NIS2 for the general counsel: jurisdiction, personal liability, investigations and customer clauses

What should a general counsel decide first: which Member State's authority has jurisdiction over us, and do we need an EU representative without an EU establishment?

Under Article 26, jurisdiction generally follows establishment:

Designating a representative is without prejudice to legal actions against the entity itself (paragraph 4). A company that is only a supplier to regulated EU customers and does not fall into these categories is usually not a regulated entity. Which Member State and which transposing law apply should be assessed by a lawyer familiar with that law.

Can directors and senior managers be held personally liable? What should we check in D&O insurance?

• Article 20(1): management bodies approve the cybersecurity risk-management measures under Article 21, oversee their implementation and can be held liable for the entity's infringements of that Article; Article 20(2) requires members to follow training.
• Article 32(5)(b): for essential entities, where other enforcement measures are ineffective, authorities may request a temporary prohibition on any natural person discharging managerial responsibilities; recital 133 says this is a last resort.
• Article 32(6): Member States must be able to hold liable natural persons who represent or control the entity; Article 33(5) applies this mutatis mutandis to important entities.
• European Commission FAQ: NIS2 introduces provisions on the liability of natural persons holding senior management positions.

What the general counsel prepares is the record of approval and oversight: board minutes, the approved security policy and training records. The exact scope of personal liability depends on each national transposing law; whether D&O insurance covers related fines or defence costs depends on the policy wording and local law, to be confirmed by the insurance broker and a lawyer.

What tools can the authority use when it investigates, and how are the maximum fines calculated?

Article 32(2) lists the supervisory measures for essential entities:

• On-site inspections and off-site supervision
• Regular and targeted security audits by an independent body or the competent authority
• Ad hoc audits, including after a significant incident or an infringement
• Security scans
• Requests for information on cybersecurity risk-management measures and policies
• Requests for access to data, documents and information needed for supervision
• Requests for evidence of implementation of cybersecurity policies, such as results of audits by a qualified auditor

The supervisory regimes for essential and important entities differ (Commission FAQ). Fines (Article 34): for essential entities infringing Article 21 or 23, a maximum of at least EUR 10 million or 2% of total worldwide annual turnover, whichever is higher; for important entities at least EUR 7 million or 1.4%. Penalties for other infringements of national transposing measures are set by Member States under Article 36 and must be effective, proportionate and dissuasive. Build a document index so you can hand over evidence on request.

Does notifying a significant incident amount to admitting an infringement? How should we prepare the notification and the evidence?

• Article 23(1): the mere act of notification does not subject the notifying entity to increased liability; the content of the notification, however, becomes the factual basis for later supervision.
• Final report (within one month of the incident notification, Article 23(4)(d)) must include a detailed description of the incident including its severity and impact, the type of threat or root cause likely to have triggered it, applied and ongoing mitigation measures, and any cross-border impact.
• Interface with the GDPR: where infringements of Articles 21 or 23 may entail a personal data breach, the authority must inform the GDPR supervisory authorities (Article 35(1)); where a GDPR supervisory authority has already fined the same conduct, no fine is imposed under Article 34, although other enforcement measures remain available (Article 35(2)).

Practical framework: separate confirmed facts from assumptions in notifications; secure incident logs, forensic and decision records first and record who handled them; which documents can be protected by legal privilege should be assessed by a lawyer under local law.

An EU customer has sent NIS2 security clauses. What is the general counsel's review checklist?

Customers manage supply-chain security under Article 21(2)(d) and, under Article 21(3), must take into account the vulnerabilities specific to each direct supplier and service provider, so the clauses land on you.

The legal effect of each clause should be assessed by a lawyer familiar with the local law.

We already have ISO 27001. Can we use it to show we meet our Article 21 obligations?

NIS2 has no certificate, and an ISO 27001 certificate does not equal NIS2 compliance; it can, however, be the backbone of your evidence:

• Article 21(1) requires appropriate and proportionate technical, operational and organisational measures, taking into account the state of the art and the cost of implementation. The general counsel needs to explain why the chosen measures are appropriate; the risk assessment and the Statement of Applicability (SoA) are the written basis for that explanation.
• Article 32(2) lets authorities request evidence of implementation, such as audit results from a qualified auditor; internal audit and certification audit reports can be used.
• NIS2 adds Article 23 reporting deadlines, registration with the authority, management-body approval and training, and supply-chain security, which must be added on top of ISO 27001.

Timeline (as listed on the service page): typically 4–6 months from gap analysis to an established system; 2–3 months for organisations with ISO 27001 in place.

How does Winners Consulting help a general counsel with NIS2?

• Status and applicability: determine, by sector, size and the transposing law of the Member State concerned, whether you are an essential or important entity or only need to respond to customers' supply-chain requirements
• Gap analysis: compare against each of the ten Article 21 measures and produce a prioritised remediation list
• Reporting: build a three-stage 24-hour, 72-hour and one-month reporting procedure and confirm through tabletop exercises that it can be repeated
• Management accountability: build a security responsibility matrix and approval records for senior management
• Supply-chain security: build a supplier risk assessment procedure and contractual security clauses
• Integration with ISO 27001: add the NIS2 differences to your existing system so one set of evidence covers NIS2 and customer requirements
• Who leads: VP- and director-level consultants lead the work end to end, never outsourced

More: NIS2 consulting, How to choose a NIS2 consultant in Taiwan, How to choose a DORA consultant in Taiwan. Request a free mechanism diagnosis