NIS2 Article 20 requires the management bodies of essential and important entities to approve the cybersecurity risk-management measures, oversee their implementation, and says they can be held liable for infringements of Article 21. Members of those bodies must also follow cybersecurity training. This is a board and executive duty, not only a security team task.
What the text says
Article 20(1): management bodies must "approve" the measures taken to comply with Article 21, "oversee" their implementation, and "can be held liable" for infringements. The same paragraph is without prejudice to national liability rules for public institutions and officials. Because NIS2 is a directive, how liability works in practice depends on national law.
Article 20(2): members of management bodies must follow training, and member states must encourage entities to offer similar training to employees regularly. The goal given is enough knowledge and skill to identify risks and assess cybersecurity risk-management practices and their effect on services.
What approval should look like
A signature on a slide is thin evidence. Better:
- A dated record that the board or executive team reviewed the risk analysis and the ten Article 21(2) measure areas.
- Minutes showing questions asked and decisions made, including budget.
- A named executive owner for each measure area.
- A schedule for re-approval, at least yearly and after a major incident.
What oversight should look like
Oversight means regular information, not annual surprise. A simple quarterly pack can include:
- Open critical vulnerabilities and age of the oldest.
- Incident counts and any reports filed.
- Results of the last backup restore test.
- Supplier risks and contract gaps.
- Training completion rates, including for management.
- Exceptions the company has accepted, and who accepted them.
What training should cover
The text asks for knowledge to assess risks and practices. Useful topics for directors: how incident reporting deadlines work, what the supervisor can request, how supply chain risk shows up in your products, and how to read the metrics pack above. Keep attendance records and note the date and content.
Link it to the other measures
Article 20 only works if there is something to approve. Tie each approval to the Article 21(2) areas: risk policy, incident handling, continuity, supply chain, secure development and the rest. A one page map from measure to owner to latest evidence makes board review quick and shows oversight is real.
A caution on liability language
Do not describe personal liability in marketing or internal memos as certain. The directive says management bodies "can be held liable", and national implementations differ. If your leadership asks for specifics, take advice from counsel in the relevant member state.
Safeguard's compliance and evidence automation can help assemble the metrics pack from scan and policy data. The approvals and decisions themselves remain the leadership team's own.
Quick check
Does Article 20 apply to small startups?
It applies to entities within NIS2 scope. Check size and sector rules and your national law to see whether you are covered.
Is one board training session enough?
The text says training should happen, and encourages regular training for employees. A single session is unlikely to be viewed as regular, so plan a recurring schedule.
Sources
Last reviewed: 19 October 2026.
