NIS2 director liability: what § 38 BSIG requires of management
Management must implement the security measures under § 30 BSIG, oversee their implementation and attend training regularly (§ 38 BSIG). If it culpably breaches these duties and the company suffers damage as a result, management is liable to the company. That follows company law, as with management's other duties.
Who § 38 BSIG applies to
§ 38 BSIG applies to the management of every essential and every important entity. That is what the law calls the companies NIS2 applies to.
Management means whoever runs the business and represents the company under the law, the articles of association or the partnership agreement. In a GmbH that is the managing directors, in an AG the management board.
§ 2 no. 13 BSIG · § 38 BSIG
The three duties
§ 38 BSIG names three duties. The first two are in subsection 1, the third in subsection 3.
Implement
Management makes sure the measures under § 30 BSIG are in place in the business, for example an incident response plan, tested backups or a second factor at sign-in. Others can do the work itself, such as IT or a service provider.
§ 38(1) BSIG
Oversee
It checks whether the measures are in place and working. The law does not say how often or in what form. A recorded meeting with date, outcome and tasks is an obvious way to show it.
§ 38(1) BSIG
Train
Every member of management attends training regularly. The aim is to identify and assess risks and to judge their effect on the company's services. The law sets no number of hours. The explanatory memorandum to the law reads “regularly” as training offered at least every three years.
§ 38(3) BSIG
The EU directive words it slightly differently: management approves the measures and oversees their implementation (Art. 20(1) NIS 2). The German law requires management to implement them.
How liability works
If management breaches these duties and culpably causes damage to the company, it is liable to its own company. This is called internal liability: the claim belongs to the company, not to an authority or a customer.
Liability follows the company law of the legal form. For a GmbH that is § 43 GmbHG, for an AG § 93 AktG. Only where company law has no such rule is management liable under the BSIG itself.
Culpably means intentionally or negligently. Whether a claim exists, and for how much, depends on the individual case.
§ 38(2) BSIG · § 43 GmbHG · § 93 AktG
What the authority can do
Fines are set out in § 65 BSIG. For breaches of the measures or the reporting duty, the upper limit is EUR 10 million for essential and EUR 7 million for important entities. These are maximum amounts.
For essential entities, the competent supervisory authority can, as a last resort, temporarily prohibit unreliable management from carrying out its role. This requires that the company has not followed orders from the BSI despite a deadline. The prohibition applies only until it complies. The law does not provide for this for important entities.
§ 61(9) BSIG · § 65 BSIG · Art. 32(5) NIS 2
The fines in detailWhat management can hand over
It can hand over the work: to IT, to a person who coordinates information security, or to a service provider. The duty to implement and oversee stays with management. § 38 BSIG is addressed to management itself.
Nobody can attend the training on management's behalf. Every member of management takes part in person.
What this means for a company with 50 to 150 employees
Here management often consists of one or two people. They do not have to set up the measures themselves. They have to know what has been decided and check that it is happening.
Keep a record of three things: which documents management approved and when, when it last reviewed the status and what it decided, and the latest training of each member.
The company has to document that it implements the measures anyway. The same records show that management has met its duties.
§ 30(1), third sentence, BSIG
An example
A made-up company: a conveyor systems manufacturer with 90 employees and two managing directors. Machinery manufacturing is listed in Annex 2 of the BSIG, so the company is an important entity.
January: both managing directors attend a training course for management. They record the date, provider and content.
February to April: the IT manager and the IT service provider decide on the measures. The documents come out of this, such as the security policy and the incident response plan.
May: the managing directors read the documents and approve them. They decide not to implement one item and write down the reason.
After that: once a year they sit down with the IT manager. They look at incidents, open items and the largest risks and record who does what by when. The company chose this interval itself; the law sets none.
How the walkthrough does this
In the walkthrough at nisd2.eu, you end up with what management should keep on record for § 38 BSIG.
One step records the latest training of each member of management, with the date and, if there is one, the certificate.
The documents come out of your answers, such as the security policy and the incident response plan.
Management reads each document and approves it in the app, signed in with its own account. Name and date then appear on every document.
If you decide not to implement an item, you write down why. Management signs that decision too.
The management review records when management reviewed the status, what it decided and who does what by when.
Common questions
Is management personally liable under NIS2?
It is liable to its own company for damage it causes by culpably breaching its duties under § 38(1) BSIG. That follows company law, for a GmbH § 43 GmbHG. Whether a claim exists depends on the individual case.
What does § 38(3) BSIG require?
Every member of management attends training regularly, to identify and assess risks and to judge their effect on the company's services. The law does not prescribe the length, format or provider. The explanatory memorandum reads “regularly” as at least every three years.
Can management hand the responsibility to IT?
The work, yes; the duty, no. § 38 BSIG obliges management to implement and oversee the measures. It can ask others to do it, but has to check that it happens.
Does this also apply to small companies?
It applies to every essential and every important entity. Whether your company is one depends on its sector and size (§ 28 BSIG). How many people sit in management makes no difference.
Does D&O insurance cover this?
That depends on the individual policy. The BSIG does not deal with it. Have the terms of your policy checked.
Sources
- BSI Act (BSIG) §§ 2 no. 13, 28, 30, 38, 61, 65, gesetze-im-internet.de/bsig_2025
- Directive (EU) 2022/2555 (NIS 2), Art. 20 and 32, EUR-Lex
- Explanatory memorandum to the NIS2UmsuCG, Bundestag printed paper 21/1501, p. 154 (on § 38(3))
- § 43 GmbHG and § 93 AktG, gesetze-im-internet.de
In practice
Where this comes up in the walkthrough
The walkthrough turns this into steps you fill in, with the law explained beside each one. Open a step to see its screen, filled in for a made-up company.
Governance & Liability
Get management trained
Every member of management, regularly.
Effectiveness Assessment
Record the management review
Management checks whether the measures work and approves your documents.
Risk Management
Write the security policy
A short policy that management approves.
What the walkthrough costs
€4,800 net a year, plus VAT
30 days money backBy invoice, due in 30 days. Cancel within the first 30 days: invoice cancelled or money back.
Guided NIS 2 implementation, step by step
A history of changes and sign-offs to show your regulator
Deadlines and reminders for each requirement
Security questionnaire for your suppliers
Export to PDF or CSV at any time
Been asked to handle NIS2?
In the end you have everything in one document: what is done, what is still open, and your management's approval with name and date. The app writes the texts.
