Good security, no paperwork: the article 20 gap

A specific obligation, not a statement of principle

Most of NIS2 is written as outcomes. Article 20 is not. It names two acts of the management body, each of which either happened or did not and leaves a record or fails to, and attaches a liability to them.

Approve. Oversee. Those are the acts; liability for infringements of article 21 by the entity is the exposure that goes with them. Article 20(2) adds a third duty: the members of the management body must follow training themselves — and member states must encourage entities to offer similar training to their employees.

What a supervisor can ask for

For an essential entity, article 32(2) gives the competent authority the power to request the information necessary to assess the cybersecurity risk-management measures, including documented cybersecurity policies (point (e)), access to data, documents and information (point (f)), and evidence of implementation of cybersecurity policies (point (g)). Article 33(2) gives comparable powers, used ex post, for an important entity. A minuted decision of the management body approving the measures is a document such a request can reach.

What "approve" has to look like

A minuted decision, by the body that actually governs the entity, referring to an identifiable set of measures, on a date. Not a slide noted in passing. Not an email from the CISO saying the programme is on track. Three things such a record shows:

1. A resolution or minuted decision naming what was approved — a risk assessment, a measures register, a policy set — with version and date.
2. Evidence of oversight since: recurring reporting to the management body, with enough substance to show it was read and acted upon.
3. Training records for the members of the management body themselves, not only for staff.

The second is the one that decays. Many entities approve once, during their NIS2 project, and then let the reporting lapse. Article 20 requires oversight of implementation, which is continuous by construction.

Liability is national; the ban exists everywhere

Article 20 says management bodies "can be held liable", and leaves the form of that liability to national law. How that liability is organised is therefore a question for each member state's transposition law, which the directive itself does not answer.

What every member state must provide for is article 32(5)(b):

This applies to essential entities, after other enforcement has failed. It is not a fine that a company absorbs: it is a temporary prohibition, requested by the competent authority, on a natural person at chief executive officer or legal representative level exercising managerial functions, which applies only until the entity has taken the necessary action (article 32(5)).

The fix is unglamorous

Nothing here requires new technology. It requires a decision to be taken by the right body, recorded properly, and refreshed on a cycle. For most organisations that is one agenda item, one template, and a recurring calendar entry.

The reason it does not happen is that it belongs to nobody: too administrative for the security team, too technical for the corporate secretary. Assigning it explicitly is most of the work.