NIS2 Article 20: What Management Bodies Must Approve, Oversee and Learn

The duty reaches organisations through the national law that transposes Directive (EU) 2022/2555, because the Directive is addressed to the 27 Member States (Article 46) and has applied since 18 October 2024 (Article 41(1)). Essential and important entities carry the same Article 20 obligations; they differ only in supervision and in the maximum fine. How the law itself is built is explained under NIS2 Directive on the home page.

This page sets out the four duties with their paragraphs, who counts as the management body, five extra board points for 11 digital entity types under Implementing Regulation (EU) 2024/2690, 16 national provisions and the status of Article 20 as of 23 October 2026.

What Does NIS2 Article 20 Require from the Management Body?

Article 20 of NIS2 gives the management body of every essential and important entity four duties: approve the cybersecurity risk-management measures, oversee their implementation, be held liable for the entity's infringements of Article 21, and follow training. Article 20 carries the title "Governance" and opens Chapter IV (Articles 20 to 25), which also holds the measures and the reporting obligations. Recital 137 states the aim: a high level of responsibility for the risk-management measures and reporting obligations at entity level. Table 1 lists each duty with its legal basis.

Liability under Article 20(1) means that the management body "can be held liable"; the Directive itself sets no personal fines. Article 34 fines the entity, with a maximum of at least EUR 10,000,000 or 2 % of total worldwide annual turnover for essential entities and at least EUR 7,000,000 or 1.4 % for important entities, whichever is higher. The strongest EU measure against a person, the temporary ban on managerial functions of Article 32(5)(b), applies to essential entities only.

Approving the Cybersecurity Measures

The management body approves the measures that the entity takes under Article 21 to manage cybersecurity risks (Article 20(1)). These are appropriate and proportionate technical, operational and organisational measures (Article 21(1)) that cover at least the 10 points (a) to (j) of Article 21(2), such as policies on risk analysis and information system security, incident handling, business continuity and supply chain security.

Approval becomes evidence once it is recorded: a dated board decision shows the supervisor which measures the management body accepted and when. For the digital entity types of Implementing Regulation (EU) 2024/2690, the security policy itself must indicate the date of its formal approval by the management bodies. For every other entity, board approval is one step of the NIS2 compliance requirements.

Overseeing How the Measures Are Implemented

The management body oversees the implementation of the approved measures, so the duty continues after the approval decision (Article 20(1)).

Germany's § 38(1) BSIG makes the Geschäftsleitung (senior management) of besonders wichtige and wichtige Einrichtungen implement ("umzusetzen") the § 30 measures as well as oversee their implementation. Where oversight finds a gap, the entity takes all necessary corrective measures without undue delay (Article 21(4)); the Directive sets no fixed number of days.

Following Training to Identify and Assess Risks

Members of the management body are required to follow training that gives them sufficient knowledge and skills to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity (Article 20(2)).

Member States encourage entities to offer similar training to their employees on a regular basis. The Directive sets no frequency, duration, exam or certificate for either group. Staff training is also one of the minimum measures, as "basic cyber hygiene practices and cybersecurity training" (Article 21(2)(g)). For the digital entity types, awareness programmes under point 8.1.1 of the Annex to Regulation (EU) 2024/2690 include the members of management bodies.

Who Counts as the Management Body?

NIS2 does not define the management body: Article 6 lists 41 definitions without it, so each national law decides which persons approve and oversee the measures, for example § 2 No. 13 BSIG in Germany and § 3 Z 11 NISG 2026 in Austria.

Estonia lets one designated board member carry the duty: at least one member approves and oversees the security measures and is responsible for them, and all board members carry the duty when none is designated (KüTS § 6¹). Poland addresses the head of the entity and the person entrusted with cybersecurity duties (Article 8e(1) of the Act on the National Cybersecurity System, KSC).

Lithuania names three groups: the members of the management body, the head of the entity and the authorised person (Article 14(7) of Law No. XII-1428 as recast by Law No. XIV-2902). Portugal keeps the duty inside the board: responsibility may be delegated only to another member of the management body (Article 25(3) of the Regime Jurídico da Cibersegurança, Decreto-Lei n.º 125/2025).

Board Duties Added for the 11 Digital Entity Types

For the 11 digital entity types that Implementing Regulation (EU) 2024/2690 binds, such as cloud computing, data centre and managed service providers, the management bodies also approve the security policy with a recorded date, review it at least annually, receive direct security reporting and accept the residual risks. The Regulation (OJ L, 2024/2690, 18.10.2024) is directly applicable to these types and has been in force since 7 November 2024 (Article 16). Its Annex adds five management-body points, listed below.

• Policy approval date: the security policy indicates the date of its formal approval by the management bodies (Annex point 1.1.1(k)).
• Annual review: the management bodies review the policy and, where appropriate, update it at least annually and when significant incidents or significant changes occur (point 1.1.2).
• Direct reporting line: at least one person reports directly to the management bodies on network and information system security (point 1.2.3).
• Residual-risk acceptance: the management bodies, or accountable persons with adequate reporting to them, accept the risk assessment results and residual risks (point 2.1.1).
• Review results: the results of compliance monitoring, independent reviews and monitoring and measurement are reported to the management bodies, which decide on corrective action or accept the residual risk (point 2.3.3).

Topic-specific policies may be approved by an appropriate level of management rather than the management bodies (recital 9 of the Regulation). ENISA's Technical Implementation Guidance, version 1.0 of 26 June 2025, is non-binding and advises presenting independent review reports to the management bodies at least annually (section 2.3.3); the full Annex is explained under Implementing Regulation (EU) 2024/2690.

Every other essential or important entity follows the list of measures in its national law. No implementing act under Article 21(5) of the Directive exists for other sectors.

How 16 National Laws Word the Management Body Duties

Of the 16 national provisions in Table 2, the clearest departures from the text of Article 20 fall into five groups: Germany adds implementation, Estonia, Poland and Lithuania name which board members are bound, the Netherlands, Lithuania, Poland and Romania set a training interval, certificate or accreditation, Portugal limits delegation, and Austria and Greece fine missing training or governance.

National provisions as cited; not a statement of transposition status. As of 23 October 2026.

The Netherlands sets the most detailed board rule. Under Article 24 of the Cyberbeveiligingswet (Wet van 8 juli 2026, Stb. 2026, 187), the measures need the approval of the bestuur (board) (Article 24(1)), and each board member has the knowledge and skills for the duty (Article 24(2)). Members acquire that knowledge within two years of the entry into force of Article 24(2) or of their appointment (Article 24(3)), keep it demonstrably current (Article 24(4)) and prove it with a training certificate (Article 24(5)).

Two Member States attach fines to the board duty itself. Austria fines a failure to provide management training under § 45(1) Z 1 NISG 2026. Greece fines breaches of Article 14(1) Ν. 5160/2024 up to EUR 200,000 and breaches of the training rule in Article 14(2) up to EUR 100,000 (Article 26(9)(a) and (b)); the status of each law is dated in the NIS2 transposition tracker.

Where Article 20 Stands on 2026-10-23

As of 23 October 2026, Article 20 reads as adopted on 14 December 2022: the Directive has not been amended, and the pending Commission proposal COM(2026) 13 leaves Article 20 unchanged.

COM(2026) 13, the Commission proposal of 20 January 2026 for targeted amendments (procedure 2026/0012(COD)), is at the European Parliament stage "Awaiting committee decision". The Digital Omnibus COM(2025) 837 of 19 November 2025 (procedure 2025/0360(COD)) is also pending; the Council mandate on it was agreed by Coreper on 21 October 2026.

Article 40 sets the next fixed point: the Commission reviews the functioning of the Directive by 17 October 2027 and every 36 months after that. Both proposals are followed under NIS2 amendments and review.

What Article 20 Does Not Require

Article 20 does not set a training frequency, a certificate, a definition of the management body or a fine on managers; where these exist, they come from national law.

Article 20 also binds only the boards of entities in scope. Whether an organisation is an essential or important entity is a scope question that comes first.

Does Article 20 Apply Where a Sector Act Governs Cybersecurity?

No: under the Commission's Guidelines on Article 4 (2023/C 328/02), Article 20 should not apply where a sector-specific Union act governs cybersecurity risk-management, because it is intrinsically linked to Article 21. DORA, Regulation (EU) 2022/2554, is such an act for financial entities, and its Article 5(2)(a) gives their management body the ultimate responsibility for managing ICT risk; how the two regimes overlap is compared under NIS2 vs DORA.

The entity therefore checks which act governs its risk management before applying Article 20. Where DORA applies, the NIS2 measures, reporting and supervision give way under the Guidelines on the application of Article 4(1) and (2) (OJ C 328, 18.9.2023, p. 2), while Articles 7, 9, 10 and 16 of NIS2 continue to apply.

Do Public Bodies Carry the Same Board Duties?

Yes, public administration entities in scope carry the Article 20 duties, but the Directive leaves national rules on the liability of public institutions, public servants and elected or appointed officials untouched (Article 20(1) second subparagraph).

The temporary ban of Article 32(5)(b) does not apply to public administration entities (Article 32(5), third subparagraph), and each Member State decides whether and to what extent fines may be imposed on them (Article 34(7)). Which bodies fall in scope is set out for the public administration sector.