NIS2 Management Liability: Personal Accountability, Temporary Bans and National Rules

A second basis reaches legal representatives in both entity categories, and a temporary ban from managerial functions threatens the chief executive level of essential entities only.

Directive (EU) 2022/2555 sets three bases for this accountability: Article 20(1), Article 32(6) with Article 33(5), and Article 32(5)(b). None binds a manager directly: the Directive binds the Member States (Article 46), so managers answer under the national law that transposes the NIS2 Directive.

The sections below cover the three bases, the five conditions of the ban, the two entity categories, 12 national laws and six steps that reduce personal exposure. The table summarises the rules.

What Does Management Liability Mean under NIS2?

Management liability under NIS2 means that the people who lead an essential or important entity answer personally, under the rules of their national law, for the cybersecurity duties the Directive places on the entity. The duties themselves sit with the entity: it takes the Article 21 measures and reports significant incidents under Article 23. Recital 137 of Directive (EU) 2022/2555 calls for a high level of responsibility for the cybersecurity risk-management measures and reporting obligations at the level of the essential and important entities.

Article 20 turns that responsibility into a personal one: liability under Article 20(1) follows from the duty of management bodies to approve and oversee the measures. The parent page sets out what management bodies must approve and oversee.

Who Counts as a Manager for Liability Purposes

NIS2 does not define "management body" in Article 6, so the national laws decide who belongs to it, for example § 2 No. 13 BSIG in Germany and § 3 Z 11 NISG 2026 in Austria. The Directive names two further circles: Article 32(5)(b) targets the person discharging managerial responsibilities at chief executive officer or legal representative level, and Article 32(6) any natural person responsible for, or acting as legal representative of, an essential entity. One board member can therefore fall under both Article 20(1) and Article 32(6).

On Which EU Legal Bases Can Managers Be Held Liable?

Directive (EU) 2022/2555 contains three bases for the accountability of natural persons: Article 20(1) for management bodies, Article 32(6) for legal representatives, applied to important entities by Article 33(5), and Article 32(5)(b) for the temporary ban in essential entities. Each basis obliges the Member States, and the Directive text on EUR-Lex shows how the three differ in the persons and entities they reach.

Liability for Approving and Overseeing the Measures

Article 20(1) obliges Member States to ensure that management bodies approve the Article 21 measures, oversee their implementation and can be held liable for the entity's infringements of Article 21. The text names infringements of Article 21 only, not the reporting duties of Article 23.

Article 20(2) adds a training duty: members of the management bodies are required to follow training to gain sufficient knowledge and skills to identify risks and assess cybersecurity risk-management practices. The Directive sets no frequency, duration or certificate for that training. What the board approves and oversees is the set of at least 10 cybersecurity risk-management measures in Article 21(2), points (a) to (j).

Legal Representatives Who Must Ensure the Entity Meets Its Duties

Article 32(6) requires that any natural person responsible for, or acting as legal representative of, an essential entity has the power to ensure its compliance and can be held liable for breach of those duties.

Article 33(5) applies Article 32(6) to important entities, so this basis, unlike the ban, reaches both entity categories. Belgium transposes Article 32(6) in Article 61 of the Law of 26 April 2024: natural persons responsible for or representing the entity are liable for failing their duty to ensure compliance. Article 31 of the same law holds Belgian management bodies responsible for violations of Article 30.

What the Directive Leaves to National Law

The Directive leaves the form of liability to national law: recital 128 states that it does not require civil or criminal liability of natural persons for damage suffered by third parties. Whether a manager answers to the entity, to the authority or in criminal proceedings is a national choice.

Directive (EU) 2022/2555 sets no personal fines on managers. Article 34 fines the entity, with a maximum of at least EUR 10,000,000 or 2 % of total worldwide annual turnover in the preceding financial year, whichever is higher, for essential entities (Article 34(4)), and at least EUR 7,000,000 or 1.4 %, whichever is higher, for important entities (Article 34(5)). The second subparagraph of Article 20(1) keeps national rules on the liability of public institutions, public servants and elected or appointed officials untouched. How Member States apply the entity caps is explained under NIS2 fines.

When Can a Manager Be Temporarily Banned?

A competent authority can have the chief executive or legal representative of an essential entity temporarily banned from managerial functions under Article 32(5)(b), but only after its earlier enforcement measures have failed and its deadline has passed. The sister measure of Article 32(5)(a) temporarily suspends a certification or authorisation concerning the entity's services or activities. The table lists the five conditions of the ban and its three limits.

The Conditions That Must Be Met First

The ban becomes available only when enforcement measures under Article 32(4)(a) to (d) and (f) have proved ineffective and the deadline the authority set for the entity has expired. These measures include warnings and binding instructions, and point (f) is the order to implement the recommendations of a security audit within a reasonable deadline. Recital 133 describes the ban as a last resort, used only after the other relevant enforcement measures are exhausted.

Under Article 34(2), administrative fines are imposed in addition to the measures of Article 32(4)(a) to (h) and Article 32(5), so a ban on the manager and a fine on the entity can follow the same infringement. The earlier steps of that sequence, from audits to binding orders, belong to NIS2 supervision and enforcement.

Who Imposes the Ban and How Long It Lasts

Under Article 32(5)(b) the competent authority requests the ban and the relevant bodies, courts or tribunals impose it in accordance with national law. The ban lasts only until the entity takes the necessary remedial action (Article 32(5), second subparagraph). Nationally, Belgium (Article 60 2° of the Law of 26 April 2024) and Austria (§ 39(4) NISG 2026, by Bescheid, an administrative decision) let the authority itself prohibit the manager, while the Netherlands and Sweden go through a court.

Entities the Ban Does Not Reach

The Directive's ban does not apply to important entities, because Article 33(4) contains no equivalent of Article 32(5), and it does not apply to public administration entities (Article 32(5), third subparagraph). Both limits also cover the suspension under Article 32(5)(a).

Four national laws compared here repeat the public-body exclusion: § 39(6) NISG 2026 in Austria, Article 79 of the Cyberbeveiligingswet in the Netherlands, Article 22(5) of the Luxembourg law of 5 May 2026 and §§ 22 and 23 of the Danish NIS 2-loven. In these four countries, entities of the public administration sector face neither the EU ban nor its national version.

Does Liability Differ by Entity Category?

Managers of essential and important entities share the same liability under Article 20(1) and Article 32(6), and the main difference lies in exposure to the temporary ban, which Article 32(5) reserves for essential entities. The table compares the two categories point by point.

Important entities are supervised only when evidence, an indication or information points to non-compliance (Article 33(1), recital 122). At national level, Italy moves the line by extending its incapacity sanction to important entities, as the national section below explains.

How Do the National Laws Treat Managers Personally?

The 12 national laws compared on this page differ from the Directive and from each other in three places: whether a manager answers only to the entity or also to the authority, whether the authority or a court imposes a ban, and whether managers can be fined personally. Nine appear in the table; Bulgaria, Croatia and Cyprus follow in the list on personal fines. The status of all 27 Member States is kept in the NIS2 transposition tracker.

Checked against each act as of 23 October 2026.

The national NIS2 act and the company law of the entity's legal form decide together how a manager answers, so each row names the act and the section.

Germany: Liability to the Entity and a Last-Resort Ban

In Germany, the Geschäftsleitungen (management) of particularly important and important entities must implement and oversee the § 30 measures (§ 38(1) BSIG), and those who breach this duty are liable to their entity under the company law of its legal form (§ 38(2) BSIG). The text of § 38 BSIG applies its own liability rule only where company law has none, and the BSIG sets no personal fine on managers. As a last resort, § 61(9) BSIG lets the sector supervisory authority temporarily prohibit unreliable Geschäftsleitungen of particularly important entities.

Two groups are carved out. Federal administration entities are treated as particularly important except for §§ 38, 40(3), 61 and 65 (§ 29(2) BSIG), so neither the duty nor the ban applies to them. Under § 28(6) No. 1 BSIG, §§ 30, 31, 32, 35, 36, 38 and 39 do not apply to DORA financial entities (Article 2(2) of Regulation (EU) 2022/2554), while the § 33 registration duty still does. The BSIG 2025 came with the NIS2UmsuCG (BGBl. 2025 I Nr. 301), in force since 6 December 2025; the new BSIG after NIS2UmsuCG explains §§ 38 and 61.

Personal Fines and Criminal Penalties in National Law

Four of the 12 national laws compared here fine managers personally, which the Directive itself does not require, and a fifth sets criminal penalties. The five rules are listed below.

• Netherlands: up to EUR 25,000 on a board member for breach of the knowledge and training duties of Article 24(2) to (6) (Article 93 Cbw; NIS2 in the Netherlands).
• Bulgaria: EUR 500 to 5,000 on managers for breach of Article 21 (Article 29(4) ЗКС, amended in State Gazette No. 17 of 13 February 2026; NIS2 in Bulgaria).
• Croatia: EUR 1,000 to 6,000 on responsible persons of essential entities (Article 101(2), Zakon o kibernetičkoj sigurnosti; NIS2 in Croatia).
• Portugal: EUR 350 to 200,000 on natural persons for very serious infringements (Article 61(2) RJC; NIS2 in Portugal).
• Cyprus: criminal penalties of up to two years' imprisonment and/or EUR 10,000 for failure to notify and up to three years and/or EUR 15,000 for failure to take risk measures (s. 44(1), (3) Law 89(I)/2020 as amended; NIS2 in Cyprus).

National Bans That Go Beyond the Directive

Two national laws in the table go further than the Directive's ban: Italy's incapacity sanction under Article 38(6) of D.Lgs. 138/2024 also reaches important entities, and Portugal's RJC lists the temporary prohibition of management-body members among its accessory sanctions (Article 67). Italy applies it after a missed formal warning (diffida) deadline. Sweden lets the administrative court prohibit a person from holding a management function on the supervisory authority's application (4 kap. 6 to 8 §§ Cybersäkerhetslag (2025:1506)). Two laws make the ban public: the Dutch court suspension is entered in the Handelsregister (Article 78 Cbw) and the Austrian Bescheid in the Firmenbuch, the commercial register (§ 39(4) NISG 2026).

How Can Managers Reduce Their Personal Exposure?

Managers reduce their exposure by doing, and recording, what the legal bases ask of them: approving the measures, overseeing them, keeping the power to ensure compliance and acting on every order before its deadline. The six steps below follow the legal bases.

1. Approve the Article 21 measures formally and date the approval; for the 11 entity types of Implementing Regulation (EU) 2024/2690, the security policy shows that date (Annex point 1.1.1(k)).
2. Oversee implementation through a person who reports directly to the management bodies (point 1.2.3), and accept residual risks formally (point 2.1.1).
3. Follow the training of Article 20(2), explained under NIS2 training for management.
4. Secure the power to ensure compliance that Article 32(6) requires of every legal representative.
5. Act on warnings, instructions and orders before their deadline, because a missed deadline opens the path to the ban.
6. Check the national act for personal fines and liability towards the entity, such as Article 93 Cbw or § 38(2) BSIG.

Will the Pending Amendments Change Manager Liability?

The pending targeted amendment COM(2026) 13 of 20 January 2026 (procedure 2026/0012(COD)) does not amend Article 20 or Article 34, and as of 23 October 2026 it is pending, with the European Parliament at the stage "Awaiting committee decision". The procedure file in the Legislative Observatory records each stage.

Adopted in its current form, it would leave the duties and liability of Article 20 and the fines of Article 34 unchanged. All pending changes are followed under NIS2 amendments and review.

Manager Liability Questions

Five questions recur about the personal liability of NIS2 managers.

Can managers be fined personally under NIS2?

Not under the Directive itself: Article 34 fines the entity, and personal fines exist only where national law adds them, such as the Netherlands (up to EUR 25,000, Article 93 Cbw). Bulgaria, Croatia and Portugal also fine natural persons.

Can managers of important entities be banned?

Not under the Directive, which reserves the ban of Article 32(5)(b) for essential entities, but Italy's Article 38(6) of D.Lgs. 138/2024 extends its incapacity sanction to important entities.

Does NIS2 make managers liable to customers or other third parties?

No: recital 128 states that the Directive does not require civil or criminal liability of natural persons for damage to third parties, so any such claim rests on national law. In Germany, § 38(2) BSIG covers liability towards the entity.

Does reporting an incident increase the entity's liability?

No: Article 23(1) states that the mere act of notification does not subject the notifying entity to increased liability, a rule covered under NIS2 incident reporting.

Are public officials covered by the same liability rules?

Article 20(1) applies without prejudice to national rules on the liability of public institutions, public servants and elected or appointed officials, and the ban never applies to public administration entities (Article 32(5), third subparagraph).