This guide concerns German law and the general corporate situation. Entity type, legal form, responsibilities, the specific breach of duty and damage remain decisive. Germany’s implementing provisions have generally applied since 6 December 2025. Federal Law Gazette 2025 I No. 301, Article 30.
Which duties apply to management?
First establish whether the entity is covered as particularly important or important and which duties actually apply. Sector and employee numbers alone are not always sufficient. For example, section 28(5)–(7) contains special classifications for certain energy, telecommunications, financial and telematics entities. Non-application of section 38 in such a situation does not automatically remove other management or security responsibilities. Section 28 BSIG.
Under section 2, point 13, “management” means natural persons appointed by law, statute or articles of association to manage and represent the entity. A CISO, head of IT or external service provider does not become this statutory governing body solely by holding a technical role. Conversely, the term is not limited to people with the title “managing director”. Section 2, point 13 BSIG.
1. Implement measures
Management must implement the risk management measures under section 30. This includes an organisation whose responsibilities, resources and decisions enable effective implementation. The ten areas range from risk analysis and incident handling to supply chains, training, cryptography and access protection. The required scope depends on the risk and the more detailed statutory requirements. Section 38(1), section 30 BSIG.
In practice, for example, a material outage risk must not remain indefinitely unresolved between IT, purchasing and a service provider. Management needs a decision on the necessary measure, its funding, responsibility and implementation. A solution deliberately matched to the risk may differ from a particular standard product; simply omitting a required measure does not become permissible because it is recorded in the risk register.
2. Oversee implementation
Section 38(1) also requires oversight. Management needs meaningful information, traceable checks and a process for dealing with deviations. A monthly spreadsheet of figures is of little use if it omits critical remaining problems.
A suitable report answers questions such as: which material risks remain open? Which deadlines are being missed? Which recovery has been tested successfully? Which suppliers are not responding? What decision is needed from management? Frequency and depth depend on the actual risk; a single scanner score does not replace this information.
3. Regularly attend training yourself
Section 38(3) requires management to attend training regularly. It should provide the knowledge needed to identify and assess risks, evaluate risk management practice and judge its effects on services. Management therefore needs to understand the connections; it does not have to carry out every technical configuration itself.
The law specifies neither a fixed annual frequency nor a minimum number of hours. The current BSI guidance, version 1.0 of 17 April 2026, also takes a risk-based approach to duration and repetition: prior knowledge, role, changing risks and changes within the entity matter. It does not establish a blanket rule of “four hours every three years”. The guidance explains the authority’s view; it is not an additional law. BSI: management training, in particular sections 1.2 and 1.5.
Document the content, date, duration and attendance so that completed training remains traceable. An attendance certificate alone proves neither adequate content nor an effective security organisation.
When can personal liability arise?
Section 38(2) concerns liability towards the entity itself. It primarily refers to the rules applicable to that entity’s legal form. Direct liability under the BSIG is subsidiary, applying where such rules are absent. The subsection does not create an automatic payment obligation towards every customer who suffers damage. Section 38(2) BSIG.
On narrow screens, scroll the table sideways.
| Point to assess | What needs to be established |
|---|---|
| Personal duty | Was the person part of management, was the entity within scope, and did section 38(1) apply? |
| Breach of duty | Which necessary implementation or oversight was specifically omitted? A successful attack alone does not answer this. |
| Fault | Can the breach be attributed to the person’s fault under the applicable rules? |
| Damage and causal connection | What damage did the entity suffer specifically because of this breach of duty? |
| Liability rules | Which rules apply to the legal form and the particular claim, including any questions about the burden of proof? |
For a GmbH, the duties of care and compensation rules in section 43 GmbHG are particularly relevant; for a stock corporation, section 93 AktG applies. Section 93(2), second sentence, contains a specific burden-of-proof rule concerning the care exercised by management board members. This must not be turned into one identical rule for every management body and every legal form. Section 43 GmbHG, section 93 AktG.
A business decision under section 93(1), second sentence AktG concerns decisions taken on an adequate information basis for the company’s benefit. It is not general permission to disregard statutory duties. A specific distinction is needed between an allegation concerning a business choice, a binding duty or oversight of that duty.
Two cases illustrate the difference
Case A: an attack despite appropriate precautions. An undertaking is attacked through a previously unknown vulnerability. Its measures and oversight were organised according to risk; the incident is handled appropriately. The damage does not automatically make management liable. A successful attack alone does not establish a breach of duty.
Case B: a known material risk remains unaddressed. Management receives reliable evidence that a business-critical service cannot be recovered. Necessary remedial action and adequate checks are culpably omitted. If this causes avoidable damage, liability towards the entity may arise. The scope of the duty, fault, causation and amount of damage still need to be assessed.
Both examples are synthetic. They do not represent a court decision or a judgement on an actual loss event.
What can be delegated?
Qualified employees or service providers may undertake technical and organisational work. Examples include administration, risk analyses, organising training and preparing reports. Engaging a service provider does not, however, release management from its duty under section 38(1).
Sound delegation combines a clear mandate with appropriate selection, authority, resources, reporting routes and checks. Management must respond to identifiable problems. The oversight required in an individual case depends on the task, risks, organisation and legal form; the BSIG provides no universal delegation contract.
Dividing responsibilities within a management body of several people likewise does not give every other member a blanket exemption from liability. The actual allocation of responsibilities and the remaining organisational and oversight duties must be assessed separately.
Consider other types of liability separately
Civil liability towards the entity, third-party claims and public-law sanctions are different questions. Third-party claims require their own legal basis. For administrative offences, relevant rules include attribution to organs and representatives under section 9 OWiG and fines against legal persons or associations of persons under section 30 OWiG. Neither “only the company is ever affected” nor “the managing director always pays personally” accurately describes these rules. Section 9, section 30 OWiG.
Insurance is not a finding on liability either. Whether a particular claim is covered depends on the actual terms, exclusions and facts; having a D&O policy does not establish complete protection.
Which fines and supervisory measures may apply?
The figures below are maximum fine limits for specified offences, not penalties for every security shortcoming or an automatic personal bill for management. Section 65 distinguishes the duty, the person or entity addressed, and the breach; depending on the provision, the offences listed cover intentional or negligent conduct. Section 65 BSIG.
On narrow screens, scroll the table sideways.
| Situation | Statutory limit |
|---|---|
| Specified breaches, such as failures concerning required measures, documentation or staged notifications, by particularly important entities | Up to EUR 10 million under section 65(5), first sentence, point 1(a). |
| Corresponding breaches by important entities | Up to EUR 7 million under point (b). |
| The entity in scope belongs to an undertaking with worldwide total turnover above EUR 500 million | For the cases listed in subsections (6) and (7), limits of up to 2% or 1.4% respectively apply instead; turnover is determined under subsection (8). |
| Failure to register, or incorrect, incomplete or late registration, under section 33(1) or (2), or section 34(1) | Up to EUR 500,000 under section 65(2), point 6, and subsection (5), first sentence, point 5. |
There is therefore no blanket rule that “an NIS2 breach equals EUR 10 million”. Nor should the NIS2 and GDPR maximum amounts simply be added together: section 65(11) addresses cases where a GDPR fine has already been imposed for the same conduct.
As a further measure, section 61(9) provides, under narrow conditions, for a temporary prohibition on exercising management functions at particularly important entities. Neither an incident nor a low technical score is sufficient. The provision concerns failure to comply with official orders despite a deadline being set. The BSI informs the competent supervisory authority; as a last resort, that authority may temporarily prohibit unreliable management members from performing management functions. The measure must relate to the unfulfilled order; the prohibition lasts until the requirements are met. Section 61(9) BSIG.
Five steps for effective management arrangements
- Document the reasoning on scope. Record the legal entity, actual services, relationships between undertakings, thresholds and special rules. Reassess when circumstances change; an old sector check is not sufficient indefinitely.
- Connect measures with decisions. Make material risks, responsibilities, resources, deadlines and deviations visible. Do not replace legally required measures with mere acceptance of a risk.
- Make oversight demonstrable. Request meaningful reports and checks, follow up unresolved deficiencies and document decisions. An entirely green presentation with no testing scope is not reliable evidence.
- Plan management’s own training. Match content and repetition to roles, prior knowledge and changes. Track employee training and management competence separately.
- Test reporting and crisis readiness. Establish responsibilities, deputies, access and secure communication before a real incident. The internal approval chain must not block statutory reporting deadlines.
These steps are an organisational aid. They establish neither a fixed statutory format for management records nor an assurance that documented care defeats every claim.
Which records are useful now?
For the next management meeting, useful material includes a reasoned scope assessment, the most important open risks, a report on measures, and the current position on training and reporting readiness. Technical scan findings can explain individual risks; they confirm neither complete fulfilment of duties nor freedom from liability.
The NIS2 checklist organises the ten areas of measures. The incident reporting guide explains deadlines and responsibilities. NIS2 and ISO 27001 shows how an existing management system can help and which duties remain alongside it.