Your Directors Are Personally Liable for Cybersecurity. Most of Them Likely do not Know it Yet.

Preliminary remark: while this post draws on Belgian legislation as a concrete example, the underlying EU framework applies similarly across all Member States. Belgium is a particularly useful lens as it was among the first to transpose NIS 2 (Directive (EU) 2022/2555) into national law (the NIS 2 Law), and the Centre for Cybersecurity Belgium (‘CCB’) is widely regarded as one of Europe's most active and technically sophisticated cybersecurity regulators. 

Two questions recur whenever a board reviews its NIS 2 compliance status. The first is whether cybersecurity is genuinely a board matter or whether it can be delegated to the IT security function. The second is whether each director must personally attend cybersecurity training. 

On both questions, the NIS 2 Law is unambiguous. A board member cannot delegate the obligation away, and each member must personally complete the training. The consequence of getting this wrong is not just a possible fine for the company. It may also include enforcement measures and fines against board members, personally. Those measures go far and even include temporary suspension from your managerial role, and public disclosure of the infringement. This post explains how we got here, what the law actually requires, and what the minimum defensible governance position looks like. 

What Changed? And why does it matter? 

Under the previous NIS 1 framework, cybersecurity enforcement targeted the company. Directors of operators of essential services could, in practice, remain entirely passive on cybersecurity matters without any meaningful personal exposure. The company might receive a fine or a binding instruction. The board was not yet in the firing line. 

NIS 2 deliberately ended that arrangement. The legislative intent is explicit: cybersecurity governance must be driven from the top. Boards that treat cybersecurity as a technical matter to be handled by IT, without strategic oversight and documented engagement at board level, are not just organisationally exposed. They are legally exposed. 

A Two-Fold Mechanism 

Article 31 of the Belgian NIS 2 Law imposes three obligations directly on the management body as an organ. 

• First, the management body must approve the cybersecurity risk management measures and oversee their implementation, this cannot be delegated to management or to the CISO. 
• Second, every member of the management body must personally follow cybersecurity training sufficient to understand the organisation's risk profile, assess the management practices in place and make informed decisions about the programme and budget. This training obligation is statutory and mandatory, it is not just a recommendation. 
• Third, members of the management body may be held personally liable for infringements of the NIS 2 Law by the entity, where those infringements result from a breach of the management body's obligations under national applicable corporate law. 

In addition, Article 61 of the NIS 2 Law gives the inspection service of the CCB direct enforcement power against individual management body members where the entity repeatedly and systematically fails to comply with its obligations. The CCB can impose temporary suspension from all managerial roles within the entity, permanent prohibition from managing any NIS 2-regulated entity in the most serious cases, and public disclosure of the responsible individual and the infringement. These are not just theoretical powers as the CCB has already made clear through its supervisory communications that it intends to use them.

A nuance worth acknowledging

The NIS 2 Law contains no exemption for directors who play no role in day-to-day operations, non-executive directors or political appointees . If you hold a board seat at an essential or important NIS 2-entity, you are within scope. 

Some organisations take a risk-based view that a purely passive, non-executive director with no role in decision-making sits at the outer edge of the intended scope. That is a risk position, not a legal exemption, and the statutory text draws no such line. Even a director who relies on it should, at a minimum, be informed of the obligation and document the decision, because passive ignorance is the worst position of all. 

What the law actually requires: five things 

Stripped of complexity, the minimum defensible position for a management body member at an essential entity under NIS 2 involves five things. 

• The first is formal approval of the cybersecurity governance framework, specifically, a Cybersecurity Governance Charter and an Information Security Policy. The board approves these documents and records that approval in the minutes; management then implements them. 
• The second is formal approval of the multi-year cybersecurity programme and budget. For an essential entity of any significant size, a credible programme requires meaningful investment. Approving a nominal budget is not oversight. 
• The third is regular, structured reporting. The board should receive regular, non-technical reporting on the programme. The board reviews it, asks questions, and the minutes record that it did so. This is the evidentiary record that matters when the CCB comes calling. 
• The fourth is mandatory training. It is a statutory requirement, not a recommendation. A proportionate annual session is sufficient. It must be documented: who attended, when, and what was covered. 
• The fifth is documentation of everything. The clearest lesson from enforcement in compliance-driven fields is that exposure is often linked to the absence of a documented trail, not the absence of a programme. Boards that have been doing the right things but have no paper trail are almost as exposed as boards that have done nothing. 

The cumulative liability picture 

NIS 2 liability does not stand alone. It sits on top of the general duty of care that Belgian company law already imposes on directors, and it raises the bar for what a prudent director is expected to do. In 2026, a normally prudent director of an essential entity is expected to have approved a cybersecurity programme, allocated a budget, and received regular reporting; a director who has done none of these is far more exposed than the same director would have been a few years ago. Where fault causes damage, that exposure can run not only toward the company but toward third parties such as affected customers or business partners. 

The Belgian Data Protection Authority has also begun cross-referencing NIS 2 standards when it assesses cybersecurity obligations under the GDPR. A single incident can therefore trigger parallel enforcement from both the CCB and the GBA/APD, each with its own penalty ceiling. 

One question to ask yourself today 

If you would like to discuss what the NIS 2 management body obligations mean for your board specifically, including how to structure the governance framework, the mandatory training, or your response to the CCB's supervisory requests, Timelex would be glad to help. You can reach Geert Somers at geert.somers@timelex.eu or Pedro Demolder at pedro.demolder@timelex.eu. 

Geert Somers is a founding partner at Timelex and co-leads the firm's digital regulation and cybersecurity practice. Pedro Demolder is a senior associate at Timelex specialising in cybersecurity law and NIS 2 compliance. 

This post reflects EU and Belgian law as it stood in June 2026 and is intended as general legal information. It does not constitute legal advice for any specific situation.