FREE TOOL
What does NIS2 ask the board itself to do?
Under the Belgian NIS2 law of 26 April 2024, the management body approves cybersecurity risk-management measures as a body and oversees them. Its own members follow training on cyber risk. They are personally liable if the company does not comply, and essential entities that miss ordered deadlines risk a temporary ban.
NIS2 board duty memo: Your company
What the management body itself approves, oversees and answers for under the Belgian NIS2 law of 26 April 2024.
1. Approve the measures, as a body, with a date
The management body (not one director acting alone) approves the company’s cybersecurity risk-management measures and oversees their implementation. Every member answers for that approval, which is why it belongs on a board or management meeting agenda, with a date in the minutes, not in one inbox (Art. 31 §1 of the Belgian NIS2 law; Art. 20(1) of the EU directive).
2. Members of the management body follow training themselves
The law does not ask the board to approve a training budget for others: its own members must follow training to identify cybersecurity risks and judge how risk-management measures affect the services the company delivers (Art. 31 §2; Art. 20(2)). No syllabus, duration or approved provider is fixed by law: the CCB’s own FAQ says each entity sets the content and duration itself, and the CCB does not recommend specific programmes.
3. Personal liability
Any natural person responsible for an essential or important entity, or acting as its legal representative, is personally liable for making sure the company follows the law (Art. 61). A partner’s or an IT provider’s signature on a policy does not move that liability: it stays with the people who can represent, bind or control the entity.
4. Essential entities only: the temporary ban
This specific sanction (Art. 60) applies to essential entities only. For an important entity, supervision is reactive, typically triggered after an incident rather than an upfront audit.
Who exactly is "the management body"?
The NIS2 directive itself does not define the term. The CCB’s FAQ on NIS2 in Belgium quotes the explanatory memorandum of the Belgian NIS2 law: anyone who may administer or represent the entity, anyone who takes (or takes part in taking) legally binding decisions for it, and anyone who controls it, meaning decisive influence over appointing most of its directors or over the direction of its management. A legal person in one of those roles is examined together with its own management body.
This memo prints as a one-pager via "Print or save as PDF" below.
What exactly does the law ask the board to do?
Four separate duties sit with the management body, not with an IT partner or a single director. First, approve the company’s cybersecurity risk-management measures and oversee their implementation (Art. 31 §1 of the Belgian NIS2 law, Art. 20(1) of the EU directive [1][2]). Second, follow cybersecurity training yourselves, to identify risks and judge their effect on the company’s services (Art. 31 §2, Art. 20(2)). Third, answer personally if the company does not comply (Art. 61). Fourth, and for essential entities only, risk a temporary ban on the CEO or legal representative if ordered measures are not taken in time (Art. 60, with Art. 52).
Who exactly counts as "the management body" is not defined in the directive itself. The Centre for Cybersecurity Belgium (CCB) answers it in its own FAQ on NIS2 in Belgium [3], quoting the explanatory memorandum of the Belgian law: anyone who may administer or represent the entity, anyone who takes, or takes part in taking, legally binding decisions for it, and anyone who controls it.
What does a board duty memo look like?
Fill in a company name and, if known, whether it is an essential or important entity. The tool below builds a one-page memo on the four duties above. The Art. 60 temporary-ban section shows only for essential entities, because it does not apply to important ones. Print it or save it as PDF and hand it to the board before the next meeting with security measures on the agenda.
An example: the CEO of a 90-person logistics firm signs a new security policy alone and tells the other directors not to bother reading it. That does not satisfy Art. 31 §1. Approval and oversight belong to the board as a whole, with a date in the minutes, and every director answers for it, whoever signed.
Not sure yet whether the company is essential, important or out of scope? Run the NIS2 scope check first, and see the fines at stake on the NIS2 fine calculator .
Want a document to bring into the meeting? The free Board Memo: NIS2 and CyFun puts these five points on paper, with the CyFun levels alongside them.
Frequently asked questions
- Who exactly is a "member of the management body" under NIS2?
- The directive does not define it. The CCB’s FAQ quotes the Belgian law’s explanatory memorandum: anyone who may administer or represent the entity, anyone who takes (or takes part in taking) legally binding decisions for it, and anyone who controls it through decisive influence over appointing its directors or over the direction of its management [3].
- Does the IT partner or MSP carry any of this liability?
- No. Approval, oversight and personal liability under Art. 61 sit with the natural persons who can represent, bind or control the entity, not with a service provider, however technical its work.
- What training does the law actually require?
- Members of the management body must follow training to identify cybersecurity risks and assess risk-management practices and their effect on the company’s services (Art. 31 §2). The law sets no syllabus, duration or approved provider; the CCB says each entity decides content and duration itself, and it does not recommend specific programmes.
- Can a director actually be banned from managing the company?
- For essential entities only, and only after ordered cybersecurity measures were not taken within the time given, not automatically after an incident. The CEO or legal representative can be temporarily banned from managerial functions, alongside a possible suspension of a certification or authorisation (Art. 60, with Art. 52).
- Does this apply the same way to an important entity?
- The approval, oversight and training duties (Art. 31 §1-§2) and personal liability (Art. 61) apply to both essential and important entities. The Art. 60 temporary-ban sanction is essential-entity only; important entities are supervised reactively, usually after an incident.
Related free tools
- NIS2 scope check Sector, size and a supply-chain step: see in about two minutes whether a company is an essential or important NIS2 entity, or out of scope, and which customer sectors push requirements down anyway.
- NIS2 fine calculator Pick what the Belgian NIS2 law makes your company and enter your group turnover. See the highest fine it allows.
2026-11-03
Computed with the free tool at https://easycyberprotection.com/learn/tools/nis2-board-duties/, by Easy Cyber Protection.
#CYBERLEARN