{"id":32942,"date":"2026-07-17T13:13:19","date_gmt":"2026-07-17T11:13:19","guid":{"rendered":"https:\/\/www.digital-chiefs.de\/?p=32942"},"modified":"2026-07-17T15:28:50","modified_gmt":"2026-07-17T13:28:50","slug":"nis2-liability-for-management-boards-applies-despite-registration","status":"publish","type":"post","link":"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/","title":{"rendered":"NIS2 liability for management boards applies despite registration"},"content":{"rendered":"<p style=\"display:inline-block;background:#d65663;color:#fff;padding:4px 14px;border-radius:20px;font-size:0.85em;margin-bottom:18px;\">9 Min. read time<\/p>\n<p><strong>As of late May 2026, around 11,000 affected companies in Germany still lack BSI registration-and the legal deadline expired on March 6. What\u2019s being called a &#8220;grace period&#8221; is, according to law firms, merely regulatory forbearance until July 31, 2026: the BSI expects late filings but isn\u2019t extending the statutory deadline. For management, Section 38 of the BSIG sets the bar: risk management must be approved, implementation monitored, and training documented. A single portal click won\u2019t suffice.<\/strong><\/p>\n<div style=\"background:#f6f1e6;border-left:4px solid #d65663;border-radius:0 8px 8px 0;padding:22px 26px;margin:28px 0 34px;\">\n<p style=\"margin:0 0 14px 0;font-size:0.76em;font-weight:700;text-transform:uppercase;letter-spacing:0.16em;color:#c0414e;\">Key Takeaways<\/p>\n<ul style=\"margin:0;padding-left:22px;color:#23303f;line-height:1.6;\">\n<li style=\"margin-bottom:12px;\"><strong style=\"color:#0d1b2a;\">Enforcement leniency until July 31.<\/strong> The obligation ended on March 6, 2026. The BSI anticipates late registrations until July 31-law firms interpret this as forbearance, not a cure for non-compliance. As of late May 2026, the gap stands at roughly 11,000 obligated entities.<\/li>\n<li style=\"margin-bottom:12px;\"><strong style=\"color:#0d1b2a;\">Section 38 BSIG holds leadership accountable.<\/strong> Approval, oversight, and personal training remain the responsibility of management. Delegating to a CISO or IT leadership doesn\u2019t shift liability.<\/li>\n<li style=\"margin-bottom:12px;\"><strong style=\"color:#0d1b2a;\">Provability trumps checklists.<\/strong> Without logs, training records, and a documented ISMS, there\u2019s no evidence file in a crisis-where leadership duties are binding, business discretion doesn\u2019t apply.<\/li>\n<\/ul>\n<\/div>\n<p style=\"font-size:0.88em;color:#666;margin:20px 0 32px 0;border-top:1px solid #e5e5e5;border-bottom:1px solid #e5e5e5;padding:10px 0;\"><span style=\"color:#0a1e3d;font-weight:700;text-transform:uppercase;font-size:0.72em;letter-spacing:0.14em;margin-right:14px;\">Related<\/span><a href=\"https:\/\/www.digital-chiefs.de\/en\/sovereign-ai-responsibility-stays-in-house\/\" style=\"color:#333;text-decoration:underline;\">Sovereign AI: responsibility stays in-house<\/a>&nbsp;&nbsp;<span style=\"color:#ccc;\">\/<\/span>&nbsp;&nbsp;<a href=\"https:\/\/www.digital-chiefs.de\/en\/the-ai-writes-the-code-who-is-liable-for-it\/\" style=\"color:#333;text-decoration:underline;\">AI writes the code. Who\u2019s liable?<\/a><\/p>\n<p>The public debate fixates on reporting channels and portal logins. The tougher question lies elsewhere: What can be proven when an incident, regulatory scrutiny, or internal recourse targets management? Simply catching up on registration while leaving the evidence framework unaddressed swaps one visible gap for an invisible one.<\/p>\n<h2 style=\"margin-top:32px;margin-bottom:16px;\">Tolerance Does Not Cure Default<\/h2>\n<p>The legal situation is clearer than many headlines suggest. The statutory registration deadline under the BSI Act expired on 6 March 2026. The BSI itself states on its information page: The legal deadline has passed. Those affected who are still unregistered should act immediately.<\/p>\n<p>What runs until 31 July 2026 is, according to widespread law firm interpretation, administrative tolerance \u2013 a form of enforcement discretion. It is not a statutory extension of the deadline. In its letter to business associations, reported by heise online among others, the BSI assumes that all outstanding registrations will be completed by 31 July 2026 at the latest. This is a statement of expectation and prioritisation; the word &#8220;tolerance&#8221; does not appear in the BSI\u2019s letter. The BSI\u2019s information page simultaneously states: The legal deadline has passed. Anyone registering now remains formally in default \u2013 enforcement discretion does not retroactively remedy the breach of duty. This distinction separates operational relief from legal cure.<\/p>\n<div style=\"margin:28px 0;border-left:3px solid #d65663;background:#fafafa;\">\n<div style=\"display:flex;gap:18px;padding:12px 20px;border-bottom:1px solid #eee;\">\n<div style=\"min-width:110px;font-weight:700;color:#d65663;\">6 March 2026<\/div>\n<div style=\"color:#333;line-height:1.55;\">Statutory registration deadline expires. Anyone not listed in the BSI portal by this date is in default \u2013 regardless of later registration.<\/div>\n<\/div>\n<div style=\"display:flex;gap:18px;padding:12px 20px;\">\n<div style=\"min-width:110px;font-weight:700;color:#d65663;\">31 July 2026<\/div>\n<div style=\"color:#333;line-height:1.55;\">End of the BSI\u2019s communicated late-registration window (law firm interpretation: tolerance). After this, stricter monitoring and penalty practices are expected.<\/div>\n<\/div>\n<\/div>\n<p>The figures explain why the authority is proceeding this way. Of around 29,500 affected companies in Germany, only about 11,500 had registered by the statutory deadline. By the end of May, the number stood at around 18,500. As of the end of May 2026, a gap of around 11,000 obligated parties remains. Enforcement discretion is thus also an admission: enforcement has encountered an economy that underestimated the timeline.<\/p>\n<div style=\"background:#0a1e3d;color:#fff;text-align:center;padding:40px 24px;margin:32px 0;border-radius:8px;\">\n<div style=\"font-size:2.4em;font-weight:800;color:#d65663;letter-spacing:-0.03em;line-height:1.1;\">~11,000<\/div>\n<div style=\"font-size:1em;color:rgba(255,255,255,0.88);margin-top:12px;max-width:540px;margin-left:auto;margin-right:auto;line-height:1.5;\">Companies without BSI registration \u2013 calculated from around 29,500 affected and 18,500 registrations (as of end of May 2026).<\/div>\n<div style=\"font-size:0.78em;color:rgba(255,255,255,0.5);margin-top:12px;\">Source: heise online \/ BSI spokesperson (as of end of May); Kleeberg, 15.07.2026<\/div>\n<\/div>\n<p>A registration violation remains subject to fines. Under <a href=\"https:\/\/www.gesetze-im-internet.de\/bsig_2025\/__65.html\">Section 65 BSIG<\/a>, the institution faces fines of up to 500,000 Euro. The fine targets the institution. The natural person in a leadership role is not the addressee of this fine provision. More serious for executives is the internal liability under <a href=\"https:\/\/www.gesetze-im-internet.de\/bsig_2025\/__38.html\">Section 38(2) BSIG<\/a>: Anyone who violates the duties under paragraph 1 is liable to their own institution for damages caused by negligence \u2013 according to the corporate law rules of the respective legal form. The registration record protects precisely in cases of recourse. The fine remains a side issue. The ability to seek recourse determines the personal risk for leadership.<\/p>\n<h2 style=\"margin-top:32px;margin-bottom:16px;\">What \u00a7 38 BSIG Requires from Executive Management<\/h2>\n<p>\u00a7 38 BSIG places responsibility squarely on the leadership level. Executive management must approve risk management measures, monitor their implementation, and undergo training on cyber risks. BSI President Claudia Plattner puts it literally: executives are &#8220;obliged to implement risk management measures, monitor their implementation, and undergo training on the assessment and management of cyber risks.&#8221; Operational tasks can be delegated to CISOs, IT leadership, or external service providers-but ultimate responsibility remains.<\/p>\n<p>Delegation does not absolve accountability. Appointing a CISO and dropping the topic from the agenda does not fulfill the duty. The obligation to approve and oversee remains. If there is no written approval, no quarterly reports to leadership, or no proof of executive training, an audit will reveal a gap-even if the data center\u2019s technology is running smoothly.<\/p>\n<p>\u00a7 30 (1) sentence 3 BSIG requires organizations to document compliance with their risk management obligations. The focus is on proving the measures taken under this duty. In a crisis, those who cannot present documentation risk sanctions-regardless of whether much was &#8220;somehow&#8221; handled operationally. Consulting experience reveals a consistent pattern: technical controls are often in place, but records of management decisions, approvals of security concepts, and leadership training are missing.<\/p>\n<p>Whether the Business Judgment Rule (BJR) offers protection in the NIS-2 context remains legally unresolved-case law is lacking. A common interpretation among law firms draws a sharp line: the BJR protects business discretion, but under this reading, it does not cover mandatory obligations under \u00a7 38 BSIG. Where \u00a7 38 BSIG explicitly requires approval, oversight, and training, there is no room for discretion-the BJR simply does not apply. Gaps in training and documentation thus constitute independent breaches of duty, whether for a sole managing director of a GmbH or a multi-member executive board.<\/p>\n<p>Consultants often pitch leadership seminars and tool roadmaps. The weak spot? Proof. Leaving a workshop without a resolution protocol means you\u2019ve attended an event-not created an audit trail. The DACH region\u2019s reality adds pressure: works councils and data protection requirements impact monitoring and training formats. Co-determination and commissioned processing don\u2019t block compliance, but both demand early involvement-otherwise, documentation stalls the moment protocols and attendance lists must meet formal standards.<\/p>\n<h2 style=\"margin-top:32px;margin-bottom:16px;\">What Can Be Proven in a Crisis<\/h2>\n<p>Shifting perspectives is easy to articulate but hard to execute. The critical question becomes: Which document supports which claim? Who signed it, and when? Two columns separate assertion from evidence.<\/p>\n<div style=\"display:grid;grid-template-columns:repeat(auto-fit,minmax(280px,1fr));gap:16px;margin:28px 0;\">\n<div style=\"background:#fafafa;border-top:3px solid #c0392b;padding:18px 20px;border-radius:4px;\">\n<p style=\"margin:0 0 10px 0;font-size:0.78em;font-weight:700;text-transform:uppercase;letter-spacing:0.12em;color:#c0392b;\">Unsubstantiated Claims<\/p>\n<ul style=\"margin:0;padding-left:18px;color:#333;line-height:1.55;font-size:0.95em;\">\n<li style=\"margin-bottom:6px;\">\u201cSecurity is the CISO\u2019s responsibility\u201d without management approval minutes<\/li>\n<li style=\"margin-bottom:6px;\">\u201cWe have an ISMS\u201d without an up-to-date risk analysis and management sign-off<\/li>\n<li style=\"margin-bottom:6px;\">\u201cManagement is informed\u201d without training records and attendee lists<\/li>\n<li style=\"margin-bottom:6px;\">\u201cWe are registered\u201d without documented ownership for the portal and incident reporting<\/li>\n<li style=\"margin-bottom:6px;\">\u201cThe service provider handles it\u201d without monitoring reports to management<\/li>\n<\/ul>\n<\/div>\n<div style=\"background:#fafafa;border-top:3px solid #2d7a3e;padding:18px 20px;border-radius:4px;\">\n<p style=\"margin:0 0 10px 0;font-size:0.78em;font-weight:700;text-transform:uppercase;letter-spacing:0.12em;color:#2d7a3e;\">Provable in a Crisis<\/p>\n<ul style=\"margin:0;padding-left:18px;color:#333;line-height:1.55;font-size:0.95em;\">\n<li style=\"margin-bottom:6px;\">Board resolution: risk management approved, scope and owner designated<\/li>\n<li style=\"margin-bottom:6px;\">Current risk analysis with date, methodology, and management submission<\/li>\n<li style=\"margin-bottom:6px;\">Training plan and executive management certificates per \u00a7 38(3)<\/li>\n<li style=\"margin-bottom:6px;\">BSI registration confirmation plus role concept for portal and incident reporting<\/li>\n<li style=\"margin-bottom:6px;\">Quarterly report to management detailing deviations, measures, and deadlines<\/li>\n<\/ul>\n<\/div>\n<\/div>\n<p>Three risks will shape the coming months. First: Registration is completed, but the evidence file remains patchy-visibility increases, but defensibility does not. Second: Multiple managing directors share responsibility in a way that leaves no one signing off on approvals. Third: After July 31, 2026, regulators will target laggards without portal entries or documentation trails. Ownership is the scarce resource: Who maintains the evidence file? Who approves management training and record-keeping? Who escalates when the CISO reports and the agenda stays silent?<\/p>\n<p>Sources don\u2019t always align. Law firm and association briefings often mention a \u201cgrace period,\u201d suggesting delayed compliance can be remedied. But the BSI\u2019s wording is stricter: The legal deadline has passed, and while the authority expects late registrations by July 31, 2026 (<a href=\"https:\/\/www.heise.de\/news\/NIS2-Mahnung-BSI-setzt-neue-Frist-zur-Registrierung-bis-Ende-Juli-11336134.html\">heise online, June 17, 2026<\/a>), \u201ctolerance\u201d is a legal interpretation of enforcement discretion-not a term found in the BSI\u2019s statement. Digital Chiefs endorses this reading because it sharpens leadership\u2019s decision-making: act now and build evidence in parallel. No cure for delay should be expected.<\/p>\n<h2 style=\"margin-top:32px;margin-bottom:16px;\">The First 90 Days: Evidence Over Checklists<\/h2>\n<p>The first step isn\u2019t buying a tool. It\u2019s compiling a file with five key elements within ninety days-driven by senior management and operationally supported by the CISO and legal teams.<\/p>\n<p><strong>Days 1\u201330: Status and gap mapping.<\/strong> Clarify or confirm your exposure. Verify your registration status in the BSI portal and complete any pending access requirements (ELSTER\/MUK). In parallel: take inventory of existing documents-risk assessments, ISMS scope, incident and continuity plans, and previous board resolutions. Anything missing gets an owner and a deadline.<\/p>\n<p><strong>Days 31\u201360: Approval and training.<\/strong> Senior management formally approves the risk management framework and action plan. The minutes document the scope, exceptions, and responsible parties. Mandatory executive training is scheduled and recorded-with attendance lists and documented content. The CISO delivers the first written monitoring report to leadership.<\/p>\n<p><strong>Days 61\u201390: Operational rhythm.<\/strong> Establish a quarterly calendar for leadership reports, reporting channels, and escalation procedures. Assign roles in the BSI portal for registration and incident reporting. Address gaps from the inventory with deadlines and budget owners. Those who\u2019ve only ticked off registration have met half their obligations. Those who maintain an evidence file can respond when it matters.<\/p>\n<p>The trade-offs are real. Speed in registration without documentation quality creates a false sense of security. Perfectionism in the file without portal registration leaves the most visible obligation unmet. The smart move: use the post-registration window to build provability within the same ninety days. It\u2019s unglamorous. But it\u2019s what regulators and liability claims will scrutinize later.<\/p>\n<p>Executives who face personal liability know the difference between \u201cwe\u2019re handling it\u201d and \u201cwe can prove it.\u201d NIS-2 doesn\u2019t treat this as a matter of style. It makes it a leadership obligation with personal risk-especially when your own organization seeks recourse.<\/p>\n<h2 style=\"margin-top:32px;margin-bottom:16px;\">Frequently Asked Questions<\/h2>\n<details style=\"background:#f9f9f9;padding:16px 20px;margin:12px 0;border-radius:4px;\">\n<summary style=\"font-weight:700;cursor:pointer;color:#1a1a2e;\">Has the NIS-2 registration deadline been extended to 31 July 2026?<\/summary>\n<p style=\"margin:12px 0 0 0;\">No. The statutory deadline expired on 6 March 2026. According to a letter from the BSI to industry associations, the agency expects late registrations until 31 July 2026, which law firms interpret as a grace period (enforcement discretion). However, this is not a legal extension of the deadline, and late submissions do not retroactively remedy the delay.<\/p>\n<\/details>\n<details style=\"background:#f9f9f9;padding:16px 20px;margin:12px 0;border-radius:4px;\">\n<summary style=\"font-weight:700;cursor:pointer;color:#1a1a2e;\">Does appointing a CISO relieve management of liability under \u00a7 38 BSIG?<\/summary>\n<p style=\"margin:12px 0 0 0;\">No. While operational tasks can be delegated, management remains responsible for approving risk management measures, overseeing their implementation, and completing their own training. Without documented oversight, liability risks stay firmly with the executive level.<\/p>\n<\/details>\n<details style=\"background:#f9f9f9;padding:16px 20px;margin:12px 0;border-radius:4px;\">\n<summary style=\"font-weight:700;cursor:pointer;color:#1a1a2e;\">Which documents are critical in the event of an incident?<\/summary>\n<p style=\"margin:12px 0 0 0;\">Key documents include recorded approvals, up-to-date risk assessments, ISMS evidence, management training records, incident and continuity plans, and the BSI registration confirmation. \u00a7 30 (1) sentence 3 BSIG requires proof of compliance with risk management obligations. Missing documentation can lead to penalties-even if measures were actually in place.<\/p>\n<\/details>\n<details style=\"background:#f9f9f9;padding:16px 20px;margin:12px 0;border-radius:4px;\">\n<summary style=\"font-weight:700;cursor:pointer;color:#1a1a2e;\">What are the consequences of failing to register?<\/summary>\n<p style=\"margin:12px 0 0 0;\">A registration violation can result in fines of up to 500,000 euros for the organization under \u00a7 65 BSIG. Additionally, management may face internal liability claims from their own company under \u00a7 38 (2) BSIG for negligent breach of duty. Once the late registration window closes, stricter enforcement is expected.<\/p>\n<\/details>\n<details style=\"background:#f9f9f9;padding:16px 20px;margin:12px 0;border-radius:4px;\">\n<summary style=\"font-weight:700;cursor:pointer;color:#1a1a2e;\">Is the Business Judgement Rule sufficient protection for management?<\/summary>\n<p style=\"margin:12px 0 0 0;\">Unclear-and often overestimated. The Business Judgement Rule protects discretionary business decisions, but mandatory obligations under \u00a7 38 BSIG typically fall outside its scope. Without proof of training and a robust ISMS, the rule may not apply at all-and case law on NIS-2 is still lacking.<\/p>\n<\/details>\n<div style=\"margin:40px 0 24px 0;\">\n<p style=\"margin:0 0 12px 0;font-size:0.78em;font-weight:700;text-transform:uppercase;letter-spacing:0.18em;color:#666;\">More from the MBF Media Network<\/p>\n<div style=\"padding:14px 18px;border-left:3px solid #0bb7fd;background:#fafafa;margin-bottom:6px;\">\n<div style=\"font-size:0.7em;font-weight:700;color:#0bb7fd;text-transform:uppercase;letter-spacing:0.12em;margin-bottom:4px;\">cloudmagazin<\/div>\n<p><a href=\"https:\/\/www.cloudmagazin.com\/2026\/06\/29\/kritis-cloud-migration-c5-nis2-dachgesetz\/\" style=\"font-weight:600;line-height:1.4;color:#1a1a1a;text-decoration:none;\">KRITIS in the Cloud: Securing Your Migration<\/a>\n<\/p>\n<\/div>\n<div style=\"padding:14px 18px;border-left:3px solid #202528;background:#fafafa;margin-bottom:6px;\">\n<div style=\"font-size:0.7em;font-weight:700;color:#202528;text-transform:uppercase;letter-spacing:0.12em;margin-bottom:4px;\">mybusinessfuture<\/div>\n<p><a href=\"https:\/\/mybusinessfuture.com\/cybersecurity-boom-nis2-deutschlands-sicherheitsbranche\/\" style=\"font-weight:600;line-height:1.4;color:#1a1a1a;text-decoration:none;\">Cybersecurity Boom: How NIS2 is Transforming Germany\u2019s Security Sector<\/a>\n<\/p>\n<\/div>\n<div style=\"padding:14px 18px;border-left:3px solid #69d8ed;background:#fafafa;\">\n<div style=\"font-size:0.7em;font-weight:700;color:#69d8ed;text-transform:uppercase;letter-spacing:0.12em;margin-bottom:4px;\">securitytoday<\/div>\n<p><a href=\"https:\/\/www.securitytoday.de\/2026\/07\/07\/der-ai-act-ist-in-wahrheit-ein-security-gesetz\/\" style=\"font-weight:600;line-height:1.4;color:#1a1a1a;text-decoration:none;\">The AI Act Is Actually a Security Law<\/a>\n<\/p>\n<\/div>\n<\/div>\n<p style=\"text-align:right;color:#868e96;font-size:0.85em;margin-top:48px;\"><em>Image source: AI-generated (July 2026)<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The statutory registration deadline for NIS2 has expired. What remains until July 31st is enforcement leniency.<\/p>\n","protected":false},"author":114,"featured_media":32930,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_focuskw":"Executive liability","_yoast_wpseo_title":"NIS2 liability for management boards applies despite registration","_yoast_wpseo_metadesc":"NIS2 deadline passed March 6, BSI accepts late reports until July 31. Prove your management's actions in case of an incident.","_yoast_wpseo_opengraph-image":"","_yoast_wpseo_opengraph-image-id":0,"_yoast_wpseo_twitter-image":"","_yoast_wpseo_twitter-image-id":0,"featured_post_sortierung":0,"featured_post":0,"pre_headline":"","bildquelle":"","teasertext":"","language":"de","_evm_slot_owner":"","_evm_translation_lang":"","_wp_old_slug":[],"footnotes":""},"categories":[7],"tags":[],"class_list":["post-32942","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber-security","entry"],"wpml_language":"en","wpml_translation_of":32929,"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.1.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>NIS2 liability for management boards applies despite registration<\/title>\n<meta name=\"description\" content=\"NIS2 deadline passed March 6, BSI accepts late reports until July 31. Prove your management&#039;s actions in case of an incident.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"NIS2 liability for management boards applies despite registration\" \/>\n<meta property=\"og:description\" content=\"NIS2 deadline passed March 6, BSI accepts late reports until July 31. Prove your management&#039;s actions in case of an incident.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/\" \/>\n<meta property=\"og:site_name\" content=\"Digital Chiefs\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/digitalchiefs\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-17T11:13:19+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-17T13:28:50+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.digital-chiefs.de\/wp-content\/uploads\/2026\/07\/nis2-organhaftung-nachweis-registrierung-cover-hero.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1659\" \/>\n\t<meta property=\"og:image:height\" content=\"948\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Tobias Massow\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@digital_chiefs\" \/>\n<meta name=\"twitter:site\" content=\"@digital_chiefs\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Tobias Massow\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/\"},\"author\":{\"name\":\"Tobias Massow\",\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/#\/schema\/person\/7a9e40318a8c36352e7a694f6df4d5c8\"},\"headline\":\"NIS2 liability for management boards applies despite registration\",\"datePublished\":\"2026-07-17T11:13:19+00:00\",\"dateModified\":\"2026-07-17T13:28:50+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/\"},\"wordCount\":1906,\"publisher\":{\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.digital-chiefs.de\/wp-content\/uploads\/2026\/07\/nis2-organhaftung-nachweis-registrierung-cover-hero.jpg\",\"articleSection\":[\"Cyber Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/\",\"url\":\"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/\",\"name\":\"NIS2 liability for management boards applies despite registration\",\"isPartOf\":{\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.digital-chiefs.de\/wp-content\/uploads\/2026\/07\/nis2-organhaftung-nachweis-registrierung-cover-hero.jpg\",\"datePublished\":\"2026-07-17T11:13:19+00:00\",\"dateModified\":\"2026-07-17T13:28:50+00:00\",\"description\":\"NIS2 deadline passed March 6, BSI accepts late reports until July 31. Prove your management's actions in case of an incident.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/#primaryimage\",\"url\":\"https:\/\/www.digital-chiefs.de\/wp-content\/uploads\/2026\/07\/nis2-organhaftung-nachweis-registrierung-cover-hero.jpg\",\"contentUrl\":\"https:\/\/www.digital-chiefs.de\/wp-content\/uploads\/2026\/07\/nis2-organhaftung-nachweis-registrierung-cover-hero.jpg\",\"width\":1659,\"height\":948,\"caption\":\"KI-generiertes Titelbild.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Startseite\",\"item\":\"https:\/\/www.digital-chiefs.de\/en\/home\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"NIS2 liability for management boards applies despite registration\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/#website\",\"url\":\"https:\/\/www.digital-chiefs.de\/en\/\",\"name\":\"Digital Chiefs\",\"description\":\"Architekten des digitalen Deutschlands\",\"publisher\":{\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.digital-chiefs.de\/en\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/#organization\",\"name\":\"Digital Chiefs\",\"url\":\"https:\/\/www.digital-chiefs.de\/en\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.digital-chiefs.de\/wp-content\/uploads\/2020\/05\/cropped-digital-chiefs-logo-klein.jpg\",\"contentUrl\":\"https:\/\/www.digital-chiefs.de\/wp-content\/uploads\/2020\/05\/cropped-digital-chiefs-logo-klein.jpg\",\"width\":190,\"height\":190,\"caption\":\"Digital Chiefs\"},\"image\":{\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/digitalchiefs\/\",\"https:\/\/x.com\/digital_chiefs\",\"https:\/\/www.linkedin.com\/company\/digital-chiefs\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.digital-chiefs.de\/en\/#\/schema\/person\/7a9e40318a8c36352e7a694f6df4d5c8\",\"name\":\"Tobias Massow\",\"description\":\"Tobias Massow ist Gesch\u00e4ftsf\u00fchrer der Evernine Media GmbH und Herausgeber von Digital Chiefs. Er verantwortet die strategische Ausrichtung des Magazins und des MBF Media Netzwerks.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/in\/tobias-massow\/\"],\"url\":\"https:\/\/www.digital-chiefs.de\/en\/author\/tobias\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"NIS2 liability for management boards applies despite registration","description":"NIS2 deadline passed March 6, BSI accepts late reports until July 31. Prove your management's actions in case of an incident.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/","og_locale":"en_US","og_type":"article","og_title":"NIS2 liability for management boards applies despite registration","og_description":"NIS2 deadline passed March 6, BSI accepts late reports until July 31. Prove your management's actions in case of an incident.","og_url":"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/","og_site_name":"Digital Chiefs","article_publisher":"https:\/\/www.facebook.com\/digitalchiefs\/","article_published_time":"2026-07-17T11:13:19+00:00","article_modified_time":"2026-07-17T13:28:50+00:00","og_image":[{"width":1659,"height":948,"url":"https:\/\/www.digital-chiefs.de\/wp-content\/uploads\/2026\/07\/nis2-organhaftung-nachweis-registrierung-cover-hero.jpg","type":"image\/jpeg"}],"author":"Tobias Massow","twitter_card":"summary_large_image","twitter_creator":"@digital_chiefs","twitter_site":"@digital_chiefs","twitter_misc":{"Written by":"Tobias Massow","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/#article","isPartOf":{"@id":"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/"},"author":{"name":"Tobias Massow","@id":"https:\/\/www.digital-chiefs.de\/en\/#\/schema\/person\/7a9e40318a8c36352e7a694f6df4d5c8"},"headline":"NIS2 liability for management boards applies despite registration","datePublished":"2026-07-17T11:13:19+00:00","dateModified":"2026-07-17T13:28:50+00:00","mainEntityOfPage":{"@id":"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/"},"wordCount":1906,"publisher":{"@id":"https:\/\/www.digital-chiefs.de\/en\/#organization"},"image":{"@id":"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/#primaryimage"},"thumbnailUrl":"https:\/\/www.digital-chiefs.de\/wp-content\/uploads\/2026\/07\/nis2-organhaftung-nachweis-registrierung-cover-hero.jpg","articleSection":["Cyber Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/","url":"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/","name":"NIS2 liability for management boards applies despite registration","isPartOf":{"@id":"https:\/\/www.digital-chiefs.de\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/#primaryimage"},"image":{"@id":"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/#primaryimage"},"thumbnailUrl":"https:\/\/www.digital-chiefs.de\/wp-content\/uploads\/2026\/07\/nis2-organhaftung-nachweis-registrierung-cover-hero.jpg","datePublished":"2026-07-17T11:13:19+00:00","dateModified":"2026-07-17T13:28:50+00:00","description":"NIS2 deadline passed March 6, BSI accepts late reports until July 31. Prove your management's actions in case of an incident.","breadcrumb":{"@id":"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/#primaryimage","url":"https:\/\/www.digital-chiefs.de\/wp-content\/uploads\/2026\/07\/nis2-organhaftung-nachweis-registrierung-cover-hero.jpg","contentUrl":"https:\/\/www.digital-chiefs.de\/wp-content\/uploads\/2026\/07\/nis2-organhaftung-nachweis-registrierung-cover-hero.jpg","width":1659,"height":948,"caption":"KI-generiertes Titelbild."},{"@type":"BreadcrumbList","@id":"https:\/\/www.digital-chiefs.de\/en\/nis2-liability-for-management-boards-applies-despite-registration\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Startseite","item":"https:\/\/www.digital-chiefs.de\/en\/home\/"},{"@type":"ListItem","position":2,"name":"NIS2 liability for management boards applies despite registration"}]},{"@type":"WebSite","@id":"https:\/\/www.digital-chiefs.de\/en\/#website","url":"https:\/\/www.digital-chiefs.de\/en\/","name":"Digital Chiefs","description":"Architekten des digitalen Deutschlands","publisher":{"@id":"https:\/\/www.digital-chiefs.de\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.digital-chiefs.de\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.digital-chiefs.de\/en\/#organization","name":"Digital Chiefs","url":"https:\/\/www.digital-chiefs.de\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.digital-chiefs.de\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.digital-chiefs.de\/wp-content\/uploads\/2020\/05\/cropped-digital-chiefs-logo-klein.jpg","contentUrl":"https:\/\/www.digital-chiefs.de\/wp-content\/uploads\/2020\/05\/cropped-digital-chiefs-logo-klein.jpg","width":190,"height":190,"caption":"Digital Chiefs"},"image":{"@id":"https:\/\/www.digital-chiefs.de\/en\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/digitalchiefs\/","https:\/\/x.com\/digital_chiefs","https:\/\/www.linkedin.com\/company\/digital-chiefs\/"]},{"@type":"Person","@id":"https:\/\/www.digital-chiefs.de\/en\/#\/schema\/person\/7a9e40318a8c36352e7a694f6df4d5c8","name":"Tobias Massow","description":"Tobias Massow ist Gesch\u00e4ftsf\u00fchrer der Evernine Media GmbH und Herausgeber von Digital Chiefs. Er verantwortet die strategische Ausrichtung des Magazins und des MBF Media Netzwerks.","sameAs":["https:\/\/www.linkedin.com\/in\/tobias-massow\/"],"url":"https:\/\/www.digital-chiefs.de\/en\/author\/tobias\/"}]}},"_links":{"self":[{"href":"https:\/\/www.digital-chiefs.de\/en\/wp-json\/wp\/v2\/posts\/32942","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.digital-chiefs.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.digital-chiefs.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.digital-chiefs.de\/en\/wp-json\/wp\/v2\/users\/114"}],"replies":[{"embeddable":true,"href":"https:\/\/www.digital-chiefs.de\/en\/wp-json\/wp\/v2\/comments?post=32942"}],"version-history":[{"count":1,"href":"https:\/\/www.digital-chiefs.de\/en\/wp-json\/wp\/v2\/posts\/32942\/revisions"}],"predecessor-version":[{"id":32943,"href":"https:\/\/www.digital-chiefs.de\/en\/wp-json\/wp\/v2\/posts\/32942\/revisions\/32943"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.digital-chiefs.de\/en\/wp-json\/wp\/v2\/media\/32930"}],"wp:attachment":[{"href":"https:\/\/www.digital-chiefs.de\/en\/wp-json\/wp\/v2\/media?parent=32942"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.digital-chiefs.de\/en\/wp-json\/wp\/v2\/categories?post=32942"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.digital-chiefs.de\/en\/wp-json\/wp\/v2\/tags?post=32942"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}