NIS2 and the management body: what you personally stand to lose — money, office, and a training duty the BSI may audit

The question reaching boardrooms since the German NIS2 act entered into force on 6 December 2025 is always the same one: "Do I personally pay?" The honest answer is more precise than the fear behind it. You personally risk four things: money through internal liability to your own company, your office through a temporary prohibition, an auditable training duty you carry as an organ, and a personal fine if the entity breaches its fine-backed duties. The fine catalogue does not even name Section 38, the provision that governs you. But under Section 9 OWiG, the entity's offences also apply to the management acting on its behalf.

This piece walks the liability chain the way the statute built it: who counts as a management body under Section 2 no. 13 BSIG, what Section 38 actually obliges that person to do, the three routes along which a breach reaches the individual, and when the sanction frame in Section 65 reaches management as well as the company. For anyone running an important or essential entity under Section 28 BSIG, this is the paragraph architecture worth knowing before the first incident, not after.

Who counts as management — and why the IT lead does not

Section 2 no. 13 BSIG defines Geschäftsleitung as a natural person appointed by law, articles or partnership agreement to run the affairs of and represent an essential or important entity. That is the managing director of a GmbH, the board member of an AG, the personally liable partner running a KG. It is deliberately a natural person — not the IT director, not the CISO, not the external security provider. The statute puts the duty where German corporate law already puts the responsibility: on the organ that can be held to account inside the company.

The consequence cuts both ways. A company cannot lower the duty into the organisation by hiring a security officer, and the officer cannot inherit it by doing the work. Execution may be delegated — supervision may not, and that asymmetry is the hinge of the whole liability question.

What Section 38(1) orders — implement and supervise

The operative sentence of Section 38(1) BSIG is short: management bodies of essential and important entities must implement the risk-management measures required under Section 30 and supervise their implementation. Two verbs, and the German version is sharper than the directive it transposes. Article 20 of the NIS2 directive requires management bodies to approve the measures and oversee their implementation; the German statute replaces the approval with a duty to implement.

Supervision in this sense is a documented state, not an intention. It means the management body knows which of the ten measure areas of Section 30(2) are covered, by whom, and with what residual gap — and can show that it checked. What is checked is still bounded by the proportionality clause of Section 30(1) sentence 2: a sixty-employee manufacturer is owed measures scaled to its risk exposure, not a group-grade apparatus. But whatever scale applies, the supervision itself is not scaled away.

Route one: internal liability — Section 38(2) reaches private assets

Section 38(2) BSIG states that a management body breaching its duties under paragraph 1 is liable to its own entity for a culpably caused damage under the company-law rules applicable to the entity's legal form. For the GmbH that is the mechanism of Section 43(2) GmbHG — the managing director who negligently breaches his duties is liable to the company — and for the AG the parallel rule of Section 93(2) AktG. The direction matters: the company claims against its own organ, privately, with assets on the line.

What counts as the damage is the practical question. Remediation and recovery cost after an incident that a supervised implementation would have contained, third-party claims the entity settles, and the cost of ordered measures all qualify in principle. Whether a fine imposed on the company can itself be passed through to the officer is contested — the fine punishes the entity, and shifting it would blunt exactly that design. What is not contested: the chain requires fault. A management body that resolved the measures, implemented them and demonstrably monitored their effectiveness has removed the liability trigger before any court reaches the damages figure.

Route two: prohibition of office — the last resort of Section 61(9)

The sharpest instrument in the statute sits at the end of an enforcement chain most directors have never read. Where an essential entity fails to comply with a BSI order despite a deadline, Section 61(9) no. 2 BSIG allows the competent sectoral supervisory authority — not the BSI itself — to temporarily prohibit an unreliable management body from exercising the office to which it was appointed. It is expressly the last resort, it is linked to the unheeded order, and it ends the moment the entity complies.

Two limits keep the instrument rare. The wording addresses essential entities only; for important entities, Section 62 BSIG opens an ex-post review where facts justify the suspicion of non-compliance — and the prohibition clause is not worded for them. And the trigger is deliberate non-compliance after an order and a deadline, not a discovered gap. The path to a prohibited director runs through an ignored instruction, not through an incident.

Route three: the training duty the BSI may audit — Section 38(3)

Section 38(3) BSIG obliges management bodies to take part in training regularly, with a defined content: sufficient knowledge and skills to identify and assess risks and risk-management practices in information security, and to judge their effects on the entity's own services. It is a duty to understand enough to supervise — not a duty to become an engineer, and not a one-off.

The provision is not fine-backed — Section 65 does not list it — but it is auditable, and that is the detail worth marking. Section 61(1) lets the BSI order audits expressly covering Section 38(3); Section 62 opens the same check for important entities on suspicion. When an auditor asks what the board did, the answers are either documented or they are claims. Date, content and participant are a three-line record that converts a duty into evidence.

What the fine catalogue does not contain, and when Section 65 still reaches you

The number everyone quotes — ten million euros or two percent of turnover — comes from Section 65 BSIG, and its catalogue names breaches of the measure duties of Section 30, the reporting deadlines of Section 32, the registration duty of Section 33, and disobedience of orders under Section 61. Section 38 does not appear in the list. There is no fine line for the Section 38 duties themselves.

The high brackets depend on the category of the entity: ten million euros for essential, seven million for important entities, and the turnover rule of two or 1.4 percent only above five hundred million euros of global revenue. Within those brackets, Section 65(9) excludes Section 17(2) of the regulatory-offences act, the rule under which negligent conduct can be fined at most at half the maximum. A negligent breach can therefore be fined up to the full bracket. Section 65 contains no bar on personal fines: under Section 9 OWiG the entity's offences also apply to the authorised representative body acting for it, and under Section 130 OWiG a breach of the duty of supervision can be fined where proper supervision would have prevented the breach or made it substantially more difficult. Alongside that fine stand internal liability, the auditable duties and, for essential entities, the ultima-ratio prohibition.

The timeline: what already applies and what is still coming

Half the anxiety in the market comes from treating every stage as live. The statute's own schedule separates them:

The reading for a board in September 2026: the duties under Section 38 are already fully in force and already auditable on an individual basis. The BSI can make evidence demands under Section 61(3) only from December 2028, and even then it selects on a risk basis under Section 61(4) which essential entities have to provide evidence. Exposure therefore sits with the individual order, the suspicious incident and the fine-backed duties, not with a mass review.

Four records a management body should hold today

Section 38 does not grade intentions; it is discharged or breached in documentation. Four records cover the three routes above:

None of this requires a consultant. It requires that the security conversation happened where the statute placed it — at the organ table — and that someone wrote it down. The file that answers an audit is the same file that answers a D&O questionnaire and the same file that defeats an internal-liability claim before it is drafted.

The honest remainder: what the statute does not demand

Three absences are worth as much as the duties. The statute demands no technical depth from the organ — the training duty aims at the ability to assess, not to administer. It demands no faultless outcome — the liability trigger is culpable breach, not the occurrence of an incident; a breached company with a supervised implementation has an answer, a quiet one does not. And it permits no abdication — outsourcing the work to a provider leaves the supervision exactly where Section 38 put it.

Whoever takes one sentence from this piece: the personal risk under NIS2 is real, and it is decided in the documentation. The statute was written so that the organ cannot say it did not know, and so that the organ that did its duty can prove it did.

Frequently asked questions about NIS2 management liability