Is a board member personally liable under NIS2?
The NIS2 Directive does not only govern what an organisation must do technically and organisationally, but also addresses the governing body itself. The directive requires board members to approve the risk management measures, oversee their implementation and receive training in them. This is a different role from that of the IT department or an external supplier, and this role cannot be delegated away.
Whether this also leads to personal liability of an individual board member depends on the national law that implements the directive and on the broader corporate law of the country in which the organisation is established. In the Netherlands, this runs through the Cybersecurity Act and the existing rules on board member liability for improper governance. What is precisely established in this regard and what is still under development is best discussed with a legal advisor; this article describes the main lines, not your individual situation.
What the directive requires of the governing body
The duty of care that follows from NIS2 consists of two layers that complement each other. The first layer is the organisation: the ten measures that make up the cyber file, from access control to incident handling. The second layer is the governing body: it must know, approve and monitor these measures. This does not mean that a board member must understand the technology in detail, but rather that he or she knows what risks the organisation faces, what choices have been made in this regard, and whether those choices are being complied with. Anyone who wants to know exactly which measures this concerns will find an overview in the overview of all NIS2 topics.
Why this cannot be outsourced
It is quite normal for an organisation to place the implementation of security measures with an IT supplier, a managed service provider or an internal security officer. That is permitted, and for many small and medium-sized organisations it is also the only realistic way. However, the directive makes a distinction between implementation and accountability. A supplier can manage a firewall, set a password policy or run a backup; the governing body remains the one who must be able to demonstrate that it knows what is going on and that it has consciously chosen to do so. A contract with a supplier regulates the implementation, not the governance involvement that the directive requires.
This also touches on the subject of the supply chain. An organisation that is itself subject to NIS2 must oversee the risks that suppliers bring with them — which is why small and medium-sized businesses receive security questionnaires from their clients. The same logic applies internally: the governing body oversees what the organisation itself does, even if the work itself is carried out elsewhere.
What oversight means in practice
Oversight is not a matter of signing a document once. The directive speaks of approval of measures and training, which suggests that this is a recurring process: periodically checking whether the measures are still correct, whether they have been implemented, and whether something has changed that requires adjustment. For a board member without a technical background, the most workable form is usually a fixed overview: what measures are in place, what is their status, who is responsible, and what supporting document goes with each. Without such a register, oversight is difficult to demonstrate, even if it has actually taken place.
What we do and do not know for certain
The directive itself describes the role of the governing body at European level; how this precisely translates into liability law varies by country, and national legislation is not finalised everywhere at the same time. Supervisory authorities publish their own interpretation of this, and that interpretation can change. We track this by country and by source, with the date on which we saw a publication; how that source tracking works precisely is explained on the page on how we track sources. For an assessment of the liability of a specific director in a specific organisation, a legal advisor or the competent supervisory authority remains the appropriate contact point.
What you can document
Even without complete legal certainty about personal liability, there is practical work to be done: documenting which measures are in place, who manages them, and when the board last discussed them. That is precisely what the cyber dossier is designed for — a living register instead of a one-off report. If you first want to know whether your organisation is itself subject to the duty of care or is affected through the supply chain, then the free NIS2 check provides a first indication of this in a few questions, with an explanation of why.
Start where you are now: review the free NIS2 check or browse through the knowledge base to see which topics are relevant for your organisation.