4 min read<\/p>\n
NIS2 and DORA hold executives and board members personally liable if cybersecurity is grossly neglected within the company. For CIOs and CISOs, this fundamentally changes the rules of the game: implementing technical measures alone is no longer enough. Documenting one\u2019s duty of care has become a personal shield.<\/strong><\/p>\n For decades, executives and managing directors could delegate cybersecurity responsibility to the CISO or IT department. As long as no major incidents occurred, the topic remained at the operational level. NIS2 ends that model. Paragraph 38 of the revised BSI Act (Federal Office for Information Security Act) states unequivocally: Executive management must supervise the implementation of risk management measures – and is liable for violations.<\/p>\n Concretely, this means: If a company falls under NIS2 and executive management can be shown to have approved inadequate measures, those individuals may be held personally liable – even if no actual damage has occurred. The duty applies from the outset, in prevention – not only after an incident.<\/p>\n DORA intensifies this approach for the financial sector. Article 5 mandates that the management body of a financial undertaking bears ultimate responsibility for ICT risk management. While delegation to operational units remains permissible, it does not<\/em> relieve the management body of overall accountability. Germany\u2019s Federal Financial Supervisory Authority (BaFin) has signaled it will enforce this obligation rigorously.<\/p>\n \n\u201cWe must continue building Germany\u2019s \u2018Cyber Nation\u2019. The threat landscape has never been more severe – and cybersecurity must be top-management business.\u201dClaudia Plattner, President of the BSI (Federal Office for Information Security), IT Security Situation Report 2025<\/cite>\n<\/p><\/blockquote>\n NIS2 (Paragraph 38, BSI Act):<\/strong> Executive management must supervise the implementation of risk management measures outlined in Paragraph 30. It must attend cybersecurity training and be able to demonstrate adequate knowledge. Personal liability applies in cases of gross negligence – and cannot be excluded by corporate bylaws or shareholder agreements.<\/p>\n DORA (Article 5):<\/strong> The management body bears ultimate responsibility for ICT risk management. It must approve the ICT risk framework, define the cyber-resilience strategy, and supervise implementation. At least once per year, the management body must assess the appropriateness of these measures. Violations may incur sanctions imposed by national financial regulators.<\/p>\n EU AI Act:<\/strong> For high-risk AI systems, the provider or operator bears responsibility for conformity. Breaches of high-risk obligations may trigger fines of up to \u20ac35 million or 7% of global annual turnover. Although the EU AI Act does not explicitly prescribe personal liability for executives, general corporate law on organ liability may apply if executives fail to supervise compliance obligations.<\/p>\n Sources: NIS2 Implementation Act (NIS2UmsuCG), EU AI Act (2024\/1689), DORA (2022\/2554)<\/p>\n Many executives rely on their Directors-and-Officers (D&O) insurance. Yet coverage has limits. D&O policies typically exclude intentional breaches of duty. Coverage for gross negligence depends entirely on the specific policy terms. It is reasonable to expect insurers to tighten requirements for demonstrating due diligence following the entry into force of NIS2 obligations.<\/p>\n CIOs and CISOs – jointly with the legal department – should urgently verify: Does the existing D&O policy cover cybersecurity liability risks under NIS2 and DORA? Does it contain exclusions for regulatory violations? Is the coverage limit sufficient given the new fine ceilings? This review must be completed without delay.<\/p>\n 1. Document a Governance Framework.<\/strong> A written cybersecurity governance framework that clearly defines responsibilities, processes, and escalation paths. The framework must be formally adopted by the board<\/a> and updated regularly. It serves as the central proof that executive management fulfills its supervisory duty.<\/p>\n 2. Conduct Regular Board Training.<\/strong> NIS2 explicitly requires executive management to attend cybersecurity training<\/a>. Documented attendance at a minimum of two sessions per year is the baseline standard. Training should address current threat landscapes, regulatory updates, and industry-specific risks.<\/p>\n 3. Document Risk Decisions.<\/strong> Every board decision concerning cybersecurity measures must be recorded in minutes. Even the conscious acceptance of residual risk must be documented and justified. In liability proceedings, documentation of the decision-making process offers the strongest protection against allegations of gross negligence.<\/p>\n 4. Review and Adapt D&O Insurance.<\/strong> Audit existing policies for coverage of cybersecurity liability risks and regulatory violations. Where necessary, expand coverage – or procure dedicated cyber-D&O policies. This insurance review must be completed immediately.<\/p>\n 5. Commission External Audits as Evidence.<\/strong> An independent audit conducted by a qualified auditor objectively documents the state of cybersecurity measures. ISO\/IEC 27001 certification – or equivalent attestations – significantly strengthens the board\u2019s position in liability proceedings. Audits should be repeated at least annually.<\/p>\n The message to the board is uncomfortable – but essential: Since the NIS2 Act entered into force, cybersecurity has become a matter of personal liability for each individual board member. Delegation to the CISO or IT department no longer shields executives from personal accountability. The board must actively supervise, undergo regular training, and meticulously document its decisions.<\/p>\n CIOs who deliver this message early – and simultaneously build the required governance structures – lay the foundation for legally secure IT leadership. Ignoring the issue risks not only corporate fines but also personal careers and private assets. The time to act is now.<\/p>\n Yes – if the CIO is part of executive management or has formally assumed cybersecurity responsibility, personal liability may apply in cases of gross negligence. Paragraph 38 of the BSI Act assigns the supervisory duty to executive management and expressly prohibits exemption from liability via corporate bylaws.<\/p>\n<\/details>\n Gross negligence arises when executive management disregards fundamental duties of care – for example, by failing to implement any risk management system, lacking incident response processes, or ignoring known security vulnerabilities. A documented governance framework and regular audits are the strongest defenses against such allegations.<\/p>\n<\/details>\n Conditionally. D&O policies typically exclude intentional breaches of duty. Coverage for gross negligence depends on the precise policy wording. CIOs should audit their D&O policy for cybersecurity liability exposure and adjust coverage where needed.<\/p>\n<\/details>\n NIS2 requires executives to prove sufficient cybersecurity knowledge. We recommend at least two documented training sessions per year covering current threats, regulatory requirements, and sector-specific risks.<\/p>\n<\/details>\n The NIS2 Implementation Act entered into force in December 2025; the registration deadline with the BSI was March 2026. DORA has applied since January 2025. The EU AI Act becomes applicable to high-risk systems from August 2026. Companies therefore have only a few months left to establish compliant governance structures.<\/p>\n<\/details>\n Header Image Source: Vlada Karpovich \/ Pexels<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" 4 min read NIS2 and DORA hold executives and board members personally liable if cybersecurity is grossly neglected within the company. For CIOs and CISOs, this fundamentally changes the rules of the game: implementing technical measures alone is no longer enough. Documenting one\u2019s duty of care has become a personal shield. TL;DR \u2696\ufe0f Personal liability […]<\/p>\n","protected":false},"author":114,"featured_media":12752,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"personal liability","_yoast_wpseo_title":"Personal Liability: CIO risk under NIS2 and DORA rules","_yoast_wpseo_metadesc":"Personal liability for CIOs under NIS2 and DORA: Avoid legal risks with actionable compliance strategies\u2014protect yourself and your organization now.","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"featured_post_sortierung":0,"featured_post":0,"pre_headline":"","bildquelle":"","teasertext":"","language":"de","_evm_slot_owner":"","_evm_translation_lang":"","_wp_old_slug":[],"footnotes":""},"categories":[678],"tags":[],"class_list":["post-14800","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-security","entry"],"wpml_language":"en","wpml_translation_of":12753,"yoast_head":"\nTL;DR<\/h2>\n
\n
The End of Delegated Responsibility<\/h2>\n
What the Laws Specifically Require<\/h2>\n
D&O Insurance: Not Automatic Protection<\/h2>\n
Five Protective Measures for CIOs and Executives<\/h2>\n
What CIOs Must Tell the Board – Now<\/h2>\n
Frequently Asked Questions<\/h2>\n
Is the CIO personally liable under NIS2?<\/strong><\/summary>\n
What constitutes gross negligence under NIS2?<\/strong><\/summary>\n
Does D&O insurance protect against NIS2 liability?<\/strong><\/summary>\n
What training must executives demonstrate?<\/strong><\/summary>\n
When do the new liability rules take effect?<\/strong><\/summary>\n
Editor\u2019s Reading Recommendations<\/h2>\n
\n
More from the MBF Media Network<\/h2>\n
\n