German Executives Face Personal Liability Under New Cybersecurity Law – NIS-2 & DORA

The CEO’s New Cybersecurity Reality: Personal Liability and the NIS2 Directive

Germany’s top executives are facing a new era of accountability. The recently implemented NIS2 directive has fundamentally shifted the landscape of cybersecurity, making board members and CEOs directly liable for IT security failures. This isn’t just a matter of corporate risk; it’s a matter of personal financial and legal exposure.

Expanding Scope and Sharper Teeth: What NIS2 Changes

Effective since the beginning of 2026, the revised cybersecurity law impacts an estimated 30,000 companies. The scope of affected industries has dramatically expanded, extending beyond traditional critical infrastructure to include mid-sized businesses in sectors like food production, mechanical engineering, and waste management.

The requirements are comprehensive. Companies must establish systematic risk management, secure their supply chains, and maintain IT crisis contingency plans. Reporting obligations have also been tightened: significant security incidents must be reported to the Federal Office for Information Security (BSI) within 24 hours.

The Boardroom Takes Ownership

The most significant change directly impacts the executive suite. The law clearly places responsibility for cybersecurity with the management board. This means executives must not only approve security measures but also actively oversee their implementation.

Violations carry severe penalties. For particularly important entities, fines can reach up to 10 million euros or two percent of global annual revenue. Critically, executives can be held personally liable and temporarily removed from their positions.

To meet this responsibility, executives are now legally required to undergo cybersecurity training, with a minimum frequency of once every three years. Experts emphasize that all board members are jointly and severally liable, demanding cross-departmental collaboration.

A Regulatory Wave is Building

NIS2 is just the first wave of a larger regulatory shift from Brussels. Financial service providers must simultaneously implement the Digital Operational Resilience Act (DORA), which establishes specific rules for digital resilience, particularly concerning risks from cloud providers.

The AI Act will add further complexity starting in August 2026, bringing extensive documentation and governance requirements for the use of artificial intelligence. Companies need integrated compliance structures that encompass GDPR, NIS2, DORA, and AI regulations.

From Cost Center to Competitive Advantage

The economic impact of cyberattacks is substantial. In Germany alone, data theft, espionage, and sabotage caused approximately 289.2 billion euros in damages in 2025. Investments in digital security are no longer simply a cost; they are a strategic imperative.

Analysts view this development as a logical consequence of digitalization. Robust corporate governance – as demanded by ESG criteria – now inherently includes a comprehensive strategy for digital resilience. The new laws compel executives to recognize cybersecurity as a core issue that directly impacts customer and partner trust.

Compliance: An Ongoing Commitment

The regulatory momentum will not sluggish down. Further EU initiatives, such as the Data Act and the revised Product Liability Directive, are on the horizon, bringing new obligations for data access and expanded liability risks for AI systems.

2026 marks a turning point for German executives. Personal responsibility for digital security is now legally enshrined and irreversible. Proactive action, clear responsibilities, and continuous investment in technology and expertise are the only ways to minimize risks. The days of simply delegating cybersecurity to the IT department are over.