NIS2 Article 20 Management body accountability

Article 20 requires Member States to ensure that management bodies of essential and important entities approve the cybersecurity risk-management measures used to comply with Article 21 and oversee their implementation. It also says management bodies can be held liable for infringements by the entities of Article 21, subject to the national liability rules that apply to public institutions, public servants, and elected or appointed officials.

The practical decision is whether the board, executive committee, public-sector management body, or equivalent governing body has a documented approval and oversight path for the measures that protect the entity's network and information systems.

Start with entity classification. Article 20 applies to management bodies of essential and important entities, so the accountability record should point to the entity's NIS2 scope analysis, sector mapping, and Member State implementation position.

Then connect the governance record to Article 21. A management-body approval is weak if it only approves a high-level statement; it should identify the policy, risk framework, incident handling, supply-chain, business continuity, access control, asset, training, and effectiveness-assessment measures that the entity relies on for compliance.

The evidence should show that the management body understood what it approved and had a route to monitor implementation. ENISA's technical guidance treats the policy on the security of network and information systems as the highest-level security policy and says it should include the date of formal approval by the management bodies.

For covered entities using the implementing regulation and ENISA guidance, useful evidence includes the approved security policy, topic-specific policies, management review records, training records, briefings to management bodies, direct reporting lines, residual-risk approvals, and documented policy updates after significant incidents or major changes.

The most common mistake is treating Article 20 as a one-time board approval. NIS2 links approval to ongoing oversight, training, and the Article 21 risk-management system. A stale approval record will not explain how management was informed when risks, services, suppliers, or incidents changed.

Another risk is assuming the same evidence works in every Member State. NIS2 is an EU directive implemented through national law, and Article 20 expressly leaves certain public-sector and individual-liability questions to national rules.

Use this checklist before treating Article 20 as implemented. The goal is to make the governance record clear enough for legal review, audit review, security leadership, and a future regulator question.

Keep the checklist near the underlying evidence so the next review can reuse the same record instead of rebuilding the management-body narrative from memory.