Six EU digital laws. Only one question every board should be asking

Preliminary remark: While this post draws on Belgian law as a concrete example, its analysis maps directly onto the EU frameworks that apply across all Member States. Belgium serves as a useful reference point: the CCB is widely regarded as one of Europe's most sophisticated and active national cybersecurity regulators, and Belgian enforcement practice in NIS2 and data protection provides a reliable early indicator of where regulatory practice across the EU is heading.

The past four years have produced a wave of EU digital regulation on top of the GDPR, such as the NIS2 Directive (“NIS2”), Critical Entities Resilience Directive (“CER”), the AI Act, the Cyber Resilience Act (“CRA”) and the Data Act. Each has its own scope, its own obligations, and its own enforcement regime. For general counsel and compliance officers, the challenge is not understanding any single framework. It is understanding how they interact, where the exposure is real, and, most importantly, where the personal liability of individual managers and directors actually sits. 

The answer is less uniform than most people assume. And the divergence matters enormously for how organisations prioritise their governance response. 

The question that cuts across all six frameworks 

When a regulator investigates a failure, a data breach, a cybersecurity incident, an AI system that causes harm, a product with a critical vulnerability, the first question is whether the organisation met its legal obligations. The second question, increasingly, is whether the right people within the organisation knew about the risk, had the authority and resources to address it, and can demonstrate that they exercised appropriate oversight. 

Personal liability turns around that second question. And the answer differs depending on which legal framework is in play. 

The matrix: where personal exposure actually sits 

This post covers the six principal EU digital law frameworks currently in force or in the final stages of implementation. The purpose is not to provide a definitive legal opinion on any specific situation, it is to give general counsel and boards a clear map of where the genuine personal exposure lies and where it does not. 

NIS2: explicit, direct, regulatory 

Of the major EU digital law frameworks, NIS2 stands out as the only one that creates an explicit, direct, regulatory personal liability mechanism for individual board members. This flows from the Directive itself and applies across all Member States. Belgium has implemented it with particular specificity and force: the CCB can name, suspend and permanently bar individual directors, making it a leading reference point for how this mechanism operates in practice. Under Articles 31 and 61, the management body must approve cybersecurity measures, oversee their implementation and complete mandatory training. Members may be held personally liable for infringements. The CCB can temporarily or permanently exclude individual directors from managerial roles and name them publicly. This is not a general company law obligation, it is a specific statutory mechanism that attaches to the regulatory status of the entity as essential or important under NIS2. 

The exposure is real, active and currently being tested. The CCB is supervising essential entities on an ex-ante basis. The first systematic wave of supervisory requests went out in April 2026. Enforcement decisions against individuals are a matter of when, not if.

CER: indirect, through general company law 

The CER Directive (Directive (EU) 2022/2557) and the Belgian Act of 19 December 2025 on the resilience of critical entities (“CER Act”) create no equivalent personal liability mechanism for board members. Criminal and administrative sanctions under the CER Act target the critical entity as a legal person. The only routes to personal exposure for an individual director under CER are the general concurrent liability provision of Article 5 of the Criminal Code (for a director who knowingly and intentionally participates in the offence) and the obstruction offence in Article 41 §2 CER Act for directors who personally interfere with inspections or provide false information. Beyond these, directors face only their ordinary duty of diligent administration under the Belgian Code of Companies and Associations (Wetboek van Vennootschappen en Verenigingen/Code des Sociétés et des Associations, hereinafter “WVV/CSA”). 

The practical exposure level is therefore significantly lower than under NIS2.In practice, however, as analysed in our second post in this series, CER designation triggers NIS2 essential entity status through the bridge provision of Article 3 §4 of the NIS2 Act. The NIS2 management body obligations therefore apply to CER-designated entities by operation of law. 

GDPR: accountability-based, evolving 

The GDPR (Regulation (EU) 2016/679) creates no explicit management body liability mechanism comparable to NIS2. Fines under Articles 83 and 84 GDPR are addressed to the controller or processor as an organisation. Individual liability must be constructed from general company law, the WVV/CSA duty of care, Article 6.5 of the New Belgian Civil Code (Nieuw Burgerlijk Wetboek/Nouveau Code Civil, hereinafter "NBW/NCC”) for extra-contractual liability. 

That said, enforcement practice is evolving. The accountability principle under Article 5(2) GDPR, which requires controllers to be able to demonstrate compliance, is increasingly being used by supervisory authorities, including the Belgian Data Protection Authority (“GBA/APD”), to assess whether adequate organisational structures were in place. A board that approved an AI deployment, a data sharing arrangement, or a new processing system without obtaining legal advice, without commissioning a DPIA, and without designating a DPO is not criminally exposed under GDPR. But it may be civilly exposed under the WVV/CSA if the failure causes damage to the organisation, and the GBA/APD's enforcement reports increasingly name the governance failures, including board-level passivity, as aggravating factors in penalty assessments. 

The regulatory trajectory points in one direction: personal accountability at senior level is entering GDPR enforcement even where the statute does not yet provide an explicit mechanism. 

AI Act: governance obligations, no direct board liability yet 

The AI Act (Regulation (EU) 2024/1689) creates obligations on providers and deployers of AI systems, calibrated by risk level. High-risk AI systems require conformity assessments, registration, human oversight mechanisms, and transparency obligations. The AI Act's literacy obligation under Article 4 has been in force since February 2025. 

There is no explicit management body liability mechanism in the AI Act comparable to NIS2. Enforcement fines are addressed to the provider or deployer as an organisation. Individual liability again falls back on general company law. 

However, two observations are worth making. 

First, the AI Act's governance obligations, establishing a compliance function, maintaining technical documentation, conducting conformity assessments are precisely the type of systematic oversight activities that create board-level accountability exposure under the WVV/CSA and GDPR's accountability principle when they are absent. 

Second, the Commission has signaled in its AI liability discussions that individual accountability for high-risk AI decisions will be strengthened in future legislation. The AI Act is likely a transitional position, not the final word. 

Cyber Resilience Act: product liability, not board liability 

The Cyber Resilience Act (Regulation (EU) 2024/2847, CRA) imposes cybersecurity requirements on manufacturers of products with digital elements: vulnerability reporting, security updates, and conformity assessments. The CRA's vulnerability reporting obligation applies from September 2026. 

The CRA sits in a product liability framework, not a regulatory governance framework. Obligations are attached to manufacturers and importers of products, not to board members of those organisations. Personal exposure for directors of CRA-regulated manufacturers is confined to general company law, the WVV/CSA and Article 6.5 NBW/NCC and arises only where the board's failure to implement adequate product security processes can be shown to have caused damage. 

The CRA is relevant for boards of manufacturing companies primarily as a cost and operational risk, not as a direct personal liability mechanism. 

Data Act: contractual fairness, no individual liability 

The Data Act (Regulation (EU) 2023/2584, applicable since September 2025) regulates access to data generated by connected products and related services, B2B data sharing fairness, and public-sector data access. Enforcement is directed at the data holder or controller as an organisation. There is no individual liability mechanism. 

The Data Act is relevant for boards primarily through its impact on commercial strategy: data access obligations, switching rights, fairness requirements in contracts, rather than through any direct personal exposure. 

The pattern, and what it means 

The pattern that emerges from this analysis is striking. Of the six major EU digital law frameworks currently in force or in final implementation, only one (NIS2) creates an explicit, direct, regulatory personal liability mechanism for individual board members. All others leave individual exposure to be constructed from general company law, in Belgium through the WVV/CSA duty of care, the NBW/NCC extra-contractual liability provisions, or increasingly through accountability-based enforcement practice. 

NIS2 is not typical. It is the direction of travel 

The legislative intent behind the NIS2 management body provisions was precisely to break the pattern of passive board oversight of cybersecurity, a pattern that had persisted through the NIS1 era precisely because there was no personal incentive for directors to engage. By creating explicit individual exposure, the NIS2 legislator expected to change board behaviour. We expect that the CER Act, the AI Act and future digital legislation will increasingly follow the same model as regulators conclude that organisational fines alone are insufficient to drive genuine senior-level accountability. 

The governance architecture implication 

For general counsel advising boards on digital law compliance, the practical implication of this analysis is the following. 

Building a genuinely compliant NIS2 governance architecture, board approval of the cybersecurity programme, quarterly KPI reporting, mandatory training, documented oversight, simultaneously satisfies the most demanding personal liability standard in the current EU digital law landscape. It also provides the evidentiary foundation for defending against accountability challenges under GDPR, AI Act and CER, even though those frameworks do not yet impose equivalent explicit board liability. 

In other words: NIS2 governance is the floor, not the ceiling. A board that discharges its NIS2 obligations correctly is better positioned across all six frameworks than one that addresses each framework separately without a coherent governance architecture. 

The organisations that understand this now, and build the governance infrastructure accordingly, will not need to retrofit it when the AI Act enforcement regime matures, when the CER designation wave reaches their sector, or when the GDPR accountability principle produces its first major enforcement decision naming individual board members. 

One question to ask yourself today 

If you would like a practical assessment of where your organisation's personal liability exposure sits across the EU digital law frameworks that apply to you, and what a coherent governance architecture looks like for your specific sector and structure, Timelex would be glad to help. You can reach Geert Somers at geert.somers@timelex.eu or Lotte De Graeve at lotte.degraeve@timelex.eu. 

Geert Somers is a founding partner at Timelex and co-leads the firm's digital regulation and cybersecurity practice. Lotte De Graeve is associate at Timelex specialising in cybersecurity law and NIS2 compliance. This post reflects EU and Belgian law as it stood in June 2026 and is intended as general legal information. It does not constitute legal advice for any specific situation.