NIS2 for the CEO: Article 20 management liability, fines and European customer demands

NIS2 Article 20 makes the management body responsible. Can the CEO be held personally liable?

Yes, if the company is an essential or important entity under NIS2. The directive says:

• Article 20(1): management bodies approve the cybersecurity risk-management measures taken to comply with Article 21, oversee their implementation, and can be held liable for the entity's infringements of that Article.
• Article 20(2): members of management bodies are required to follow training.
• Article 32(6): natural persons who represent the entity, take decisions on its behalf or control it must have the power to ensure compliance and can be held liable for breach of that duty; it applies mutatis mutandis to important entities under Article 33(5).
• Article 32(5)(b): for essential entities, where earlier enforcement measures are ineffective and the deadline to remedy is missed, the authority can request a temporary prohibition, under national law, on persons at chief executive officer or legal representative level exercising managerial functions.

NIS2 is a directive, so actual liability depends on each Member State's transposition and is for legal counsel to assess case by case.

We have no subsidiary in Europe and are only a supplier to European customers. Does NIS2 concern us?

Determine your status first; the three statuses lead to completely different work:

Most Taiwanese manufacturers fall into the third group: Article 20 management liability does not land on you directly, but your customers' contracts do.

How large are NIS2 fines? Are they based on the Taiwanese company's turnover or the group's?

Each Member State's maximum fines must reach at least:

The turnover base in the text is that of "the undertaking to which the entity belongs", so it is not limited to the European subsidiary itself. The fines apply to infringements of Article 21 (security measures) or Article 23 (reporting). As NIS2 is a directive, actual amounts follow national transposition; whether a provision should be recognised or a contingent liability disclosed is for the statutory auditor and legal counsel to judge case by case.

A European customer wants us to sign NIS2 security clauses and accept audits. How should the CEO decide whether to accept?

First understand where the clauses come from: under Article 21, a regulated customer must manage security in its own supply chain, so it writes requirements into purchase contracts. The CEO should look at three things:

1. Can we deliver the commitment: compare reporting timelines, audit rights and security measures with your current system. With ISO 27001 in place, most requirements can be answered from existing controls and records.
2. Questionnaire or contractual obligation: if you are clearly not a regulated entity and the customer only asks for a questionnaire, answering from your ISO 27001 system and records is usually enough.
3. Legal judgment: questions of jurisdiction and applicability should go to a lawyer familiar with the local transposition.

For listed companies, their own requirements on suppliers are also an item in the TWSE ESG evaluation, S-15 (disclosing a supplier management policy requiring suppliers to follow rules on information and communication security, among others). The ESG evaluation covers listed companies; non-public companies are not bound by it but can follow it voluntarily.

Who owns NIS2? How do the board, the CEO and the CISO divide the work?

Article 20 requires the management body to approve, oversee and be trained, so in practice keep three kinds of records: management approval of security measures, oversight of their implementation, and training of management body members.

Listed companies can plug this into their existing organisation instead of building a new one:

These guidelines apply to listed companies; non-public companies are not bound by them but can follow them voluntarily.

How long does NIS2 take, and how much does existing ISO 27001 save?

As listed on the service page: from gap analysis to a working system, NIS2 consulting usually takes 4–6 months, or 2–3 months with an ISO 27001 foundation. There are five steps: applicability, gap analysis, system and documentation, technical controls, and audit readiness with ongoing maintenance.

ISO 27001 is not NIS2 compliance. NIS2 has no stand-alone certificate, and four things must be added on top of 27001:

• the Article 23 reporting deadlines
• registration with the authority
• supply chain security
• management responsibility (Article 20)

So when budgeting, the CEO should first ask "which status are we?" and then "how much does 27001 already cover?"

How does Winners Consulting help the CEO handle NIS2?

VP- and director-level consultants lead the work end to end, never outsourced.

• Status determination: by sector, size and the Member State's transposition, whether you are an essential or important entity, or only need to answer customers' supply chain requirements.
• The ten Article 21 measures: each compared with your current security management, incident reporting, supplier management and technical controls, producing a prioritised gap list.
• Management responsibility: a cybersecurity responsibility matrix and approval records for senior management.
• Reporting: a three-stage procedure for 24 hours, 72 hours and one month, tested with tabletop exercises so it can be repeated.
• Integration with ISO 27001: NIS2 differences added to the existing system, with one set of evidence for NIS2 and customer requirements.

Read more: NIS2 consulting, Choosing a NIS2 consultant, The CISO role page.

Request a free mechanism diagnosis