Glossary term
NIS2 Art. 20
Also: NIS2 Article 20, Management body responsibility under NIS2
The NIS2 article that makes the management body of an essential or important entity directly accountable for approving and overseeing cybersecurity risk-management measures. Management bodies that fail this duty can be held personally liable.
NIS2 Art. 20 raises cybersecurity from an IT responsibility to a management-body responsibility. Boards must approve the risk-management measures listed in Art. 21, oversee their implementation and undergo regular training.
Practically this means that every material cybersecurity decision (EDR selection, IAM stack choice, sovereign cloud migration, incident-reporting process) must be documented at a quality level that lets the board genuinely oversee it. Policy documents alone are not sufficient.
In practice
Organisations that treat Art. 20 as a signature requirement underestimate the liability. Organisations that treat it as an ongoing oversight function build decision-memo infrastructure as the natural response.
Related terms
Decision memo
A short structured document that captures why a decision was made, the options considered, the criteria and trade-offs, the stakeholders involved and the accepted risks. A good decision memo is auditable months later.
Audit-ready decision
A decision whose record is structured, evidence-backed and stakeholder-signed to a level that a third-party auditor, a supervisor or a board reviewer can reconstruct the reasoning without interviewing the original team.
DORA ICT risk management
The EU Digital Operational Resilience Act regulates the operational resilience of financial entities against ICT risks, with particularly prescriptive expectations around ICT third-party risk management (Art. 28) and contractual arrangements (Art. 30).
NIS2
EU directive on network and information security. Replaces NIS1, widens scope to around 30,000 German companies in 18 sectors, introduces personal management body liability, sets ten minimum cybersecurity measures under Article 21.
AI Act Conformity Assessment
Procedure to demonstrate that a high-risk AI system complies with the EU AI Act before being placed on the market or put into service. Mandatory for all Annex III high-risk systems from 2 December 2027 (postponed from the original 2 August 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
AI Act Risk Categories
Four-tier classification under the EU AI Act: prohibited (Art. 5), high-risk (Annex I/III), limited risk (Art. 50 transparency), minimal risk. Classification is the first duty; it must be documented and defensible.
BAIT
BaFin circular that concretises IT requirements for credit institutions. Specifies MaRisk AT 7.2 for IT strategy, information security, user permissions, project management, application development, and IT outsourcing.
BCM
Discipline for maintaining critical business processes during disruptions. Standards: ISO 22301, BSI Standard 200-4. Mandatory under BAIT/VAIT and DORA Art. 11 in the financial sector.