

In practice

In practice the first consequence is procedural, not financial: boards start minuting their security decisions, because the record is the defence.

Source: Directive (EU) 2022/2555 (NIS2) — Art. 20(1) and Art. 32(6). Read on .

Predict Check yourself

Under NIS2, what exposure does a member of the management body carry?

  1. They can be held liable for the entity's failure to comply, with the form set by national law.
  2. None — only the legal entity is liable; the directive is explicit about that.
  3. A fixed personal fine of up to €1 million, set by the directive.
  4. Criminal liability in every Member State, harmonised by the directive.
Show the answer

They can be held liable for the entity's failure to comply, with the form set by national law.

Article 20(1) requires Member States to ensure management bodies can be held liable. The directive sets the requirement; the mechanism and its severity are national.