Fiduciary duty in cybersecurity
The duty of members of the management body to approve and oversee cybersecurity measures and to be trained on them, failing which they can be held personally liable.
Fiduciary duty in cybersecurity refers to the obligation set by Article 20 of the NIS2 Directive: cybersecurity becomes a duty of care of the management body itself, no longer only of technical management. Members of the management body, whether the board of directors, the supervisory board or any equivalent body, must approve cybersecurity risk-management measures, oversee their implementation and take appropriate training. If they fail to, they can be held personally liable, separately from the company. The shift is sharp. Cybersecurity moves out of the information security officer's operational remit and into the board's fiduciary governance, on the same footing as accounting or internal control obligations. National transpositions spell out the managers' liability: in Germany, section 38 of the BSIG, in force since December 6, 2025, makes members of the management body liable to their own company for damage caused by a breach of their duties, while fines, up to ten million euros or 2% of worldwide turnover for an essential entity, fall on the entity. The directive itself, in Article 32, goes further and allows a temporary ban on holding management functions in essential entities. The D&O market feels this directly. Its scope extends to cyber-originated losses that reveal a governance failure, and it now overlaps with the company's cyber policy in a way it never did before.
Textbook case: the chief executive of a French pharmaceutical company, an essential entity under NIS2, failed to attend mandatory training sessions and did not approve the plan for updating critical systems. Following a ransomware attack exploiting an unpatched vulnerability, ANSSI documents the breach of Article 20 obligations. The company's D&O policy covers the executive's defense costs, but the authorities are considering a personal fine of two hundred thousand euros. The D&O insurer verifies whether the policy excludes deliberate regulatory breaches and opens a shared liability investigation with the company's cyber insurer.
- German NIS 2 Implementation Act (NIS2UmsuCG), section 38 BSIG, in force December 6, 2025, as reported by Bird & Bird, "German Bundestag passes German NIS 2 Implementation Act", 2025, and nisd2.eu, "Management liability"
- Directive (EU) 2022/2555 (NIS 2), Article 32(5)(b)
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.