IT Security Is Now a Top Priority: Directors’ Personal Responsibility for Cyber Risks

Cyberattacks are among the existential threats facing modern corporate management. With the entry into force of the NIS 2 Implementation Act and the far-reaching reform of the Federal Office for Information Security Act (BSIG), the German legislature has drastically tightened the requirements for IT risk management. More than ever, board members and managing directors bear personal responsibility. This post highlights the organizational and liability-related requirements that management must now strictly observe and fulfill, where their discretion ends, and how tasks can be delegated in a manner that protects against liability.

The New Regulatory Landscape: NIS-2, the Reformed BSIG, and the KRITIS Framework Act

The threat posed by cybercrime, espionage, and sabotage—exacerbated by geopolitical conflicts and the use of artificial intelligence—has reached an unprecedented level of intensity. According to recent Bitkom surveys, annual losses to the German economy amount to over 280 billion euros, with a large portion directly attributable to cyberattacks such as ransomware.Source: Bitkom e.V., Wirtschaftsschutz 2024 – Angriffe auf die deutsche Wirtschaft nehmen zu, August 2024.Show Footnote

Legislators have responded: On December 6, 2025, the law implementing the European NIS 2 Directive went into effect, fundamentally amending the BSIG. As a result, the number of affected companies in Germany has suddenly increased tenfold to an estimated 30,000. These are divided into:

• Critically Important Entities: e.g., large companies in key sectors such as energy, transportation, or digital infrastructure with 250 or more employees or 50 million euros in revenue,
• Important Entities: medium-sized companies with 50 or more employees or 10 million euros in revenue in regulated sectors.

Pursuant to Section 30(1) of the BSIG, these entities must implement appropriate, proportionate, and effective technical and organizational measures (TOMs) to prevent disruptions to IT systems and minimize the impact of incidents. Section 30(2) of the BSIG specifies this in the form of ten minimum requirements that constitute a comprehensive cybersecurity architecture (including risk analyses, incident response, backup management, supply chain security, encryption, multi-factor authentication, and regular training). Operators of critical infrastructure must also maintain attack detection systems in accordance with Section 31 of the BSIG.

In parallel, and to some extent overlapping, the KRITIS Framework Act (KRITIS-DachG) requires a physical “all-hazards approach” (protection against sabotage, natural disasters, etc.). Accordingly, pursuant to Section 12 of the KRITIS Framework Act, a facility-specific risk analysis must be conducted at least every four years.

Corporate Law Perspective: Where Directors’ Discretion Ends

The issue of cybersecurity by no means affects only directly regulated industries. Under general principles of corporate law (Section 93(1) of the German Stock Corporation Act (AktG), Section 43(1) of the German Limited Liability Companies Act (GmbHG)), every director is obligated to exercise the diligence expected of a prudent and conscientious executivdirector.

• Section 91(2) of the German Stock Corporation Act (AktG) requires the executive board to establish an early risk detection system to identify risks that threaten the company’s continued existence. IT and cyber risks are generally classified as such threats to the company’s continued existence.
• Section 91(3) of the German Stock Corporation Act (AktG) further requires the executive boards of publicly traded companies to maintain an appropriate and effective internal control system (ICS) and risk management system (RMS).
• These obligations apply equally to managing directors of a limited liability company (GmbH) through the guiding role and broader impact of the special statutory provisions, based on the general duties of care under Section 43 of the German Limited Liability Companies Act (GmbHG).

In particular, the statutory minimum standard set forth in Section 30(2) of the Federal Office for Information Security Act (BSIG) serves as a significant guiding principle for corporate law as a whole. The closer a company not directly regulated by law comes to the statutory thresholds in terms of size, industry, and risk profile, the more the ten minimum measures specified therein serve as a framework for the general duty of care under civil law.

With regard to liability protection under the Business Judgment Rule (BJR) within the meaning of Section 93(1), sentence 2, of the German Stock Corporation Act (AktG), a strict distinction must be made between the “whether” and the “how”:

1. “Whether”: To the extent that a company falls within the scope of the BSIG, the KRITIS-DachG, or other special laws, management has no discretion regarding “whether” to implement the measures required by law. Implementation is a legally binding obligation (duty of legality). Waiving individual minimum measures based on cost-benefit considerations constitutes a breach of duty giving rise to liability and is not protected by the BJR.
2. “How”: Management retains entrepreneurial discretion regarding the specific technical design, the selection of IT security service providers and software products, and organizational placement. As long as these decisions are made on the basis of adequate information, free from conflicts of interest, in the presumed best interests of the company, and are properly documented, the BJR’s liability protection applies.

Division of Labor and Delegation: Overall Responsibility Remains Non-Transferable

Establishing a cybersecurity management system requires a high level of expertise. Management must therefore distribute these tasks within day-to-day operations. The law and case law distinguish between two dimensions in this regard:

1. Horizontal Delegation (allocation of responsibilities within a collegial body)

Assigning operational cybersecurity to a specific member of the executive board (e.g., the Chief Information Officer) is permissible and advisable within the framework of a proper allocation of responsibilities. This limits primary responsibility for action to the designated member.

For the other members outside that area of responsibility, however, the duty transforms into a duty to observe and monitor. They may rely on the proper fulfillment of these duties as long as no warning signs or irregularities are apparent. In the event of identifiable deficiencies or persistent security vulnerabilities, the duty to intervene immediately and to bring the matter before the entire governing body is once again mandatory for all members (see the recent Federal Court of Justice [BGH] ruling of November 9, 2023—III ZR 105/22).

2. Vertical Delegation (to the CISO, IT Department, and Business Units)

Despite the misleading wording in Section 38(1) of the German Business Information Security Act (BSIG), which states that management must “implement” risk management measures, vertical delegation to subordinate employees (e.g., a Chief Information Security Officer—CISO) or external IT service providers is permissible under corporate law and is unavoidable in practice. However, delegation does not relieve management of its responsibility. Rather, the duty to act transforms into a specific duty of care regarding delegation. Management is subject to strict obligations in this regard:

• Careful selection: The delegate (e.g., CISO) must be fully qualified both professionally and personally.
• Clear instructions and assignment of tasks: Tasks, authorities, reporting channels, and escalation thresholds must be unambiguously defined in writing.
• Ongoing monitoring: Management must establish a functioning reporting and information system. It must conduct random checks and have the effectiveness of the measures regularly reviewed (e.g., by Internal Audit).

The final decision and ultimate strategic responsibility must remain with the executive body (principle of ultimate responsibility). Executives must be presented with the key measures and concepts, understand and expressly approve them, and make the relevant fundamental decisions themselves.

In addition, Section 38(3) of the BSIG mandates a personal, non-delegable training obligation for management to acquire basic knowledge of cyber risk management (proposed frequency: at least every three years).

3. Specific Features in Corporate Groups

Security infrastructures are often centralized within corporate groups (e.g., through a group-wide Security Operations Center or a Group CISO). Legally, however, the principle of decentralized individual responsibility applies: The management of each individual subsidiary remains personally responsible and liable for the IT security of its own company. Centralized corporate guidelines must not be adopted blindly; local management must ensure that these guidelines meet specific local operational and regulatory requirements and that clear, contractually defined escalation procedures are in place in the event of a crisis.

Liability in an Emergency: No External Liability, but Strict Internal Liability

If a cyberattack occurs as a result of inadequate cybersecurity measures and the company suffers damages as a result (e.g., due to operational downtime or regulatory fines), management faces the risk of personal liability:

• Internal liability to the company: Pursuant to Section 38(2) of the German Securities Supervision Act (BSIG) in conjunction with Section 93(2) of the German Stock Corporation Act (AktG) or Section 43(2) of the German Limited Liability Companies Act (GmbHG), the management is personally liable to the company for culpable breaches of duty. Since, in the event of a dispute, management must prove that it exercised the due care of a prudent manager (reversal of the burden of proof, Section 93(2), second sentence, of the German Stock Corporation Act (AktG)), comprehensive documentation of risk analyses, board resolutions, and effectiveness reviews is the most important safeguard against liability claims.
• Exclusion of tortious external liability: Personal external liability of the management directly toward injured third parties (e.g., customers whose data was stolen) pursuant to § 823(2) of the German Civil Code (BGB) in conjunction with § 30 of the German Securities Supervision Act (BSIG) should ultimately be rejected for good reasons. In line with the established case law of the Federal Court of Justice (BGH) regarding supervisory organizational obligations, § 30 BSIG is unlikely to constitute a protective statute within the meaning of tort law. The provision serves the regulatory purpose of averting risks and protecting the general public; the protection of individual assets is merely a “legal reflex” that does not give rise to a claim.

With regard to the necessary oversight by the supervisory board, the following applies: The executive board’s reporting and disclosure obligations to the supervisory board are mandatory obligations to provide information. The Executive Board is liable for deficient IT risk reporting; the Supervisory Board, in turn, is obligated to conduct proactive investigations in the event of reports that are unclear (see the recent Federal Court of Justice [BGH] decision of October 14, 2025—II ZR 78/24).

Practical Note: What Companies Should Do Now

To protect against liability risks and strengthen digital resilience, companies should initiate a structured cybersecurity legal review as soon as possible:

1. Determine regulatory scope: Assess whether the company falls under the reformed BSIG as an “important” or “critically important” entity, or whether it is subject to general corporate law organizational obligations based on the BSIG’s guiding principles.
2. Align with TOMs and minimum requirements: Compare existing IT security measures in detail against the ten minimum requirements of Section 30(2) of the BSIG and close any gaps.
3. Document delegation structures in writing: Precisely define vertical delegations (e.g., CISO responsibilities) without overlap and establish a transparent reporting and escalation system.
4. Implement the training requirement: Schedule and document mandatory and regular participation by the entire executive management team in cybersecurity training.
5. Document decisions: Document all IT risk assessments (particularly cost-benefit proportionality regarding the “how”) as well as audit reports in a tamper-proof manner to address the reversal of the burden of proof under corporate law.
6. Review insurance coverage: Consider taking out specialized cyber insurance (including potential ransom clauses in the event of ransomware attacks) while closely coordinating the contractual obligations.