NIS2 Is Not Another Regulation. It Changes Who Gets Fired After a Breach.

Most regulations add paperwork. NIS2 adds consequences.

That is not a subtle distinction. That is the entire point.

What Everyone Gets Wrong About NIS2

When a new directive arrives, organisations do what they always do. They push it to compliance. They schedule a workshop. They move on.

This is how organisations handled GDPR. It is how they handled NIS1. It is how most organisations are handling NIS2 right now.

The problem is that NIS2 was specifically designed to stop this from working.

The architects of NIS2 looked at the previous directive — NIS1, in force since 2016 — and saw what happened.¹ Organisations implemented the minimum. Supervisory authorities had limited enforcement tools. Incidents happened anyway.² The same systemic weaknesses appeared in audit after audit across EU member states.³

So they rewrote the directive. And this time, they did something different.

They made it personal.

The Liability Shift Nobody Is Talking About

Article 20 of NIS2 does something no cybersecurity regulation in Europe has done before at this scale.⁴ It places legal responsibility for cybersecurity governance directly on the management body.

Not on the CISO. Not on IT. Not on the compliance team.

On the board. On the executives. On the individuals who sit in those chairs and sign those decisions.

This is the shift. From organisational responsibility to personal liability.

Article 20(1) of NIS2 is precise: the management bodies of essential and important entities must approve cybersecurity risk-management measures, oversee their implementation, and — in the directive’s exact words — “can be held liable for infringements by the entities of that Article.”⁵

Germany has already gone further than the directive requires. The NIS2 implementation law — the NIS2UmsuCG — and the revised BSIG⁶ create a framework where supervisory authorities can pursue natural persons, not just legal entities.⁷ Where fines do not stop at the company balance sheet. Where the person who delegated cybersecurity to IT because it was “too technical” can find themselves personally named in an enforcement action.⁸

These provisions go beyond NIS2’s baseline. They are also new. The first enforcement actions under §38 BSIG will refine how courts interpret what it means for a management body to have “nicht beachtet” — to have failed to comply with — its obligations. Practical reach will develop case by case. But the legal architecture is in force, and the BSI has signalled it intends to use it.

The directive is specific about when this liability is triggered. Article 20(1) states that member states shall ensure management body members “can be held liable for infringements by those entities of this Directive.” Not for a successful attack. For an infringement — a failure to fulfil the governance obligations the directive explicitly assigns to them. Recital 137 reinforces this: supervisory authorities “should be able to hold management bodies of essential and important entities accountable where those bodies have not fulfilled their obligations.” The German BSIG goes further still. §38 BSIG n.F. creates direct personal accountability where the management body “nicht beachtet hat” — has not complied with — the cybersecurity obligations assigned to it.⁹ In the most severe enforcement scenarios, governance failure alone — without a successful attack — can be enough to trigger personal liability under §38 BSIG. This is the legal upper bound. In practice, most enforcement actions follow incidents. But the law makes the lighter case actionable — and that is what shifts the calculation in every boardroom.

If you are reading this and cannot clearly answer who in your organisation is accountable for NIS2 — you already have a problem.

For most executives, this is the moment the room goes quiet.

A Short Story About a Long Meeting

What follows is a composite scenario built from audit patterns observed across multiple essential entities in Germany. No single company is described.

In early 2024, a mid-sized logistics company in Germany received a routine inquiry from its sector regulator. A standard questionnaire. Nothing alarming on the surface.

The CISO prepared the response. The board approved it without reading it. The questionnaire was filed. Everyone moved on.

Six months later, the company experienced a ransomware incident. Trucks stopped. Deliveries failed. Customers started calling. Then regulators did.

Critical transport coordination systems were offline for eleven days. Customer data was exfiltrated. The incident met every threshold for mandatory notification.

The notification went in late.¹⁰ The post-incident examination revealed that the governance structure described in that earlier questionnaire did not match reality. The board had approved a document describing controls that had never been implemented. The training records cited did not exist. The management body had signed off on a programme they had never overseen.

Under NIS1, the company received a fine and a corrective action plan.

Under NIS2, the conversation would be different. Because NIS2 asks a question that NIS1 never asked with the same legal force: who approved this, and what did they actually know?

The management body is not a rubber stamp anymore. It is a legally accountable actor.

What Actually Changed — and Why This Time Is Different

NIS2 expanded scope dramatically. It covers sectors NIS1 never touched — food, manufacturing, chemicals, waste management, postal services, public administration.¹¹ It lowered the size threshold, pulling in medium-sized entities that previously had no sector-specific cybersecurity obligations.¹² It introduced Article 21 — ten specific security measures that covered entities must implement, oversee, and evidence.¹³

But the scope expansion and the technical requirements are not the structural shift.

The structural shift is governance accountability.

Under NIS2, the management body must approve the cybersecurity measures. Must oversee their implementation. Must undergo cybersecurity training.¹⁴ And when something goes wrong — when a breach occurs, when a notification is missed, when a control that was supposed to exist does not — the question regulators will ask is not “what did your systems do?”

It is “what did your board know, when did they know it, and what did they decide?”

That is a fundamentally different question. One that compliance frameworks, gap reports, and policy documents cannot answer on their own.

The Organisation This Directive Is Actually Aimed At

NIS2 is not aimed at organisations already running mature security programmes. Those organisations will find compliance demanding but achievable.

NIS2 is aimed at the board that has never seen a security report. The executive team that treats cybersecurity as an IT cost centre. The management body that approved a CISO’s annual presentation without asking a single question about what any of it meant.

It is aimed at the organisation where, if something went wrong tomorrow, the honest answer to “who was responsible for this?” would be: no one in particular.

NIS2 makes that answer legally unacceptable.

The Cost of the Old Approach

The directive sets maximum fines of €10 million or 2% of global annual turnover for essential entities, and €7 million or 1.4% for important entities.¹⁵ These numbers get cited frequently.

But the fines are not the most important consequence.

The most important consequence is supervisory scrutiny — the right of competent authorities to conduct on-site inspections, require access to documentation, interview management body members directly, issue binding instructions, and temporarily prohibit individuals from exercising management functions.¹⁶

Read that again.

Because this is where NIS2 stops being a compliance exercise.

Temporarily prohibit individuals from exercising management functions.

Not the company. The individual.

This is the most severe sanction available under NIS2 — and it applies, by design, only to essential entities under Article 32(5)(b). For important entities, the parallel regime under Article 33 does not include this measure. But for organisations operating in Annex I sectors — health, energy, transport, banking, drinking water, digital infrastructure — this power is real, and it sits today with national supervisory authorities. Most enforcement actions will use lighter tools first: warnings, binding instructions, fines. The prohibition is the upper bound. But the upper bound exists, and that is what every board now has to plan around.

This is what changes who gets fired after a breach. Not because the organisation decides someone must go. Because a regulator decides that a specific person should not be allowed to hold their current role while an enforcement action is live.¹⁷

This is new. This is NIS2.

The Question Your Board Cannot Afford to Get Wrong

NIS2 does not ask whether your organisation takes cybersecurity seriously.

It asks whether the people at the top can prove it.

Prove it through documented decisions. Through training records.¹⁴ Through governance structures that existed before the incident — not structures assembled in response to one.¹⁸

The organisations that will struggle most with NIS2 are not the ones that lack technology. They are the ones where nobody in the boardroom can answer a single specific question about what their cybersecurity programme actually does.¹⁹

That gap is no longer a management problem.

It is a liability. And under NIS2, it has a name attached to it.^{20 21}