nis2-geschaeftsleitung-haftung

/nis2:nis2-geschaeftsleitung-haftung

Purpose

NIS2 makes cybersecurity a top-level priority: The management body must approve, oversee the risk measures and be trained — and is liable for breach of duty personally. German law implements this in § 38 BSIG (new version), flanked by the administrative fine provision § 65 BSIG. This skill assesses management responsibility, reviews the evidentiary situation and estimates the liability and administrative fine risk.

Inputs

• Classification of the entity (particularly important / important — § 28 BSIG)
• Organisational structure (managing directors, management board, if applicable supervisory board)
• Status of approval of the § 30 measures (resolution available?)
• Oversight routine (reporting lines, reporting frequency)
• Completed training of the management bodies (evidence)
• Group revenue (for the maximum administrative fine)

Sub-agent architecture

Three conceptual roles. A duties agent breaks down § 38 BSIG / Art. 20 NIS2 Directive into the three core duties (approval, oversight, training) and reviews the fulfilment status for each duty. An evidence agent collects the documentation (resolutions, reportings, training evidence) that proves fulfilment of duties in the event of a dispute. A liability agent assesses the administrative fine risk under § 65 BSIG and the internal liability risk under company law. Decisions on organisational consequences are made by the entity itself.

Process

1. Addressee of the management duties (§ 38 BSIG)

• The addressees of the duties are the management bodies of particularly important and important entities.
• The responsibility is not fully delegable; delegation to the CISO/IT does not relieve the ultimate responsibility.

2. The three core duties (Art. 20 NIS2 Directive / § 38 BSIG)

Duty	Content
Approval	Formal approval of the risk management measures under § 30 BSIG (resolution of the governing body)
Oversight	Ongoing oversight of the implementation of the approved measures
Training	Regular training of the management bodies in order to be able to assess cyber risks; training offerings also for employees

3. Interlocking with § 30 BSIG

• The approval and oversight duty relates specifically to the ten minimum measures of § 30 BSIG.
• Without documented approval, the implementation of measures is formally incomplete.

4. Personal liability and internal liability

• § 38 (2) BSIG provides for the personal liability of the management bodies for compliance with the obligations.
• In addition, the general corporate governance liability regimes (Section 43 GmbHG, Section 93 AktG) apply in the internal relationship.

5. Administrative fines (Section 65 BSIG)

• Particularly important entities: administrative fine up to €10 million or 2 % of worldwide annual turnover (whichever is higher).
• Important entities: up to €7 million or 1,4 % of worldwide annual turnover.
• The administrative fine applies to the entity; the personal responsibility of the management may additionally become relevant under supervisory and corporate law.

Risks / typical mistakes

• Personal liability underestimated — Section 38 BSIG addresses the management bodies directly; mere delegation to IT does not relieve them of liability.
• Training of management omitted — the training obligation applies to the management itself, not just the workforce; missing evidence is an audit finding.
• Approval only verbal — without a documented board resolution on the Section 30 measures, proof of fulfillment of duties is lacking.
• Administrative finedimension misjudged — the upper limits of Section 65 BSIG are based on worldwide group turnover.

Sources

Statute

• Section 38 BSIG (new version) — duties of the management
• Section 30 BSIG (new version) — risk management measures
• Section 65 BSIG (new version) — administrative fine provisions
• Directive (EU) 2022/2555 (NIS2) — Art. 20 NIS2 Directive
• Section 43 GmbHG, Section 93 AktG (internal liability of corporate bodies)

Secondary literature

• Eckhardt, NIS2, 1st ed. 2024
• Greenberg Traurig, "NIS2 in Germany — Cybersecurity as a board-level issue"

Output format

NIS2-LEITUNGSVERANTWORTUNG — <Einrichtung> — <Datum>

I.    Einordnung (§ 28 BSIG)               [besonders wichtig / wichtig]
II.   Kernpflichten (§ 38 BSIG / Art. 20 NIS2-RL)
      Billigung der § 30-Maßnahmen          [Beschluss vorhanden? Ja/Nein]
      Überwachung                            [Reporting-Linie / Frequenz]
      Schulung der Leitung                   [Nachweise vorhanden? Ja/Nein]
III.  Nachweislage                          [vollständig / Lücken]
IV.   Persönliche Haftung                   [Risikoeinschätzung]
V.    Bußgeldrahmen (§ 65 BSIG)            [bis 10 Mio. € / 2 % bzw. 7 Mio. € / 1,4 %]

Sofortmaßnahmen:
  - Organbeschluss zu § 30-Maßnahmen
  - Schulungstermin Leitung
Nächster Schritt: <…>