What legal responsibility does a CEO carry?

Under Article 8(2) of the Company Act, a manager of a company is also a responsible person of the company within the scope of their duties; Article 23 requires a responsible person to perform duties loyally and with the care of a good administrator, with liability for damages if a breach causes loss to the company, and joint liability with the company if a breach of law causes loss to others. Whether liability arises in a given case is for legal counsel to judge.

What statements does a CEO sign?

A public company's financial reports are signed or sealed by the chairman, managers and the accounting head (Securities and Exchange Act, Article 14(3)); the internal control statement is issued by the board and the CEO, based mainly on the self-assessment (internal control regulations, Articles 22 and 24); under Article 8 of the Ethical Corporate Management Best Practice Principles for TWSE/TPEx Listed Companies, listed companies should require directors and senior management to sign a statement of compliance with the ethical management policy. Companies that are not public companies are not covered by these rules and can use them voluntarily.

Can the chairman also be the CEO?

Article 23 of the Corporate Governance Best-Practice Principles for TWSE/TPEx Listed Companies states that the duties of the chairman and the CEO should be clearly divided, and that the chairman and the CEO or equivalent should not be the same person. The principles are for listed companies; companies that are not public companies are not covered.

With a limited budget, what should the CEO do first?

Rank everything on one risk map: classify by risk category, assess impact using penalty ceilings, customer requirements and market access, and set the order against the risk appetite; build the backbone that shares evidence first, for example ISO 27001, so ISO 27701, 22301 and 42001 share one management system.

Which certifications earn a bonus in the TWSE ESG evaluation?

In the 2026 and 2027 indicators, S-12 adds one point overall for ISO 27001, CNS 27001 or similar third-party certification; S-10 adds one point for TIPS, ISO 56001 or similar third-party certification; G-18 on risk management is an AA item worth one extra point.

If an employee infringes someone else's trade secret, can the company be fined?

Article 13-4 of the Trade Secrets Act states that when a company's representative or employee commits the offence in the course of business, the company is also fined; the Intellectual Property Office explains that the article punishes the company's own breach of its duty of supervision, and a company may show it has implemented a compliance system to claim the exemption in the proviso.

If the company breaches personal data rules, can the person in charge be fined personally?

Under Article 50 of the Personal Data Protection Act, when a non-government entity is fined, its representative, manager or other person with authority to represent it is fined the same amount, unless they can show they fulfilled their duty to prevent the breach. Partial amendments promulgated on 11 November 2025 take effect on a date set by the Executive Yuan.

With an ISO certificate, are we compliant with EU law?

No. GDPR, NIS2 and the EU CRA have no standalone certificate: NIS2 requires the Article 21 measures and Article 23 reporting; the EU CRA requires conformity assessment by product category and CE marking; GDPR compliance is shown through the RoPA, DPIAs, processor contracts, transfer mechanisms and breach records. ISO 42001 certification is not EU AI Act compliance either.

Can EU NIS2 reach the CEO personally?

If the company is an entity in scope of NIS2, Article 20 requires the management body to approve and oversee cybersecurity risk-management measures, and it can be held liable for infringements; Article 32 lets authorities, for essential entities, request a temporary ban on persons at CEO or legal representative level from exercising managerial functions. Where the company is only a supplier to an entity in scope, the requirements usually come by contract.

What laws and standards is a CEO accountable for? 12 requirements explained one by one

Direct answer: in corporate governance and regulation, the CEO is the final owner of execution. Under Taiwan's Company Act, a manager is also a responsible person of the company within the scope of their duties and must perform those duties loyally and with the care of a good administrator; a public company's financial reports are signed by the chairman, managers and the accounting head, and the internal control statement is issued by the board and the CEO. The Trade Secrets Act and the Personal Data Protection Act also penalise companies and their representatives. Where the company does business in the EU, NIS2 requires the management bodies of entities in scope to approve and oversee security measures, and the EU CRA and the EU AI Act set fines by worldwide annual turnover. Security, risk, privacy, AI, business continuity, integrity and export-market rules all come back to three decisions on the CEO's desk: which requirements really apply, which comes first, and where people and budget go. Two things to remember: GDPR, NIS2 and the EU CRA have no standalone certificate, and an ISO certificate is not legal compliance.

The CEO in corporate governance: legal responsibilities and the statements you issue

Who	Rule	Key wording	What it means for the CEO
All companies	Company Act, Article 8(2)	A manager of a company is also a responsible person of the company within the scope of their duties	Within their duties, the CEO carries the responsibility of a responsible person
All companies	Company Act, Article 23(1) and (2)	A responsible person shall perform duties loyally and with the care of a good administrator and is liable for damages if a breach causes loss to the company; if a breach of law in conducting company business causes loss to others, they are jointly liable with the company	Decisions and oversight need records that explain them
All companies	Trade Secrets Act, Article 13-4	When a company's representative or employee commits a trade secret offence in the course of business, the company is also fined; a company that did its best to prevent it can invoke the proviso	"Prevention" needs a system and records
All non-government entities	Personal Data Protection Act, Article 50	When a non-government entity is fined, its representative, manager or other person with authority to represent it is fined the same amount, unless they can show they fulfilled their duty to prevent the breach	Privacy breaches can reach the representative personally
Public companies	Securities and Exchange Act, Articles 14(3) and 20-1	Financial reports are signed or sealed by the chairman, managers and the accounting head; signers are liable for damages unless they can show due care	When the CEO signs the financial reports, due care must be provable
Public companies	Internal control regulations for public companies, Articles 9-1, 22 and 24	Allocate adequate people and equipment for information security; the self-assessment is the main basis for the board and the CEO to issue the internal control statement	Audit results of new systems must feed the basis for the statement
Listed companies	Corporate Governance Best-Practice Principles for TWSE/TPEx Listed Companies, Article 23	The duties of the chairman and the CEO should be clearly divided; the two roles should not be held by the same person	Governance and execution kept apart
Listed companies	TWSE Risk Management Best Practice Principles for Listed Companies, Articles 7 and 13	A clear risk management statement and commitment from governing bodies and senior management; the board allocates and assigns sufficient and appropriate resources	Risk management needs management commitment and resources
Listed companies	Ethical Corporate Management Best Practice Principles for TWSE/TPEx Listed Companies, Articles 8 and 22	Directors and senior management sign a statement of compliance with the ethical management policy; the chairman, CEO or senior management regularly communicate the importance of integrity	The CEO personally signs and communicates
Listed companies	Cybersecurity Control Guidelines for Listed Companies, Article 4	The security policy is approved by a manager at senior vice president level or above and reviewed regularly	The approval level for the security policy
Entities in scope of EU NIS2	NIS2, Article 20 and Article 32(5) and (6)	Management bodies approve and oversee cybersecurity risk-management measures, can be held liable for infringements and must follow training; for essential entities, authorities can request a temporary ban on persons at CEO or legal representative level from exercising managerial functions	With EU business, first determine whether the company is an entity in scope
Manufacturers placing digital products on the EU market	EU CRA, Articles 13 and 64	Design, develop and produce to the essential requirements in Annex I; breaching them can cost up to EUR 15 million or 2.5% of worldwide annual turnover	Whether products can enter the EU market
Providers and deployers of AI systems in the EU	EU AI Act, Article 99	Prohibited practices up to EUR 35 million or 7% of worldwide annual turnover; other obligations up to EUR 15 million or 3%	Determine role and risk tier before using or selling AI

Companies that are not public companies are not covered by the public and listed company rules above and can use them voluntarily. The financial sector has additional rules; for example, at banks and financial holding companies the chief information security officer and the chief risk officer must be at senior vice president level or above, or have equivalent duties. Partial amendments to the Personal Data Protection Act promulgated on 11 November 2025 take effect on a date set by the Executive Yuan; until then the current text applies. Whether any of these liabilities arises is for legal counsel to judge case by case.

TWSE ESG evaluation: the indicators a CEO should watch

The ESG evaluation replaced the corporate governance evaluation from 2026 and covers listed companies. The 2026 edition (the first) has three dimensions and 75 indicators, assesses 1 January to 31 December 2026, and publishes results by the end of April 2027; the 2027 indicators were published on 30 October 2026. Except for S-7, the indicators below have the same wording in both editions.

Indicator	Content (summary)	Bonus	Service
G-18	Risk management overseen by the audit committee or a board-level functional committee, board-approved policy and procedures, disclosure of the framework and operation, and a report to the board at least once a year	AA item, one extra point overall	ERM
S-7	A board-approved ethical management policy, a full- or part-time unit, implementation and a report to the board at least once a year (2027 wording; split into S-7 and S-8 in 2026)	—	ISO 37001
S-9	Detailed disclosure on the company website of a whistleblowing system for insiders and outsiders covering illegal (including corruption) and unethical conduct	—	ISO 37001
S-10	An intellectual property management plan linked to business goals and its implementation, reported to the board at least once a year	One extra point overall for TIPS, ISO 56001 or similar third-party certification	Trade secret protection, ISO 56001
S-12	Cybersecurity risk management framework, policy, concrete programmes and resources (assessed from the annual report)	One extra point overall for ISO 27001, CNS 27001 or similar third-party certification	ISO 27001
S-13	A personal data protection policy, disclosed with its implementation	—	ISO 27701, GDPR
S-15	A supplier management policy requiring suppliers to follow rules on cybersecurity or privacy, among others	—	TISAX, NIS2

Three items carry a bonus: G-18 when scored, and S-10 and S-12 with third-party certification. When ranking investments, the bonus is one of the benefits a CEO can quantify. Companies that are not public companies are not evaluated and can use the indicators voluntarily.

The 12 requirements at a glance

Requirement	What it means for the CEO	Is there a certificate?
ERM (COSO ERM, ISO 31000)	The backbone for accounting to the board on risk and setting priorities	No
ISO 37001	Legal exposure to cross-border bribery and customer integrity due diligence	Yes, third-party certification; it does not guarantee that no bribery occurs
ISO 27001	The first security certificate customers and tenders ask for	Yes, third-party certification
ISO 22301	Recovery times promised to customers must be backed by a BIA and exercises	Yes, third-party certification
Trade secret protection and ISO 56001	Core technology that holds up in court; a bonus under ESG indicator S-10	None for the Trade Secrets Act; ISO 56001 yes
EU CRA	From 11 December 2027, non-compliant digital products may not be placed on the EU market	No standalone certificate; conformity assessment by product category and CE marking
NIS2	Management body accountability for entities in scope; suppliers take it on by contract	No
EU AI Act and ISO 42001	Legal obligations for AI and proof of AI governance	ISO 42001 yes; it is not EU AI Act compliance
GDPR and ISO 27701	EU personal data, with fines up to 4% of worldwide annual turnover or EUR 20 million	ISO 27701 yes; no official GDPR certificate
TISAX	Carmakers assess the information security of supplier sites	An assessment and exchange mechanism, not an ISO certificate; results are shared as labels valid for 3 years
Digital transformation	Digitisation that does not widen the attack surface or interrupt core business	Per the service page, benchmarked against ISO 27001 security requirements
AI transformation	Governance first, with AI investment returns that can be tracked	ISO 42001 can be built alongside; certification is not EU AI Act compliance

Requirement by requirement: what the CEO decides, what comes first, how long it takes

Each service has its own page that answers your role’s questions one by one.

How it fits the systems you already have

New requirements should fold into the internal control, risk management, integrity and security systems you already have, not form a second system.

Existing system and basis	What you already have	How the new requirements fold in
Internal control regulations, Articles 22 and 24	The annual self-assessment and the internal control statement	Feed each management system's internal audit results into the basis for the self-assessment; put findings into existing corrective action tracking
Risk management principles, Articles 13–15	Board-approved policy, risk committee and annual report	Bring security, continuity, AI, privacy and EU regulatory risk onto one risk map and into one report
Ethical management principles, Article 17	A dedicated unit reporting to the board every year	Add ISO 37001 risk assessments, due diligence and whistleblowing records to the same report
Cybersecurity control guidelines, Article 37	Regular security reports to the board or management	Put ISO 27001 audit results and reporting drills into the same report
Annual report regulations, Article 18, item 6	The annual report's cybersecurity section	Disclose resources, programmes and certification results with one set of numbers

These rules apply to public or listed companies; companies that are not public companies are not covered and can use them voluntarily. For each service, see: ERM consulting, ISO 37001, ISO 27001 consulting, ISO 22301, Trade secret protection programme, EU compliance integration.

How Winners Consulting works

This is Winners Consulting's own description; hold us to the questions above, just as you would any other consultant.

Who leads: vice-president and director-level consultants personally lead the work end to end, never outsourced, and the team holds ISO lead auditor qualifications
Applicability first: we confirm the requirements of customers, tenders, regulators and export markets, decide which laws and standards really apply, then define scope
One roadmap: we combine the requirements into one roadmap: sequence, shared evidence, and which customer or market each investment serves
What the CEO receives: a decision basis for your management meeting: applicable requirements, priorities and budget structure
Division of work: certification bodies certify and we accompany you, never auditing on their behalf; the internal control statement and financial reporting matters stay with the external auditor, and legal opinions with partner lawyers
First step: the first mechanism diagnosis is free

Compliance needs all three; a consultant's value is integration

CRA, TISAX, ISO 27701 and the AI Act are not single technical problems. They are only complete when process, security technology and legal compliance all hold at the same time. Fix only one and the gaps in the other two surface during audits, incident reporting or customer due diligence, and the work has to be redone.

Dimension	The question it answers	Typical gap when only this part is done
Process (management system)	Who is responsible, what is done, when, where the evidence is, how it improves	Tools are in place but nobody runs them on schedule, so there are no records at audit time
Security technology	How controls are designed and how their effectiveness is verified	Documents are complete but the systems do not actually do what they describe
Legal compliance	Which regulation applies, which role you hold, the deadlines and penalties	Controls are built against the wrong regulation or role, so obligations are not covered

Winners' consulting team covers all three dimensions and plans regulatory scoping, process design and technical controls together, so a single body of evidence serves multiple regulations and customer requirements.