NIS2 for Management Bodies — Article 20: approve, oversee, be liable, be trained

In this lesson

State the four elements of article 20 precisely, and say which of them binds the management body, which binds its members and which only binds the member state.
Distinguish what the directive fixes from what it leaves to national law, in particular the liability rules.
Build the evidence file a supervisor expects for each duty: the approval, the oversight, the training.
Spot the governance failures that leave a board unable to prove what it actually did.

Why a security directive has a governance article

Directive (EU) 2022/2555 spends most of its length on authorities, cooperation and the security measures that entities must take. Article 20 is short, but it changes who answers for those measures. The legislator explained the intent in recital 137: the directive should ensure "a high level of responsibility for the cybersecurity risk-management measures and reporting obligations at the level of the essential and important entities", and therefore the management bodies of those entities should approve the measures and oversee their implementation.

The practical consequence is simple. Cybersecurity can no longer be treated as a technical subject that the board hears about once a year. The board, or whatever body governs the entity, takes a decision on the measures, keeps watching them, can be held liable when they fail to meet article 21, and its members must have the knowledge to do all of that.

One point of legal mechanics matters before anything else. A directive is addressed to the member states (article 46). Article 20 does not speak to your board directly: it obliges each member state to ensure that boards carry these duties. The text that binds your directors is the national law that transposes the directive. That law may go further than the directive, because article 5 allows member states to adopt or maintain provisions ensuring a higher level of cybersecurity. Where the national text and this lesson differ, the national text governs, and the transposition tracker is where to start looking.

The text, element by element

Art. 20(1)

Article 20(1) requires member states to ensure that the management bodies of essential and important entities "approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article."

Three duties sit in that sentence, and each has a precise object.

Approve. The object is the set of measures taken to comply with article 21: the risk analysis, the policies and the ten minimum measures of article 21(2) as the entity has implemented them. It is not a general statement that security matters.
Oversee implementation. Approval is a moment; oversight is continuous. A board that approved measures two years ago and has not looked at them since has met the first duty once and the second not at all.
Can be held liable. The liability attaches to infringements of article 21 by the entity. The directive establishes that it must be possible to hold the management body liable, but it does not write the liability regime itself.

The second subparagraph adds a limit: the paragraph applies "without prejudice to national law as regards the liability rules applicable to public institutions, as well as the liability of public servants and elected or appointed officials." For a public administration entity in scope, national public law on the liability of officials continues to apply.

Liability: what the directive fixes and what it leaves

Recital 128

Boards often hear that NIS2 makes directors personally liable. The accurate statement is narrower. Article 20(1) requires that the management body can be held liable for infringements of article 21. Article 32(6), studied in module 4, requires that natural persons who represent or control an entity can be held liable for breach of their duties to ensure compliance with the directive. How that liability is established, before which body, with what standard of fault and with what consequences is decided by national law.

Recital 128 makes one limit explicit: the directive "does not require Member States to provide for criminal or civil liability with regard to natural persons with responsibility for ensuring that an entity complies with this Directive for damage suffered by third parties as a result of an infringement of this Directive." A member state may choose to go further. National liability regimes may therefore differ, and no single European answer exists to the question what happens to me personally? General counsel should obtain a written answer for each jurisdiction where the entity is in scope.

Training: who must, and who is only encouraged

Art. 20(2)

Article 20(2) contains two different instructions to member states, and they must not be merged.

First, member states shall ensure that "the members of the management bodies of essential and important entities are required to follow training". This is mandatory, and it is individual: the requirement attaches to each member, not to the body as a whole. A board where six of nine directors have been trained has three members who have not yet met the requirement.

Second, member states "shall encourage essential and important entities to offer similar training to their employees on a regular basis". For employees, article 20(2) asks the state to encourage, not to impose. Staff training is not left to chance, however: article 21(2)(g) lists "basic cyber hygiene practices and cybersecurity training" among the minimum risk-management measures, so the entity's own security measures must include it.

The purpose clause tells you what the training of members must achieve: knowledge and skills sufficient "to enable them to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity." That is a demanding standard. A generic awareness video about phishing and passwords does not equip a director to assess risk-management practices. The directive sets no duration, frequency or format for the members' training; national law or the competent authority may.

Who is the management body?

Article 6 defines forty-one terms, and management body is not one of them. Which body carries the article 20 duties is therefore a question of national company law and of the entity's own constitution. In a one-tier structure, the answer is usually the board of directors. In a two-tier structure, the duties may fall on the management board, the supervisory board, or be split between them, depending on how the national transposition reads. For a public administration entity, the answer depends on its statute.

Two practical rules follow. Record in writing which body the entity treats as its management body for NIS2 purposes and why, with counsel's view attached. And where the duties are split, make sure nothing falls between the two bodies: an approval by the executive board that the supervisory board never sees can leave the oversight duty unmet.

The evidence file, duty by duty

Supervisors may request "documented cybersecurity policies" and "evidence of implementation of cybersecurity policies" (article 32(2)(e) and (g) for essential entities; article 33(2)(d) and (f) for important entities). Governance evidence is among the easiest things to ask for and among the hardest to reconstruct afterwards. Build it as you go. The directive does not prescribe the form of this evidence: the table below is practice, not a list of legal requirements.

Duty	What proves it	Common weakness
Approve	A resolution in the minutes naming the document approved, its version and date, and the body that approved it	A minute saying only that the board took note of the presentation: no decision, no identifiable object
Oversee	A reporting calendar, board packs, minutes showing questions asked and actions assigned, and an action log closed over time	Reports go to an executive committee and never reach the body that approved
Liability	Counsel's written analysis of the national regime for each jurisdiction, and a decision on insurance and indemnities	Assumptions copied from a vendor brochure instead of the national text
Training	A register per member: date, provider, content, duration, and how the content meets the purpose of article 20(2)	New directors join and are never trained; nobody tracks it

A decision taken without the information needed to take it is weak evidence even when it is minuted. The papers before the board should show what was approved: the risk analysis summary, the measures, the residual risks being accepted, and the budget.

In practice

A fictional case. Ravenmoor Water supplies drinking water to a region, employs 700 people and is therefore large: it is an essential entity under article 3(1)(a). In March, its board of nine received a forty-slide presentation on its NIS2 programme and the minutes recorded only that the board took note. Quarterly security reports then went to the executive committee. Two directors had attended a half-day training course; the other seven had not.

When the competent authority announced an inspection, it asked for the decision approving the risk-management measures, the reports received since, and the training records of the management body. The company secretary found no resolution, no identifiable document approved, no board-level oversight after March, and training for two members out of nine.

The board's remediation took one quarter. It adopted a resolution approving Cybersecurity risk-management measures, version 1.3, annexed to the minutes, with the residual risks listed and accepted by name. It added security as a standing item four times a year, with an annual re-approval cycle. Each director completed training designed around the article 20(2) purpose clause, recorded in a register held by the company secretary. None of that repaired the past; all of it changed what the next request would find.

What a supervisor will ask

Which body approved the cybersecurity risk-management measures, on what date, and what exactly did it approve? The minutes, the resolution and the approved document with its version.
How has the management body overseen implementation since that approval? Board packs, minutes showing discussion and challenge, and the action log.
Which members of the management body have followed training, when, and on what content? The training register and course outlines.
How does the entity identify its management body under national law? A short legal note, signed off by counsel.

Key points

Article 20(1): the management body approves the article 21 measures, oversees their implementation, and can be held liable for infringements of article 21.
Liability rules are national. The directive does not require criminal or civil liability of natural persons for damage to third parties (recital 128), and leaves public-sector liability rules untouched.
Article 20(2): members of the management body are required to follow training; member states encourage entities to train employees, while article 21(2)(g) separately makes cybersecurity training part of the measures.
The term management body is not defined in article 6: national company law and the entity's constitution decide which body it is.
In practice, evidence is built in advance: a resolution with an identifiable object, recurring oversight, and an individual training register.