Bottom line: According to Börse Express, under NIS2 managing directors are personally liable for cybersecurity failures as soon as a company reaches a size of 50 employees.
According to Börse Express, the NIS2 Directive provides for personal liability of managing directors once companies reach the threshold of 50 employees. This shifts cybersecurity from a purely technical matter into the direct responsibility of company leadership.
The report provides no further details on the level of fines, specific obligations, or implementation deadlines.
According to the report by Börse Express, the NIS2 Directive ties personal liability of managing directors to company size: the rule already applies from 50 employees onward. The original article contains no further information on specific revenue thresholds, fine ranges, or the precise status of transposition into national law.
For CISOs and management teams, personal liability means that questions of information security can no longer be delegated solely to IT or security departments. Decisions on budget, resources, and risk management in cybersecurity thus become a matter that personally affects company leadership and must be demonstrably documented.
In practice, this means: companies with 50 or more employees that fall within the scope of the NIS2 Directive should check whether and in what form they are classified as an affected entity, what governance structures exist for demonstrating compliance to management, and whether responsibilities and reporting obligations are clearly assigned. The article itself does not name further implementation details, so for reliable statements on deadlines and sanction amounts, consulting the respective national implementing legislation remains necessary.
Source: news.google.com · Published August 8, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.