NIS2 penalties and the personal liability of directors

NIS2 sets fine ceilings designed to be dissuasive even for large groups: up to €10 million or 2% of annual global turnover for essential entities, whichever is higher; up to €7 million or 1.4% for important entities. In Italy, Legislative Decree 138/2024 mirrors these same European ceilings and adds its own national sanctioning framework for procedural breaches, with amounts ranging from €5,000 to €5 million.

The number makes headlines, but it is not the part that should change a board’s behaviour. The directive allows management bodies to be held personally accountable for failing to oversee risk-management measures — and the Italian decree provides, for serious and persistent governance failures, the possibility of temporarily suspending the individuals running the company.

What "oversight" actually means in practice

It does not mean every director must become a technical expert. It means the board must be able to show it approved the risk-management measures, followed their implementation on a defined cadence, and received adequate training — the same training the directive explicitly requires for members of management bodies. A board that receives an unreadable technical report once a year, without discussing it, is not overseeing anything; it is filing it away.

What to put on record before it matters

The difference between a board that can answer for itself and one that is exposed often lies in the minutes: were cyber-risk decisions discussed and reasoned through, or simply rubber-stamped without debate? Was it recorded who raised which objection? Was a roadmap with verifiable deadlines actually followed? None of this prevents an incident, but it is what separates documented oversight from presumed negligence when someone asks for an account of what happened.

The takeaway

The fine ceiling is the company’s problem. Personal liability is the problem of whoever sits on the board. Treating them as the same risk means worrying about the wrong number.